1. Scope and roles
This Addendum ("DPA") is between the business customer ("you") and Mazemind ("Mazemind", "we"). It applies to personal data we process on your behalf when providing the Service ("Customer Data"). It does not apply to the Shared Memory, for which you and we are each an independent controller, as the Terms explain. Words defined in the GDPR have the same meaning here.
2. Our obligations
We will:
- process Customer Data only on your documented instructions, which are the Terms, this DPA and your use of the Service, unless the law requires otherwise (we will tell you first unless the law forbids it);
- make sure everyone who handles Customer Data is bound by confidentiality;
- keep the security measures in section 5 in place;
- use subprocessors only as set out in section 4;
- help you, as far as we reasonably can, to answer requests from people exercising their rights, and with security, breach notification, impact assessments and consultations with authorities;
- tell you without undue delay, and within 48 hours, after we become aware of a personal data breach affecting Customer Data;
- at the end of the Service, delete or return Customer Data at your choice, within 30 days, except where the law requires us to keep it;
- give you the information you need to show compliance with Article 28 GDPR, and allow audits under section 6.
3. Your obligations
You confirm you have a lawful basis for the Customer Data you send us and that you have given the information people are entitled to. You don't send us special categories of data, or data about children, unless we agreed in writing.
4. Subprocessors
You authorise the subprocessors listed at mazemind.ai/subprocessors. We post changes there 10 days in advance; you may object on reasonable data protection grounds by writing to privacy@mazemind.ai, and if we can't address the objection, you may end the affected Service and get a refund of prepaid, unused fees. We bind each subprocessor to data protection terms at least as protective as this DPA and remain responsible for it.
5. Security
Encryption in transit and at rest, access limited to staff who need it and protected by strong authentication, logs of access to production, backups, API keys you can revoke, and regular review of our providers.
6. Audits
We answer reasonable security questionnaires once a year. If that is not enough to show compliance, or an authority requires it, you may audit us once a year, at your cost, with 30 days' notice, during business hours, through an independent auditor bound by confidentiality.
7. International transfers
Where Customer Data leaves the European Economic Area or Switzerland for a country without an adequacy decision, the European Commission's Standard Contractual Clauses (2021/914) apply and are incorporated by reference: Module 2 (controller to processor), with the optional clause 7 and option 2 of clause 9 (general authorisation, 10 days' notice); clause 11 option not used; governing law and courts of France (clauses 17 and 18). Annex I is section 8 below; Annex II is section 5; Annex III is our subprocessor page.
8. Details of processing
| Subject matter and duration | Providing the Service, for as long as you use it |
| Nature and purpose | Hosting, looking up, enriching and returning data at your request |
| People concerned | Your contacts, prospects, customers and staff, as you choose |
| Types of data | Business contact data: name, job title, employer, business email and phone, public professional profiles |
| Controller | You, the business customer |
| Processor | Mazemind. Contact: privacy@mazemind.ai |
9. Order of precedence and liability
If this DPA conflicts with the Terms on data protection, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail. Each party's liability under this DPA is subject to the limits in the Terms, except where the law or the Clauses do not allow it.
Questions? privacy@mazemind.ai
Terms of Service