Data Processing Agreement (GDPR art. 28) — Moments

This is a translation of the Dutch Verwerkersovereenkomst. In the event of any difference or inconsistency, the Dutch version prevails.

Version: 2026-11-02
Product: Moments (https://moments.business)
Developer and provider: Learnable BV, trading as For The Dream

This data processing agreement applies to B2B clients who have personal data processed by Learnable BV through Moments.

Parties

Controller (the “Controller” / the “Client”):

The business or organisation that purchases Moments, as identified in the account registration and the order or activation confirmation. The legal form, name, company number, address and authorised representative stated therein apply for the purposes of this agreement. The privacy contact provided or, in the absence thereof, the registered company admin is the point of contact. The Client keeps these details up to date.

and

Processor (the “Processor” / “Learnable”):

Hereinafter jointly the “Parties”.

Recitals

A. The Client uses the SaaS service Moments, developed and offered by Learnable BV for time tracking and the modules activated by the Client.
B. In that context, Learnable processes personal data of the Client's team members and users on behalf of the Client.
C. The Client is the controller; Learnable is the processor for that processing (GDPR).
D. The Parties wish to comply with art. 28 GDPR and hereby record their arrangements in writing.
E. This Data Processing Agreement (the “DPA”) forms part of the agreement for the provision of Moments (including the Moments General Terms and Conditions) and, in the event of a conflict, prevails with regard to data protection over other provisions, unless expressly agreed otherwise in writing.

Article 1 — Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “personal data breach” and “supervisory authority” have the meaning given to them in the GDPR (Regulation (EU) 2016/679).

Other terms defined in the Moments General Terms and Conditions also apply here, unless otherwise provided.

Article 2 — Subject matter and duration

2.1. The Processor processes personal data exclusively for the purpose of the provision, support, security and improvement (within the limits of this DPA) of Moments for the Client.

2.2. This DPA enters into force on the date of signature or, in the case of digital acceptance, at the time of acceptance / activation of the Moments subscription, and applies for as long as the Processor processes personal data for the Client in the context of Moments.

2.3. Provisions which by their nature survive (confidentiality, liability, return/erasure) continue to apply after termination.

Article 3 — Roles and instructions

3.1. The Client determines the purposes and means of the processing of data that it has processed through Moments and is responsible for:

• a valid legal basis towards data subjects and, for special categories of personal data, an applicable exception in accordance with art. 9 GDPR;
• information obligations towards data subjects;
• the accuracy of the instructions;
• the lawful use of Moments.

3.2. The Processor processes personal data only on documented instructions from the Client, including with regard to transfers, unless Union or Member State law requires otherwise (in which case the Processor informs the Client before the processing, unless that law prohibits this).

3.3. The Moments service itself, the documentation, this DPA and reasonable support requests from the Client constitute instructions. Additional or deviating instructions are given in writing (email suffices) and may lead to additional costs, or to impossibility where they are not technically or legally feasible.

3.4. The Processor immediately informs the Client if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

3.5. Learnable as controller: for CRM, website visitors, leads, its own marketing and the invoicing of the Client as a contracting party, Learnable acts as an independent controller. This falls outside the subject matter of this DPA, except where those activities inevitably overlap with support for Moments.

Article 4 — Data map (description of processing)

4.1 Categories of data subjects

• Team members, freelancers, admins and other users of the Client;
• Contact persons of clients, projects and submitted requests;
• Recipients of newsletters that the Client manages or sends;
• Persons whom the Client mentions in tasks, comments, notes or files, insofar as their data is provided for the assignment.

4.2 Categories of personal data

4.3 Special categories

When managing sickness absences, health data may be processed, including the period of absence and a certificate intended for the employer. For this, the Client determines both a legal basis in accordance with art. 6 GDPR and an applicable exception in accordance with art. 9 GDPR, and limits the processing and access to what is necessary for staff administration. A diagnosis or other non-essential medical information does not belong in this administration. The free-text explanation is not stored for a sickness request.

Other processing of special categories of personal data only falls within the scope of the assignment where the Parties make appropriate written arrangements in advance and the Client establishes its lawfulness.

4.4 Purposes of the processing by the Processor

• Hosting and making Moments available;
• Storing, displaying and managing records within the client account;
• Project and task administration, collaboration and handling of submitted requests;
• Handling leave requests and absences for staff administration;
• Management of newsletter recipients, segmentation, sending, delivery statistics and unsubscribes; open and click tracking only insofar as enabled and under the Client's responsibility for the required consent;
• Data exchange via integrations enabled by the Client and the designated administrative services;
• Corrections and audit trail in accordance with product functionality;
• Authentication, invitations, access management;
• Support at the Client's request;
• Security, monitoring, backups, incident response;
• Compliance with the Processor's legal obligations.

