Skip to content
Start Free TrialBook a Demo

Data Processing Agreement

Version
2026-10-30.1
Effective
2026-10-30
Trust center

Version 2026-10-30.1. Effective 2026-10-30.

This Data Processing Agreement, including its schedules ("DPA"), forms part of the Terms or other service agreement ("Agreement") between AECH CO trading as Mindstamp and the Customer identified in the account's legal acceptance record.

It applies when Mindstamp processes personal data for the Customer through the Services ("Customer Personal Data"). It takes effect when the Customer's authorised representative accepts the approved version through the online acceptance process and Mindstamp's authorised offer makes that acceptance binding. The record identifies both parties, the versions, and the acceptance date. A separate signature is not required under that approved process.

This DPA does not amend a separately signed agreement unless its amendment process permits the change. It continues for as long as Mindstamp processes Customer Personal Data under the Agreement, including return, deletion, or required legal retention.

The organisation owner on a paid plan can review and accept the standard agreement through the authenticated account. Free trials are not eligible for this online acceptance process. The owner can download the completed acceptance copy from that page.

"Data Protection Law" means the privacy and data protection law applicable to the processing, including the EU GDPR and UK GDPR where applicable. "Controller", "processor", "processing", "personal data", "data subject", and "personal data breach" have their meanings under the applicable law.

"Subprocessor" means a provider appointed by Mindstamp to process Customer Personal Data for the Customer. A service separately contracted and instructed by the Customer is not a Mindstamp-appointed subprocessor solely because the Customer connects it to Mindstamp.

The Customer is a controller and Mindstamp is its processor. Where the Customer is a processor for another controller, Mindstamp is a subprocessor and the Customer confirms it has authority to appoint and instruct Mindstamp. Each party complies with the duties that apply to its role. Schedule 1 describes the processing.

This DPA does not govern data for which Mindstamp acts as a separate controller. Our Privacy Policy describes those activities. Mindstamp will not use this distinction to process Customer Personal Data for a new independent purpose contrary to this DPA or applicable law.

Mindstamp will process Customer Personal Data only on the Customer's documented instructions, including instructions about international transfers, unless applicable law requires other processing. In that case, Mindstamp will inform the Customer before processing unless the law prohibits that notice for an important public interest reason.

The Agreement, this DPA, and the Customer's authorised use of supported features and settings document its instructions. Further lawful instructions can be sent to [email protected]. Mindstamp will confirm and record any agreed change in processing or scope.

The Customer instructs processing through this DPA, its standard processing schedule, and its lawful settings and requests for the supported Services. The schedule describes the permitted scope; it does not state that every listed category is present or enable every feature. Mindstamp's assistance concerns its own processing and the information available to it. The Customer remains responsible for assessing its purposes, lawful bases, notices and configured uses. Mindstamp does not undertake a routine review of individual customer videos or prepare the Customer's complete compliance assessment. Further instructions that change the agreed processing or require additional services require agreement on scope and any permitted charges. This does not remove required assistance or Mindstamp's duty to identify an instruction that it considers unlawful.

Mindstamp will inform the Customer immediately if, in its opinion, an instruction infringes applicable Data Protection Law. It will not carry out an unlawful instruction. If an instruction requires functionality outside the agreed Services, the parties will determine a lawful way to meet it; this does not remove a duty imposed by law or mandatory transfer clauses.

The Customer determines the purposes of processing and is responsible for the lawful basis, required notices and permissions, the accuracy and lawfulness of its data, and its authority to give instructions. It controls the questions, identity fields, personalised links, audience, integrations, and automated uses it configures.

The Customer will provide only data needed for its purposes. For special category data, criminal offence data, or other regulated sensitive information, it will establish any additional conditions required by law and ensure that suitable protections are in place. The parties will document any additional processing details or measures needed for that use before the affected processing begins. Mindstamp will not carry out an unlawful instruction or processing for which required protections are absent.

Unless Mindstamp has approved the relevant use and processing profile in writing, the Customer must not instruct processing of special category personal data, criminal offence data, or personal data for decisions that have legal or similarly significant effects on an individual. Approval must identify the categories, purpose, enabled features and required protections. Mindstamp may restrict affected processing if a use is outside the agreed profile or required protections are absent. The Customer remains responsible for its lawful authority and instructions, and Mindstamp remains responsible for its own duties.

These duties do not remove Mindstamp's own duties under this DPA or applicable law.

Mindstamp will ensure that people authorised to process Customer Personal Data have committed to confidentiality or are subject to an appropriate statutory duty. It will restrict access to people who need it for authorised work.

Mindstamp will implement and maintain technical and organisational measures appropriate to the processing risks and the applicable requirements of Article 32. Schedule 2 sets out the agreed measures. Mindstamp will assess their effectiveness and will not make a change that materially reduces the agreed protection. It will update the measures where needed to address changes in risks, technology, or law.

