Legal Things

Version 1.0 · Effective 2 November 2026 for new accounts and 2 December 2026 for existing accounts

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Moonshot Ventures Inc., trading as Basin ("Basin"), and the customer that uses the Service under those Terms (the "Controller"). It applies whenever Basin processes personal data on the Controller's behalf, and needs no separate signature.

1. Definitions

"Personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in the GDPR. "Data Protection Law" means the GDPR (EU) 2016/679, the UK GDPR, the Swiss Federal Act on Data Protection, and any other data protection law that applies to the processing under this DPA. "Controller Personal Data" means personal data Basin processes on the Controller's behalf to provide the Service. "Service" means the Basin service described in the Terms of Service. "Subprocessor" means a third party Basin engages to process Controller Personal Data.

2. Roles

2.1. The Controller is the controller of Controller Personal Data, and Basin is its processor. Where the Controller processes Controller Personal Data on behalf of its own client, the Controller is that client's processor and Basin is its subprocessor. In that case the Controller confirms that its client has authorised it to engage Basin on these terms, its instructions to Basin include those it passes on from its client, and Basin deals only with the Controller, which passes Basin's notices and assistance on to its client. Annex I describes the processing.

2.2. Basin also uses Controller Personal Data as an independent controller, only to: (a) keep the Service secure and working, including preventing spam, phishing, fraud, and other abuse; (b) comply with laws that apply to Basin; (c) establish, exercise, or defend legal claims; and (d) produce aggregate statistics that identify no individual. Basin's Privacy Policy describes this processing. Basin does not use Controller Personal Data for any other purpose of its own, and does not sell it.

3. The Controller's Obligations

The Controller is responsible for having a lawful basis for the personal data it collects through the Service, for giving data subjects the notices and obtaining the consents the law requires, for the fields and content of its forms, and for making sure its instructions to Basin comply with Data Protection Law. The Controller is also responsible for its own security choices in the Service, such as two-factor authentication, team access, secure attachment links, and verifying webhook signatures, and for keeping its API keys and attachment links confidential.

4. Basin's Obligations

4.1. Basin will:

• (a) process Controller Personal Data, including transferring it to another country, only on the Controller's documented instructions, which are this DPA, the Terms of Service, and the Controller's use and configuration of the Service. Other instructions need Basin's written agreement. If the law requires Basin to process it otherwise, Basin will tell the Controller first, unless that law prohibits it on important grounds of public interest. Basin will tell the Controller immediately if it believes an instruction infringes Data Protection Law;
• (b) ensure that the people it authorises to process Controller Personal Data are bound by confidentiality;
• (c) maintain the technical and organisational measures Article 32 of the GDPR requires, including those in Annex II;
• (d) engage Subprocessors only as set out in Section 5;
• (e) help the Controller, taking into account the nature of the processing, to respond to data subjects exercising their rights. If a data subject contacts Basin about Controller Personal Data, Basin will pass the request to the Controller where it can identify the Controller, and will act on it only on the Controller's instructions or where the law requires;
• (f) help the Controller meet its obligations on security, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of the processing and the information available to Basin;
• (g) return and delete Controller Personal Data as set out in Section 7; and
• (h) provide information and allow audits as set out in Section 8.

Where the law allows, Basin may charge its reasonable costs for assistance under (e) and (f) beyond the Service's self-service tools, unless the assistance is needed because Basin breached this DPA.

4.2. If a public authority asks Basin to disclose Controller Personal Data, Basin will try to redirect it to the Controller, notify the Controller unless the law prohibits it, challenge the request where it has reasonable grounds to consider it unlawful, and disclose only the minimum the request requires.

4.3. Where the California Consumer Privacy Act or another US state privacy law applies, Basin is the Controller's service provider or processor under it. Basin will not sell or share Controller Personal Data; retain, use, or disclose it for any purpose other than those in this DPA, or outside its direct business relationship with the Controller; or combine it with personal data from other sources, except as that law permits. Basin will comply with that law, give the level of privacy protection it requires, and tell the Controller if it can no longer meet its obligations under it. If Basin uses Controller Personal Data in breach of this Section, the Controller may take reasonable and appropriate steps to stop and remediate it.

5. Subprocessors

5.1. The Controller gives Basin general authorisation to engage Subprocessors. Basin's current Subprocessors, with their locations and transfer mechanisms, are listed at usebasin.com/gdpr#subprocessors. Services the Controller connects or configures, such as integrations, webhook destinations, and AI assistants, receive data on the Controller's instructions under the Controller's own agreement with them, and are not Subprocessors.

5.2. Basin engages each Subprocessor under a written contract, which may be the Subprocessor's standard data processing terms, that gives at least the same level of protection as this DPA. A Subprocessor's terms may let it use data for limited purposes of its own, such as securing its services or producing de-identified statistics. Basin remains liable to the Controller for its Subprocessors.

5.3. Basin will email the Controller at least 14 days before a new or replacement Subprocessor starts processing Controller Personal Data. A Subprocessor used only by a feature the Controller chooses to turn on needs no advance notice, as long as Basin names it where the feature is turned on. If the Controller objects on reasonable data protection grounds within those 14 days and Basin cannot reasonably accommodate the objection, the Controller may terminate the Service for the affected processing.

6. Personal Data Breaches

Basin will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller Personal Data, and will give the Controller the information it reasonably needs to meet its own obligations as that information becomes available. Notifying a breach is not an admission of fault or liability.