4.5 Nature and duration

Electronic processing for the duration of the subscription and its settlement in accordance with the Client's instructions. During the subscription, the data remains available for the provision of the service. Return or deletion follows art. 12. Any backups of deleted data then remain in existence for a maximum of 24 hours. A deviating assignment is recorded in writing and must comply with the GDPR.

Article 5 — Confidentiality

5.1. The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.2. The Processor limits access to staff/contractors who need the data (“need to know”).

Article 6 — Security (art. 32 GDPR) — TOMs

6.1. The Processor implements appropriate technical and organisational measures, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risks.

6.2. Without being exhaustive, the measures include, among other things:

6.3. The Processor may adjust TOMs provided that the level of security does not materially decrease. Upon reasonable request, the Processor provides a current high-level description.

6.4. No absolute security guarantee. The Client is responsible for strong passwords, correct role assignment and internal procedures.

Article 7 — Sub-processors

7.1. The Client hereby grants the Processor a general written authorisation to engage sub-processors for the provision of Moments.

7.2. The following sub-processors are engaged for the provision of Moments:

The list concerns the services that Learnable engages directly for this processing. Their own sub-processors are covered by the supplier agreements referred to. Optional website analytics and product help via Moments AI are described separately in the Privacy Policy; no organisation data is added automatically to the AI service. Write with AI only processes text an admin enters themselves and does not store it outside the draft the admin saves. External integrations chosen by the Client itself are covered by the assignment and arrangements agreed for them.

7.3. The Processor contractually imposes on sub-processors data protection obligations at least equivalent to those in this DPA, insofar as relevant to the outsourced processing.

7.4. In the event of an intended addition or replacement of a sub-processor, the Processor informs the Client by email with a notice period of at least fourteen (14) calendar days, except in cases of urgency for security reasons or force majeure. In that case, notification follows as soon as possible with an explanation of the reason.

7.5. Within that period, the Client may raise a reasoned objection on reasonable data protection grounds. The Parties consult in good faith. If no solution is found, the Client may cancel Moments with effect from the end of the current billing period without penalty, without prejudice to amounts owed up to that point.

7.6. The Processor remains responsible towards the Client for the performance of sub-processors, within the liability limits of art. 14.

Article 8 — Transfers outside the EEA

8.1. The production database is located in the EEA. Other processing is not limited exclusively to the EEA: hosting, email, support and the services of sub-processors may involve processing outside it, as described in art. 7.2.

8.2. Transfers outside the EEA only take place with a valid mechanism (adequacy decision, SCCs, etc.) and in accordance with instructions / this DPA.

8.3. The data processing terms of Supabase, Vercel and Resend contain the applicable transfer safeguards, including the standard contractual clauses of the European Commission (Decision (EU) 2021/914) where required. An adequacy decision may be relied upon insofar as the recipient and processing concerned fall within its scope. Upon request, Learnable provides information about the safeguards applicable to the Client and a copy thereof, with protection of confidential information.

Article 9 — Assistance with data subject requests

9.1. Taking into account the nature of the processing, the Processor assists the Client by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection).

9.2. Requests received directly by the Processor are — subject to statutory exceptions — forwarded to the Client without delay. The Processor does not act independently on such requests without instructions from the Client, unless required by law.

9.3. The Client remains the primary point of contact for team members.

Article 10 — DPIA, prior consultation and other assistance

10.1. The Processor provides reasonable assistance to the Client with:

• data protection impact assessments (DPIA);
• prior consultation of the supervisory authority;
• compliance with art. 32–36 GDPR,

taking into account the nature of the processing and the information available to the Processor.

10.2. Disproportionate or repeated assistance beyond the standard service may be charged at reasonable hourly rates, after prior notice.

Article 11 — Notification of breaches (data breaches)

11.1. The Processor notifies the Client of a personal data breach without undue delay and in any event no later than 48 hours after becoming aware of it, insofar as the breach relates to data covered by this DPA.

11.2. The notification contains, insofar as reasonably available:

• the nature of the breach;
• the categories and approximate number of data subjects and data records;
• the likely consequences;
• the measures taken or proposed;
• the point of contact at the Processor.

11.3. The Processor documents breaches and supports the Client with any notification to the Belgian Data Protection Authority (GBA) / data subjects. The Client decides on notification to the authority and data subjects, unless mandatory law places a direct obligation on the Processor.