The Customer remains responsible for its own accounts, credentials, devices, permissions, and configured disclosures. A provider certification does not constitute a certification of Mindstamp.

The Customer gives general written authorisation to the Mindstamp-appointed subprocessors identified in the approved Schedule 3 applicable to its Services. Mindstamp will maintain the list with provider identity, function, processing locations, and feature dependency.

Before adding or replacing a subprocessor, Mindstamp will give advance written notice to the Customer's designated legal or account contact. The notice will describe the provider, the processing, the locations, and the proposed start. It will give a reasonable opportunity to object on data protection grounds before that provider starts the affected processing. Merely changing a public webpage does not replace that notice.

The Customer must identify the subprocessor change and explain its data protection concern with enough detail for Mindstamp to assess it. The parties will consider reasonable measures to address a substantiated concern. Mindstamp is not obliged to create a dedicated service or appoint a Customer-selected provider. If the parties cannot resolve the concern and the affected processing cannot lawfully continue, either party may end the affected feature or service, with the required return or deletion process. Any refund on termination of the affected service is governed by the Agreement and applicable law. This does not limit a refund or remedy required by law or mandatory transfer clauses. This does not extinguish a claim for an existing breach, remove mandatory remedies, or permit processing contrary to the DPA or transfer clauses.

Mindstamp will put a binding agreement in place with each subprocessor imposing the required data protection duties and an equivalent level of protection for the processing. Mindstamp remains responsible to the Customer for the performance of its subprocessors' duties as required by applicable law. It cannot avoid that responsibility by electing to terminate the service.

Taking account of the nature of the processing, Mindstamp will assist the Customer through appropriate technical and organisational measures with requests to exercise data protection rights. This includes identifying, accessing, correcting, returning, restricting, or deleting relevant data as required.

If Mindstamp receives a request concerning Customer Personal Data, it will refer it to the Customer without undue delay and will not respond substantively without the Customer's instructions unless applicable law requires a response. Mindstamp will provide the assistance needed for the Customer to meet applicable deadlines. Referral alone does not discharge an assistance duty where further action is required.

The parties will verify identity and authority proportionately and protect other people's information. The Customer can use supported account controls or contact [email protected] for assistance. An unsupported data export or correction format will be addressed through a lawful, workable process rather than treated as a reason to refuse a required right.

Taking account of the processing and the information available to it, Mindstamp will assist the Customer with security duties, breach notifications, data protection impact assessments, and prior consultation with authorities where required.

Mindstamp will inform the Customer without undue delay of a relevant regulator enquiry or third party request for Customer Personal Data, unless law prohibits notice. For a legally required disclosure, Mindstamp will follow applicable law and transfer clauses, including review, challenge, minimisation, and notification duties where applicable. It will not voluntarily disclose Customer Personal Data beyond its instructions and lawful duties.

Mindstamp will provide required assistance through relevant account controls, standard documentation, and reasonable support concerning its processing. To the extent permitted by law and mandatory transfer clauses, Mindstamp may charge reasonable, disclosed costs for additional staff work requested by the Customer, including custom reporting or consultation beyond the standard service. Mindstamp will explain the proposed scope and charges before that work starts. It will not charge the Customer for work needed to correct Mindstamp's own breach, or delay or refuse required assistance because charges remain disputed. The Customer remains responsible for its own legal advice and external advisers.

Mindstamp will notify the Customer without undue delay after becoming aware of a personal data breach involving Customer Personal Data. This duty applies without Mindstamp first deciding that the breach creates a risk to individuals.

The notice will provide information available at that time, including the nature of the breach, affected categories and approximate numbers where known, a contact point, likely consequences, and measures taken or proposed to address the breach and reduce harm. Mindstamp can provide information in stages as it becomes available.

Mindstamp will take appropriate steps to contain, investigate, and remedy the breach, preserve relevant evidence, and assist the Customer. The Customer decides its own regulator and data subject notifications, subject to applicable law. Mindstamp will meet any notification duties that apply to it independently. A notice does not itself admit fault or liability.

At the end of the processing service, the Customer can choose return or deletion of Customer Personal Data. Mindstamp will complete the instructed return or deletion without undue delay and delete remaining copies unless applicable law requires storage. Return will use a supported export or another agreed, commonly used electronic format suitable for the relevant data.

The Customer can give its choice through the account's supported controls or [email protected]. The Customer instructs deletion at the end of processing unless it requests return before deletion begins. Mindstamp will inform the Customer of the applicable process and give a reasonable opportunity to choose return before irreversible deletion. This instruction does not override a separately agreed retention or return term.

