Data processing addendum

Revision: 25 September 2026. Contractual terms apply only when incorporated into the relevant agreement; this revision does not retrospectively change existing contracts.

1. Parties and processing instructions

This DPA applies when incorporated into a service agreement under which Mindtro GmbH processes personal data for the customer. The customer acts as controller, or as a processor with the necessary authority from its controller; Mindtro acts as processor or subprocessor accordingly. The order identifies the parties and authorised instruction contacts. Mindtro’s independent account, billing and website processing is addressed in the privacy notice.

The subject matter is delivery of the purchased service. Processing may include receipt, storage, organisation, retrieval, transmission and deletion of customer-provided content, only within the agreed functionality. Its duration is the service term and limited return/deletion period. The customer determines the permitted data subjects and data categories in the deployment schedule. Sensitive or specially regulated data is outside the default scope unless expressly agreed with suitable safeguards.

2. Instructions, confidentiality and security

Mindtro processes covered data only on documented lawful instructions, including applicable transfer instructions, unless required by law; it informs the customer of such a requirement unless legally prohibited. If an instruction appears unlawful, Mindtro informs the customer and may pause the affected processing while the issue is resolved. It does not use covered content for advertising or general model training.

Authorised personnel must be bound to confidentiality. Mindtro implements the agreed technical and organisational measures appropriate to the risk, as described in the deployment security schedule. Changes must not materially reduce the agreed protection. The security policy is explanatory and does not substitute a complete schedule of implemented measures.

3. Subprocessors

The customer authorises only the subprocessors identified through the agreed authorisation process and schedule. Mindtro imposes equivalent applicable data-protection duties and remains responsible for its subprocessor’s performance of those duties. The public provider overview is an entry point, not blanket authorisation for unnamed entities.

For general authorisation, Mindtro gives at least 30 days’ advance written notice of intended additions or replacements. The customer may object on reasonable data-protection grounds within that period. The parties seek a suitable alternative; if unresolved, the affected processing does not commence with that provider and either party may end the affected service, with a refund of its prepaid unused portion. Emergency restrictions may pause a service but do not silently bypass authorisation.

4. International transfers

Transfers or relevant access outside the EEA require a valid Chapter V basis, assessment of the actual recipient and any necessary supplementary measures. Where Standard Contractual Clauses are needed, the applicable module, parties, annexes, supervisory authority and options must be completed for the transfer. This web document does not declare incomplete clauses executed or certify a provider’s DPF status. Mandatory transfer clauses prevail in their scope. Equivalent local requirements are addressed where applicable.

5. Assistance, incidents and review

Mindtro assists the customer, taking account of the processing and available information, with rights requests, security duties, breach response, impact assessments and prior consultation. It forwards relevant requests promptly and does not respond on the customer’s behalf unless instructed or legally required.

Mindtro notifies the customer without undue delay after becoming aware of a personal-data breach. Available information includes the nature, affected data and people, likely consequences, mitigation and a contact; missing details follow as they become available. The customer determines its own notifications, with our assistance.

Mindtro makes information necessary to demonstrate compliance available and permits audits by the customer or an authorised auditor. Reasonable confidentiality, notice and operational arrangements may apply, but must not prevent a legally required investigation or timely review following a material incident. No blanket once-a-year restriction limits statutory rights.

6. Return, deletion and legal holds

At the customer’s choice, Mindtro returns or deletes covered data when the services end, unless law requires retention. The default hosted-service handover window is 30 days after termination, with restricted backup copies expiring within a further 35 days. Earlier deletion instructions are handled without undue delay where technically and legally possible. A different service-specific schedule must be expressly recorded.

Retained copies are isolated from ordinary use, access is limited, and restored backups must have applicable deletion instructions reapplied. Mindtro confirms completion on request. Legally retained records are limited to the required data and purpose and deleted when that basis ends. The customer remains responsible for exports and instructions within the agreed handover process; statutory rights are not forfeited solely through an account closure.

7. Required deployment record

Before processing starts, the parties complete a record that identifies:

• Contracting parties, roles, authorised contacts, product and deployment.
• Purpose, operations, duration, data categories and affected people.
• Hosting, backup and support locations, exact subprocessors and their authorisation.
• Implemented measures for access, encryption, keys, logging, separation, incident response and tested restoration.
• Retention, export, deletion and backup expiry, including any lawful exception.
• Transfer instruments and completed annexes where required.

A signed order may contain this record or incorporate an identified version. A customer agreement must identify the applicable version and parties.

8. Rights and precedence

The DPA controls covered processing where other service terms conflict. It does not restrict data-subject rights, regulatory powers or liability that cannot be excluded. The service agreement governs other commercial matters. References: GDPR and EDPB guidance on controller and processor roles.

Questions, notices and requests: legal@mindtro.com. General enquiries: info@mindtro.com, +49 30 166381616.