Data processing addendum

1. What this addendum is and how it is used

This addendum sets the terms on which MetaMinds processes personal data on a client’s behalf. It attaches to, and forms part of, the agreement between us for the services, alongside the terms of service. On anything about personal data, this addendum wins over the rest of the agreement.

It is published so your own counsel can read it before you book a call rather than a week after. It is our draft. If you would rather work from your own, send it and we will sign a reasonable one; we do not insist on our paper.

The processor is named in full above. Registration numbers are withheld by choice rather than missing: they are public record, are sent on request, and appear on every invoice and engagement letter. Bracketed entries elsewhere in this document are a different thing. Some are the counterparty details a signed copy fills in, and the rest are drafting decisions still with our lawyer. They are printed as visible gaps rather than filled with something plausible, because a processor agreement naming a company that does not exist is not a processor agreement.

2. Definitions

Data Protection Law means every law about personal data that applies to the processing under the agreement, including the EU General Data Protection Regulation 2016/679, the UK GDPR and the Data Protection Act 2018, and India’s Digital Personal Data Protection Act 2023.

Controller, processor, data subject, personal data, processing, special category data and personal data breach carry the meanings the GDPR gives them. Under the DPDP Act, the controller is the Data Fiduciary, the processor is the Data Processor and the data subject is the Data Principal; those terms are read as equivalents here.

Client Personal Data means personal data that MetaMinds processes on the client’s behalf under the agreement. Subprocessor means a third party engaged by MetaMinds to process Client Personal Data.

3. Roles

You are the controller and we are the processor for all Client Personal Data. You decide the purposes and the means; we act on your documented instructions and on nothing else.

Where you are yourself a processor for your own customers, we are a subprocessor, this addendum is read accordingly, and you confirm you have the authority from your controller to appoint us.

You confirm that you have a lawful basis for the processing you ask us to perform, that you have given the notices and obtained the consents your own obligations require, and that your instructions to us do not require us to break Data Protection Law.

MetaMinds is a separate and independent controller for a small set of data: the contact details of your staff who deal with us, our billing records, and the website data described in the privacy notice. This addendum does not cover that; the privacy notice does.

4. Subject matter, nature, purpose and duration

The order form can narrow any of these for a specific engagement. It cannot widen them without a written amendment signed by both of us.

5. Categories of personal data and data subjects

This is the default set. The order form for your engagement replaces it with the actual list, and that list is what governs.

6. What MetaMinds commits to as processor

These are the Article 28(3) obligations, written out rather than cross referenced. We will:

• Process only on your documented instructions, including on any transfer to another country, unless a law we are subject to requires otherwise, in which case we tell you before processing unless that law forbids it on public interest grounds.
• Tell you if we think an instruction breaks the law. We will say so in writing and will not carry it out while the point is open.
• Bind everyone with access to confidentiality, by contract or statutory duty, and give access only to the named people who need it for your engagement.
• Apply the security measures in section 8, and not reduce them during the engagement.
• Use subprocessors only on the terms in section 7, and stay fully liable to you for what they do.
• Help you answer data subject requests, as set out in section 9.
• Help you with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36, taking account of the nature of the processing and what we actually know.
• Delete or return the data at the end, on the terms in section 11.
• Give you the information you need to demonstrate compliance with Article 28, and submit to audits on the terms in section 12.
• Never use Client Personal Data to train or fine-tune any model, ours or a provider’s, and never place it in a shared evaluation set. Where a model provider sits in the processing path, the account is configured so that submitted content is not retained for training.

7. Subprocessors

The default arrangement uses no subprocessor for your data at all. Our retrieval stack is self-hostable, and where it runs inside your own infrastructure your documents never leave it. In that arrangement the list below applies only to our own records about the engagement, such as correspondence with your team.

Where processing happens on our side, you give general written authorization for the categories of subprocessor in Annex B, and:

• A current list naming each subprocessor, what it processes and in which country, is published at /legal/subprocessors. That page is the named list operating within the categories authorized in Annex B below; it is not itself an annex, and it is updated on the day a change takes effect. Where an upstream provider gives us less warning than the notice period below, we pass it on as soon as we have it and the shorter period governs, because we cannot commit on a vendor’s behalf to a period it does not offer.
• We give you at least 30 days written notice before adding or replacing one.
• You may object within those 30 days on reasonable data protection grounds. We will try to resolve it, and if we cannot, you may terminate the affected part of the engagement without penalty and we refund fees paid for work not yet done.
• Every subprocessor is bound by written terms that are no weaker than this addendum, and we remain liable to you for their acts and omissions as if they were our own.

8. Security measures

These are the measures we apply to Client Personal Data, and they are Annex C for the purpose of any Standard Contractual Clauses.