Mindstamp will keep appropriate records of the data covered, return or deletion steps and any lawful exception. Its standard request and disposal records may provide that evidence. Mindstamp will supply further information where required by applicable law or mandatory transfer clauses. Mindstamp will ensure that relevant subprocessor copies are also returned or deleted and will confirm completion on request.

For backups that cannot be selectively edited, Mindstamp will put affected data beyond ordinary use, keep it protected, and delete it through an appropriate documented expiry cycle as soon as possible. If a backup is restored, Mindstamp will reapply deletion and restriction instructions before ordinary use. Backup retention is not permission to retain data indefinitely.

Data that law requires Mindstamp to retain remains protected and is processed only for that required purpose. Mindstamp will identify the retention requirement to the Customer unless prohibited by law. Cancellation, refund, or suspension does not remove the duties in this section.

Mindstamp will make available the information needed to demonstrate compliance with applicable processor duties and will allow and contribute to required audits and inspections by the Customer or its appointed auditor.

The Customer will use relevant documentation and available control evidence first where these adequately establish compliance. If further examination is needed, the parties will agree a scope connected to the processing covered by this DPA and use remote review where it is adequate. An inspection will use reasonable advance notice and normal business hours where the circumstances permit. An external auditor must be suitably qualified, independent and bound by confidentiality. The parties will use safeguards for other customers' data, credentials, privileged material and trade secrets. These safeguards will not prevent access to information needed to establish compliance.

Mindstamp may propose a reasonable alternative to an auditor with a material conflict of interest. It will not use that proposal to obstruct a required audit. Security testing needs an agreed method and scope that protects the service and other customers. The Customer bears its external auditor's costs unless applicable law, a binding order or a separate agreement requires otherwise. Any charge for Mindstamp's additional work must be reasonable, disclosed and legally permitted; Mindstamp will not charge for work needed to correct its own breach. These arrangements do not restrict regulator powers, urgent examination of an incident, or mandatory audit and transfer rights.

Mindstamp will transfer Customer Personal Data only on documented instructions and under a valid route required by applicable law. It will ensure that required protections also apply to relevant onward transfers and subprocessor processing.

Schedule 4 contains the UK IDTA for restricted UK transfers. The relevant parties must validly enter into it, complete the required details, and meet the applicable transfer assessment requirements before relying on it. It covers only the processing described in its tables.

The UK IDTA does not establish a route for transfers governed solely by EU GDPR. Those transfers require the applicable approved instrument or other valid route. Mindstamp will not carry out a restricted transfer for which no valid route is in place. Any additional EU transfer schedule must be legally applicable, completed, accepted, and assessed before use.

If Mindstamp cannot comply with the agreed transfer protections, it will inform the Customer and suspend the affected processing as required by the applicable clauses. No general service term reduces mandatory transfer duties or data subject rights.

Mandatory transfer clauses take priority over conflicting terms. Subject to that priority, this DPA takes priority over conflicting provisions in the Agreement for processing it covers. The Privacy Policy does not override this DPA.

The Agreement's commercial liability limits apply to Customer claims under this DPA only to the extent permitted by applicable law and mandatory transfer clauses. They do not exclude non-excludable duties or remedies, limit a data subject's mandatory rights, restrict a regulator's powers, or remove the responsibility for subprocessors required by law. Preserving those duties does not itself create an additional indemnity or unlimited liability for ordinary contractual damages where a limitation is legally permitted.

An amendment follows the Agreement's valid amendment process, applicable law, and the change rules in mandatory transfer clauses. Mindstamp will preserve accepted versions and records. Updating a webpage alone does not establish a new binding agreement for an existing account.

Contact Mindstamp at [email protected] or AECH CO, 550 Teakwood Ave, Satellite Beach, FL 32937, United States. The Customer's designated contact is recorded in its legal acceptance record and can be updated by an authorised representative.

Schedule 1 Processing details

Subject matter and duration

The subject matter is the Customer's use of Mindstamp to create, deliver, personalise, and report on interactive videos and related content. Processing continues during the agreed service and only as needed afterwards for the instructed return or deletion and lawful retention under section 10.

Nature and purpose

Mindstamp receives, organises, hosts, stores, delivers, retrieves, and deletes Customer Content and associated personal data. It records viewing activity and interactions, produces customer reports and exports, and performs optional features and integrations instructed by the Customer. These can include transcription, translation, AI assistance, response media, and customer-directed disclosures.

AI feature instructions

Where the agreed service includes AI processing, DPA Schedule 1 and the accepted Provider and Subprocessor Directory identify the applicable service scope and provider dependencies. The Customer instructs the supported functions through its lawful settings and requests. The applicable processing instructions must identify the function, provider, input categories, trigger and stored outputs; the standard acceptance is not a separate instruction to enable a feature. Some workflows can be automatic, including transcription for eligible trial uploads. Automatic processing must be described and authorised within the documented instructions before it begins. The Mindstamp MCP organisation control is not a statement that every AI function uses that control.