7. Return and Deletion

7.1. The Controller can export Controller Personal Data from the dashboard or API, and delete it or its account, at any time while the account is active. This export is how Basin returns the data. If Basin suspends or terminates the account, Basin will make Controller Personal Data available for export if the Controller asks within 14 days, unless the law prohibits it or the data was collected in breach of the acceptable use rules in the Terms of Service.

7.2. When the Controller deletes Controller Personal Data or its account, asks Basin to, or the Service ends (after the 14-day export period in Section 7.1 if the Controller asked for one), Basin deletes it from its live systems promptly. Copies in backups, logs, support tickets, and Subprocessors' systems are deleted as they expire on their normal schedules. Basin may keep data for longer only where the law requires it, or for its own purposes under Section 2.2 for as long as those purposes need it. Basin keeps two logs for 6 months as its own security and accountability records (Section 2.2(a)): its change log of changes made by Basin staff and Basin's own automated tools, which keeps the identifiers, status, and times of affected submissions, email logs, and chat conversations but not their content, and its log of requests made by AI assistants the Controller connects to Basin, which records what each request did with its content removed or masked. Basin will confirm deletion in writing on request.

8. Information and Audits

Basin will make available the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR, and will allow for and contribute to audits, including inspections, by the Controller or an independent auditor it mandates. Basin will first answer an audit request in writing. Where the Controller reasonably needs more, an audit or inspection requires at least 30 days' written notice; takes place no more than once in any 12 months, unless a supervisory authority requires it or it follows a personal data breach affecting Controller Personal Data; happens during business hours without unreasonable disruption; is limited to this DPA and Controller Personal Data; is at the Controller's cost, including Basin's reasonable costs; and follows a confidentiality agreement acceptable to Basin. Basin need not disclose trade secrets or privileged information.

9. International Transfers

Transfers to Basin in Canada rely on the EU, UK, and Swiss adequacy decisions for organisations subject to Canada's PIPEDA. Where a Subprocessor processes Controller Personal Data in a country without an adequacy decision, Basin relies on the transfer mechanism listed for that Subprocessor: the EU Standard Contractual Clauses (with the UK Addendum for UK data, and applied to Swiss data for Swiss transfers), or the EU–U.S. Data Privacy Framework, its UK Extension, or the Swiss–U.S. Data Privacy Framework where the Subprocessor is certified. If a mechanism becomes invalid, Basin will use reasonable efforts to adopt another. If it cannot, the Controller may terminate the Service for the affected processing.

10. General

10.1. This DPA applies for as long as Basin processes Controller Personal Data. Provisions that by their nature should survive termination survive it.

10.2. Basin may update this DPA by publishing a new version at usebasin.com/dpa, which applies from its effective date. Earlier versions are available on request. Basin will email the Controller at least 15 days before an update that reduces the Controller's protections takes effect. If the Controller objects in writing before then, it may terminate the Service for the affected processing. Subprocessor changes follow Section 5.3.

10.3. If this DPA conflicts with the Terms of Service on data protection, this DPA prevails. The limitations of liability in the Terms of Service apply to claims under this DPA, except where Data Protection Law does not allow them.

10.4. This DPA is governed by the law that governs the Terms of Service, except where Data Protection Law requires otherwise. If any provision is invalid, the rest continues in effect. From its effective date, each version of this DPA replaces any earlier data processing agreement between the parties for the Service, whether signed or not. Basin will sign a copy on request.

---

Annex I: Description of Processing

Parties: the Controller (as above) and Moonshot Ventures Inc., trading as Basin, as processor. Contact: support@usebasin.com.

Subject matter and duration: the provision of the Service, until the data is deleted under Section 7.

Nature and purpose: collecting, storing, screening for spam and abuse, delivering (for example by email, SMS, webhooks, and integrations the Controller connects), processing with AI features the Controller uses, hosting, and deleting personal data, to provide the Service on the Controller's instructions. This includes checking the accuracy of spam filtering against submissions the Controller corrects, which the Controller can turn off in its settings.

Data subjects: people who submit or interact with the Controller's forms, hosted pages, chat widgets, and other Basin-powered features.

Personal data: whatever the Controller's forms and features collect, typically names, contact details, message content, and files, plus technical data such as IP address and the approximate location derived from it, browser and device details, and usage events. Basin does not need special category data; the Controller is responsible for any it chooses to collect.

Annex II: Security Measures

• Encryption: data is encrypted in transit over public networks and at rest. Passwords are hashed, and API keys and integration tokens are encrypted.
• Access: customer accounts support role-based access and two-factor authentication, and sign-in is protected against repeated attempts. Basin staff can access production data only as their role needs, are bound by confidentiality, and administrative changes to accounts are logged.
• Network: inbound traffic passes through a web application firewall and DDoS protection.
• Abuse protection: file attachments are scanned for malware where the file type can be scanned, and submissions are screened for spam and abuse.
• Attachment links: links to attachments can open the file for anyone who has them, so the Controller should treat them as confidential.
• Monitoring: errors and performance are monitored, with credentials and common personal-data fields filtered from error reports.
• Retention: data is deleted automatically according to the Controller's retention settings and Basin's retention limits.
• Backups: data is backed up, including encrypted off-site copies, and backups expire on a rotation.
• Development: code changes are tested before release, and third-party libraries are monitored for vulnerabilities.
• Incidents: Basin maintains a breach response plan.