• Encryption. All connections carrying Client Personal Data use TLS 1.2 or higher. Where MetaMinds controls the storage, Client Personal Data is encrypted at rest using AES-256 or an equivalent industry-standard cipher. Where processing happens inside the Client’s own tenancy or infrastructure, the Client’s encryption controls apply and MetaMinds does not weaken, disable or work around them. The specific configuration for an engagement is recorded in that engagement’s architecture document, which is provided to the Client and may be audited.
• Access control. Named, least-privilege credentials issued to the specific engineers on your engagement. No shared accounts. Multi-factor authentication on every system that supports it. Access you grant is access you can revoke without asking us first.
• Separation. Your data is not mixed with another client’s working set, and production data is not copied into development or test environments.
• Endpoints. Full-disk encryption, automatic screen lock and current operating system patches on every machine that touches client data.
• Resilience. Where MetaMinds holds Client Personal Data in a system of its own, that system is backed up on a stated schedule and its restores are tested rather than assumed, and the schedule is recorded in the engagement’s architecture document. No such system exists today, so today there is nothing on our side to back up: correspondence sits with the email provider named on the subprocessors page and is covered by their retention.
• Deletion. Working copies destroyed at completion, or earlier on your request, and confirmed to you in writing.
• People. Confidentiality obligations for everyone with access, and access removed when someone leaves the engagement.

Where your own security requirements go beyond this list, they go in the order form and they override it. We would rather meet a stricter standard you can name than argue about a general one.

9. Helping you answer data subject requests

If a data subject contacts us directly about data we hold for you, we will not answer them substantively. We will forward the request to your named contact without undue delay and in any case within 3 business days, and we will tell the person we have passed it on and to whom.

We will help you meet requests for access, rectification, erasure, restriction, portability and objection, using the tooling and the access we have. For a reasonable volume of requests that help is free. If the volume becomes disproportionate we will agree a charge with you in advance and in writing, never after the fact.

The same applies to the DPDP Act rights of access, correction, erasure, grievance redressal and nomination, where MetaMinds is your Data Processor.

10. Personal data breaches

As information becomes available, we will provide:

• the nature of the breach, including what happened and when;
• the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures we have taken or propose to take, including to limit the damage;
• a named contact on our side who can answer questions.

Whether to notify a supervisory authority or the data subjects is your decision, not ours. It is a controller decision and we will not make it for you. What we will do is give you what you need to make it inside your own 72 hour deadline under Article 33. Where the DPDP Act applies, we support you as Data Fiduciary in meeting the notification duties owed to the Data Protection Board of India and to affected Data Principals; the exact timings there are set by rules made under the Act and are [DPDP breach timelines pending confirmation].

We keep a record of every breach, its effects and the action taken, and you may see the entries relating to you.

11. Deletion or return at the end

At the end of the engagement, or earlier if you ask in writing, we delete or return Client Personal Data at your choice. The default is deletion, because keeping data we no longer need is a liability for both of us.

• You tell us which you want. If you tell us nothing, we delete after 30 days and remind you before we do.
• Return is in a commonly used, machine readable format, over an encrypted channel.
• Deletion from live systems happens within 30 days of the end of the engagement, and we confirm it to you in writing.
• Where backups exist, an encrypted copy can survive a deletion for up to 30 further days before the backup expires. Backup copies are never restored to live systems except to recover from a failure, they are not accessed for any other purpose, and this addendum keeps applying to them until they expire. This clause is conditional rather than absolute because MetaMinds currently operates no backups of its own; see the resilience item in section 8.
• We keep only what a law requires us to keep. If that happens we tell you what it is, why, and for how long, and it stays protected by this addendum for the whole period.

12. Audit and inspection

• You may verify our compliance with this addendum once in any 12 month period, and more often if a supervisory authority requires it or after a breach affecting your data.
• The first step is a written questionnaire together with our documentation. We answer within 20 business days.
• If that does not answer the question, you may audit us remotely or on site on 30 days notice, during business hours, without unreasonable disruption. You may use an independent auditor who is not a competitor of ours and who signs a confidentiality undertaking.
• You bear your own audit costs and we bear ours, unless the audit finds a material breach of this addendum, in which case we bear both.

13. International transfers

The application server and the database that hold Client Personal Data run on hardware operated by MetaMinds in [data processing region pending]. The website itself is served from a global content delivery network, which holds no Client Personal Data.

Where the Standard Contractual Clauses are executed between us, they prevail over this addendum on any conflict. Annex A of this addendum serves as their Annex I, Annex C as their Annex II and Annex B as their Annex III, all of which are mapped in section 16. The docking clause is available so an affiliate of yours can join.

14. Liability, precedence and governing law

The limitation of liability in the terms of service applies to this addendum, and a claim under this addendum counts against the same cap rather than creating a second one. Nothing here limits a data subject’s rights under Data Protection Law or a supervisory authority’s powers.

If this addendum conflicts with the rest of the agreement, this addendum wins on anything about personal data. Executed Standard Contractual Clauses win over this addendum.

The governing law and forum follow the agreement, which means they are [governing law pending] and [dispute forum pending] until that is settled. Where Standard Contractual Clauses are executed, the law and forum they specify govern the clauses themselves.

15. Signature

16. Annexes

For anyone mapping this document onto the Standard Contractual Clauses, the annexes are these sections rather than separate attachments.

• Annex A, parties and processing description. Section 1 for the parties, section 4 for the subject matter, nature, purpose and duration, and section 5 for the categories of data and data subjects. This is Annex I of the Standard Contractual Clauses.
• Annex B, subprocessors. The table below, with the named list supplied on request under section 7. This is Annex III of the Standard Contractual Clauses.
• Annex C, technical and organizational measures. Section 8. This is Annex II of the Standard Contractual Clauses.

Annex B: authorized categories of subprocessor

Provider names and the country each processes in are in the current subprocessor list, which we give you before contract. Ask privacy@metaminds.store.