Mindstamp will not use Customer Personal Data to train or improve models for an independent purpose outside the Customer's lawful instructions and this DPA. Model-improvement sharing settings do not replace purpose limits, subprocessor duties, transfer safeguards or deletion duties. Customer-directed AI agents remain subject to the agreed permissions and disclosure instructions.

Data subjects

Data subjects include the Customer's viewers, learners, employees, contractors, prospects, contacts, account users, and people whose information is included in Customer Content. The actual categories depend on the Customer's lawful use. The standard acceptance covers these categories where applicable, including children where included in the Customer's lawful use; it does not declare that every category is present.

Data categories

Data can include viewer and session identifiers; names, emails, phone numbers, custom identifiers, and customer-supplied fields; viewing and interaction records; answers, scores, paths, and submitted content; IP address, browser, device, screen, page, language, and location information; personal data in media, transcripts, captions, documents, prompts, outputs, and connected feature inputs.

The standard acceptance uses these service categories instead of requiring a separate feature or data-category checklist. The Customer's lawful settings and instructions determine the categories processed in its account. Disabling IP or location fields does not remove the other categories. An unnamed identifier can remain personal data.

Sensitive data

Customer Content and responses may contain sensitive information depending on the Customer's use. The Customer must identify the relevant categories and legal conditions, and the parties must document the risks and additional measures needed under section 4. This general description does not establish that the standard service is suitable for every sensitive use or that all additional conditions have been met.

Customer rights and obligations

The Customer has the rights and obligations in this DPA, including lawful instructions, privacy information, required permissions, subprocessor objections, requests for assistance and evidence, and choice of return or deletion.

Schedule 2 Security and operating measures

The following measures apply to the processing covered by this DPA.

Access and account controls

Mindstamp will restrict administrative and customer data access to authorised roles and necessary tasks. It will use individual staff accounts, protect privileged access with appropriate strong authentication, review access when roles change, and revoke access when no longer needed. It will apply customer account and organisation permissions to service requests.

Mindstamp will store password verifiers using an appropriate one-way password hashing method and protect credentials and secrets from unauthorised disclosure. It will protect authentication, recovery, and access paths against reasonably foreseeable misuse.

Transmission and storage

Mindstamp will use encrypted transport for personal data transmitted through supported service endpoints and protect database, object storage, backups, and administrative connections through appropriate encryption and access controls. It will use signed or otherwise authorised access for protected media where the feature requires it and avoid representing public sharing links as identity-based access controls.

Operations and resilience

Mindstamp will maintain appropriate network and application protections, security updates, vulnerability review, and controlled changes. It will maintain protected backups and a recovery process appropriate to the service, and test or assess recovery and security measures against the processing risks.

Monitoring and incidents

Mindstamp will maintain logging and monitoring needed to protect the service, with access restrictions and appropriate minimisation of personal data. It will review relevant alerts, investigate suspected incidents, preserve evidence, and carry out the breach notice process in section 9. It will apply appropriate filtering, redaction and data-minimisation controls to reduce the risk of secrets or unnecessary Customer Personal Data entering diagnostic systems, and address identified failures in those controls.

People and providers

Mindstamp will apply confidentiality duties and appropriate data protection and security training to authorised staff. It will assess providers for their relevant processing, put required agreements in place, and review material changes. It will protect devices used for privileged access and use appropriate safeguards for remote work.

Data handling and disposal

Mindstamp will apply lawful instructions for access, correction, restriction, export, and deletion. It will identify relevant application records, content, provider copies, logs, and backups; avoid indefinite retention; and document completion and exceptions. Backup restoration will not silently reactivate data already instructed to be deleted.

Verification and change

Mindstamp will keep evidence needed to demonstrate these measures and reassess them when the processing or risks change. This schedule does not claim SOC 2, ISO certification, a fixed recovery time, a fixed backup expiry period, or a particular storage region without supporting evidence.

Schedule 3 Subprocessor directory

The provider directory identifies the authorised providers and feature dependencies for this DPA. Providers used only for Mindstamp's controller activities and customer-contracted integrations are identified separately.

The approved directory is incorporated into this schedule by its published URL and version recorded at acceptance. Notice and objection rights in section 6 apply to later additions or replacements.

Schedule 4 UK transfer agreement

The UK IDTA in the accompanying transfer schedule forms part of this DPA for the restricted UK transfers it describes. Its mandatory clauses control where they conflict. The applicable transfer assessment records the information and measures supporting the transfer. It is not itself a transfer safeguard.