11.4. Notification to: the Client's privacy/contract contact as provided or, in the absence thereof, the known admin email address.

Article 12 — Return and erasure upon termination

12.1. After termination of Moments for the Client, or upon earlier written request, the Processor shall — at the Client's choice and insofar as technically supported — erase or return personal data and erase existing copies, unless Union or Belgian law requires storage (e.g. Learnable's invoicing data as an independent controller).

12.2. Product transparency: standard export of the full history is currently not a guaranteed product feature. Display limits (including 200 / 1,000 recent records) may apply. The Parties agree on exit/export needs before the start. Upon reasonable request during or at the end of the service, the Processor examines what is technically feasible (possibly at additional cost).

12.3. After deletion from the active environment, any backups of the data concerned remain in existence for a maximum of 24 hours. Those copies are then deleted or overwritten. This period starts at the deletion, not at an ordinary cancellation. Data that Learnable must keep separately because of a legal obligation remains limited to that purpose.

12.4. Upon request, the Processor confirms in writing (by email) that erasure has taken place, subject to statutory exceptions.

Article 13 — Audits and information

13.1. The Processor makes available to the Client all information necessary to demonstrate compliance with the obligations of art. 28 GDPR, and allows audits / inspections as set out below.

13.2. The Client may carry out at most one (1) audit per period of twelve (12) months, unless an incident or indication of non-compliance justifies an additional audit, or the supervisory authority requires it.

13.3. Audits:

• are announced in writing at least thirty (30) calendar days in advance, except where an incident, a specific indication of non-compliance or a request from a competent supervisory authority justifies a shorter period;
• take place during office hours;
• disrupt business operations as little as possible;
• may be (partly) satisfied by current security documentation, certificates of sub-processors or an independent audit report;
• are subject to confidentiality.

13.4. The costs of the audit are borne by the Client, unless a material failure by the Processor is established that justified the audit.

Article 14 — Liability

14.1. The Parties' liability under this DPA follows the liability provisions of the Moments General Terms and Conditions (including the exclusions of indirect damage and the cap equal to the fees paid by the Client for Moments in the twelve (12) months preceding the event giving rise to the damage), insofar as mandatory law permits.

14.2. Nothing in this DPA limits liability that may not be limited under mandatory law (including wilful misconduct and gross negligence under Belgian law, insofar as applicable).

14.3. Fines imposed by supervisory authorities that result solely from a failure by the Client (legal basis, information obligation, unlawful instructions) are borne by the Client. Conversely, fines that result solely from a failure by the Processor in its obligations as processor fall under art. 14.1.

Article 15 — Compliance and cooperation with the supervisory authority

The Processor cooperates with the competent supervisory authority insofar as legally required and relevant to Moments, and informs the Client where appropriate and permitted.

Article 16 — Amendments

Amendments to this DPA are made in writing (including in an accepted electronic form). In the event of amendments required by legislation or case law, the Processor may propose an update; if the Client refuses a necessary update, the Processor may terminate the service subject to a reasonable notice period.

Article 17 — Governing law and disputes

Belgian law. Disputes fall under the jurisdiction of the Enterprise Court of Antwerp, Hasselt division (Ondernemingsrechtbank Antwerpen, afdeling Hasselt), without prejudice to mandatory rules of jurisdiction.

Article 18 — Final provisions

18.1. If a provision is void or unenforceable, the remaining provisions remain in force. The Parties replace the provision with a valid one that most closely reflects its intent.

18.2. This DPA may be signed or accepted digitally (click acceptance, email confirmation upon activation of the subscription).

Acceptance

This data processing agreement forms part of the agreement for Moments and is accepted in writing or digitally together with it. The Client and its authorised representative are identified according to the details under Parties. The order, activation or signing confirmation records the acceptance.

On behalf of Learnable BV: Kutlu Taskin Tuna, managing director (zaakvoerder). In the case of separate signing, the date and signature of both Parties are recorded in that confirmation.

Annex A — Instructions (standard)

The standard instruction is: process the data referred to in art. 4 exclusively in order to provide Moments as configured by the Client's admins, including support on request, security and the legal obligations of the Processor.

Annex B — Sub-processors

The current list can be found in article 7.2 of this data processing agreement, published at moments.business/en/data-processing-agreement. Changes are communicated in accordance with article 7.4.

Moments Data Processing Agreement · Learnable BV · BE 0733.680.680 · Version 2026-11-02