Data processing agreement

Last updated: 8 November 2026

Your podcasts contain personal data: the names and images of contributors, the voices in your audio files and transcripts, the details in your imprint. Your listeners leave personal data when they fetch your episodes, and Pandan turns it into your download numbers. For this data, your account is the controller, and Mundane Bits OÜ processes it on your behalf. This agreement sets out how, as Art. 28 GDPR requires.

How this agreement works

This agreement consists of the standard contractual clauses between controllers and processors of the European Commission (Implementing Decision (EU) 2021/915), with the choices and the annexes on this page. The clauses apply as published; this page only fills in what they leave open.
It is part of our terms of service. It is concluded when you start a plan, and electronically, without a signature (Art. 28(9) GDPR). It ends when the contract ends. If you need a signed copy, write to hello@pandan.fm.
Your documented instructions (Clause 7.1) are the terms of service, this agreement, and what the users of your account do in Pandan, such as publishing an episode or deleting a podcast.

Choices in the clauses

Clause 5, the optional docking clause, does not apply.
Clause 7.7(a): Option 2, general written authorisation. The agreed list of subprocessors is in Annex IV. We tell your account’s owners by email at least 30 days before we add or replace a subprocessor. If you object and we cannot resolve it, you can end the contract before the change takes effect, and we refund the part of a paid period that you do not use.
Clause 10(d): when the contract ends, we delete your account’s personal data 30 days after its plan ends, as the terms describe. If you want it returned instead, tell us before then: we send you your audio files, images, and podcast texts as files. Copies in our database backups expire within six months.

Annex I: List of parties

Controller:

The account that started a plan on Pandan, with the name and address given at checkout or in billing.
Contact: the account’s owners, at the email addresses they sign in with.
Accession: when the plan starts at checkout, by accepting the terms of service.

Processor:

Mundane Bits OÜ, Sepapaja 6, 15551 Tallinn, Estonia.
Contact: Eric Teubert, managing director, hello@pandan.fm. We have no data protection officer; the law does not require one for us.

Annex II: Description of the processing

Categories of data subjects

Listeners: people who fetch the account’s RSS feeds and audio files.
Visitors of the account’s podcast websites.
People in the account’s podcasts: contributors, guests, and anyone who speaks, is named, or is shown in an episode, a transcript, or an image.
People named in a podcast’s details, such as its author, contact email, and imprint.

Categories of personal data

Listeners: IP address, user agent, time, requested address, requested part of the file, and referring page; a hash of the IP address in place of the address after ingest.
Visitors of podcast websites: IP address while a request is served; server logs keep it only shortened (IPv4 to the first two bytes, IPv6 to the first four), so that it no longer identifies anyone.
People in podcasts and their details: names, images, links, email addresses, postal addresses, voices, and whatever they say or is said about them in audio files, descriptions, chapters, and transcripts.

Sensitive data

Pandan does not ask for special categories of personal data (Art. 9 GDPR). A podcast may contain them, for example health or political opinions; whether to publish them is the account’s decision. Until an episode is published, its files are private objects that only the account’s users and our operators can reach.

Nature of the processing

Storing uploaded and imported files and texts; checking audio files and making smaller versions of images; publishing the account’s podcasts in RSS feeds, on podcast websites, and as public files; logging requests for audio files and counting them as downloads; deleting.

Purposes

Hosting and publishing the account’s podcasts, and showing the account its download numbers.

Not covered by this agreement: we also count downloads to bill plans and to spot abuse, and we run user accounts, billing, and support. For these we are the controller, as our privacy policy describes.

Duration

Content: as long as the account keeps it, and until deletion at the end of the contract.
Full IP addresses of listeners: at most 48 hours, normally about an hour, in the media host’s log. The random value behind the hash is deleted once its day is counted, at the latest after 48 hours; from then on the hash cannot be traced to an address.
Hashed requests: 90 days, not in backups. What stays is the number of downloads per episode and day, which identifies no one.

Annex III: Technical and organisational measures

Encryption and pseudonymisation

All connections to Pandan and to stored files use HTTPS; the app host sends HSTS.
Listeners’ IP addresses are replaced by an HMAC with a daily random value within minutes, as described in Annex II. Other server logs shorten IP addresses before they are written.
Database backups are encrypted with a key of their own.
Passwords are stored only as bcrypt hashes.

Access control

Content belongs to an account. The application checks every read and change against authorization policies, so users only reach the content of their own account.
Uploads, drafts, and their files are private objects in a separate storage bucket that only the application can read. A file becomes public only when it appears in a feed or on a podcast website.
Users sign in with a password or a link sent to their confirmed email address.
Operators reach all accounts through the admin, which needs an operator’s email address and a second password in front of it. Every admin action is logged with the operator’s address. The operator today is the managing director, who is bound to confidentiality.
The servers are administered over SSH with keys only. Application secrets are stored encrypted.

Availability and recovery

The database is backed up every night into an encrypted repository: 7 daily, 4 weekly, and 6 monthly backups, checked after every run. Restoring has been tested.
Audio files and images are stored once in Hetzner’s object storage, without a separate backup. Accounts should keep their own copies.
An account can be suspended without deleting anything: its feeds and podcast websites go offline and its public files are moved to private storage, and all of it comes back when the suspension is lifted.

Physical security

Servers and storage are in Hetzner’s data centres in Helsinki, Finland. Their physical security is Hetzner’s, under its data processing agreement with us.

Logging and review

The application and the admin log to the server’s journal.
Changes to Pandan go through automated tests before release. We review these measures when Pandan changes, and at least once a year.

Assisting the controller

Owners can correct and delete content in Pandan themselves. For anything else, such as a listener’s request or a personal data breach, write to hello@pandan.fm; we tell you of a breach that concerns your account without undue delay. Because listeners’ IP addresses are hashed with a value that is deleted daily, we usually cannot find a single listener’s requests after a day.

Annex IV: Subprocessors

The agreed list under Clause 7.7(a), Option 2. Each subprocessor is bound by a data processing agreement with us.

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers, database, and object storage in Helsinki, Finland: stores and serves all content and logs.
AhaSend B.V., Willem Fenengastraat 16, 1096 BN Amsterdam, the Netherlands. Sends Pandan’s emails to the account’s users, such as sign-in links and notices about the account, from servers in the European Economic Area.
Fastmail Pty Ltd, Melbourne, Australia. Holds the email that the account writes to us and our replies. The live copy is in Fastmail’s EU region in Amsterdam, the Netherlands; a replica, backups, and logs are in the United States. Transfers rest on the European Commission’s standard contractual clauses.