Data Processing Addendum

1. Scope & Applicability

This Data Processing Addendum ("DPA") supplements and forms part of the agreement between you ("Data Controller") and MyndHyve Inc. ("Data Processor") governing the processing of personal data under the Services.

This DPA applies where MyndHyve Inc. processes personal data on your behalf as a data processor under applicable data protection laws, including the EU General Data Protection Regulation (GDPR), UK GDPR, and other applicable privacy regulations.

2. Definitions

Terms used in this DPA have the meanings set forth in the GDPR unless otherwise defined:

• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data (collection, storage, use, disclosure, deletion, etc.)
• Data Subject: An identified or identifiable natural person whose personal data is processed
• Sub-processor: A third party engaged by the processor to process personal data on behalf of the controller

3. Processor Obligations

As a data processor, MyndHyve Inc. shall:

• Process personal data only on documented instructions from the controller
• Ensure persons authorized to process personal data are subject to confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the controller in responding to data subject requests
• Assist the controller with data protection impact assessments when required
• Delete or return all personal data upon termination of the agreement
• Make available all information necessary to demonstrate compliance

4. Sub-processors

We maintain a list of authorized sub-processors at Subprocessors List. We will:

• Provide prior notice before adding or replacing sub-processors
• Ensure sub-processors are bound by equivalent data protection obligations
• Remain liable for the acts or omissions of sub-processors

5. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.

6. Security Measures

We implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit and at rest
• Measures to ensure ongoing confidentiality, integrity, and availability
• Regular testing and assessment of security measures
• Incident response and breach notification procedures

7. Breach Notification

In the event of a personal data breach, we will:

• Notify the controller without undue delay (within 72 hours of becoming aware)
• Provide information about the nature of the breach, categories of data affected, and remedial actions taken
• Cooperate with the controller and relevant authorities as required

8. Data Subject Rights

We will assist the controller in fulfilling data subject requests, including requests for access, rectification, erasure, restriction, portability, and objection, to the extent technically feasible.

9. Contact

For DPA-related inquiries, contact us at privacy@myndhyve.ai.