Version 2026-10-30.1. Effective 2026-10-30.
Completion and binding effect
This schedule forms Schedule 4 of the Mindstamp Data Processing Agreement. AECH CO trading as Mindstamp is the Importer. The Customer making the restricted UK transfer is the Exporter. The completed legal acceptance record, this schedule, the DPA and its schedules, and the incorporated Mandatory Clauses together form the IDTA.
The acceptance process must produce a durable copy of the completed information below for both parties. A trading name or email address alone is not sufficient to identify a corporate party. The record must identify both parties, their authorised execution method, their applicable roles, the documents and versions accepted, and the required transfer and security information. No transfer may rely on an incomplete record. The standard Importer details and mutual electronic execution method are identified in the release and acceptance record.
The following are the standard selections for this schedule. Customer party details are populated from its acceptance. The standard processing schedule covers the categories and supported services where used, and the UK IDTA applies only where a restricted UK transfer occurs. Acceptance alone does not declare that a UK transfer occurs or that every listed feature is enabled. The Importer must supply accurate information about its own processing. Neither party may use a declaration to disregard contrary facts.
Part 1 Table 1 Parties and execution
| Required item | Exporter | Importer |
|---|---|---|
| Start date | The date and UTC time at which both parties validly enter this completed IDTA, recorded in the legal acceptance record. | The same Start Date. |
| Full legal name | The Customer's full legal name recorded at acceptance. | AECH CO, with its corporate registration details identified in the release and acceptance record. |
| Trading name | The trading name recorded at acceptance, if different. | Mindstamp. |
| Company address | The Customer's address recorded at acceptance, using its registered address where it is a registered company. | Main address: 550 Teakwood Ave, Satellite Beach, FL 32937, United States. The registered address is identified in the release and acceptance record. |
| Official registration number if any | The company number or other official identifier supplied at acceptance, if any. | The official corporate registration identifier from the Importer's verified record, identified in the release and acceptance record. |
| Key contact name and job title | The accepting representative and job title, also used as the privacy contact, as recorded at acceptance. | Privacy contact, AECH CO trading as Mindstamp, identified in the release and acceptance record. |
| Key contact details | The contact email and other contact details recorded at acceptance. | [email protected] and the confirmed address above. |
| Importer data subject contact | Not applicable. | Privacy contact, [email protected], at the confirmed Importer address. |
| Execution for the party | The accepting representative's full name, job title, authority declaration, authenticated acceptance action, and UTC time are recorded with the completed documents. | The approved AECH corporate offer and execution record identifies its authorised representative or approved electronic execution method, capacity, accepted version, and UTC time of binding effect. The record identifies the approved execution method. |
No separate customer signature exchange is proposed. Each party must still be legally bound. An acceptance record must show the applicable signature or electronic execution evidence required by the IDTA and the relevant law.
Part 1 Table 2 Transfer details
| Required item | Standard entry |
|---|---|
| UK law governing the IDTA | England and Wales. This selection applies to the IDTA, regardless of the commercial Terms' governing law. |
| Primary place for party legal claims | England and Wales, subject to the Mandatory Clauses and data subject rights. |
| Exporter status | Controller for data for which the Customer determines purposes and means. If it acts as processor or subprocessor, that status and its upstream controller instructions must instead be recorded for the affected data. |
| Importer status | The Exporter's Processor or Sub-Processor for the transferred Customer Personal Data. |
| Whether UK GDPR applies to Importer processing | Yes for the relevant UK viewer-analytics processing covered by this schedule, as approved by counsel and recorded in the release and completed acceptance record. The Customer's actual processing profile remains relevant to scope. |
| Linked Agreement | The Mindstamp DPA, including its processing, security, and approved subprocessor schedules, between the Table 1 parties. Its date, accepted version, and account reference are recorded at acceptance. |
| Other agreements concerning the data | The Mindstamp Terms of Service and any applicable order or existing customer agreement. The record identifies each document's date, parties, and reference, or records that there is no additional agreement. A signed customer agreement is not amended merely by this schedule's publication. |
| Exporter upstream instructions where it is a processor | The record identifies the upstream processing agreement, its date, parties and reference, and the Exporter's authority to appoint and instruct Mindstamp. Not applicable where the Exporter acts solely as controller. |
| Term | The period for which the Linked Agreement is in force. Its return, deletion, and required legal retention duties continue as provided in the DPA and Mandatory Clauses. |
| Ending before the end of the Term | The parties cannot end the IDTA before the end of the Term unless there is a breach of the IDTA or the parties agree in writing, subject to the Mandatory Clauses. No optional fixed notice period is proposed. |
| Ending when the Approved IDTA changes | Importer is selected for the optional ending right under Section 29.2. Any exercise of that right must meet all conditions in the Mandatory Clauses. Other mandatory suspension, ending, return and deletion duties continue. |
| Further transfers | The Importer may transfer the data onward only in accordance with Section 16.1 of the Mandatory Clauses. |
| Specific restrictions on further transfers | Transfers are limited to the authorised receivers identified in the approved DPA Schedule 3, and customer-instructed destinations recorded under the DPA. The DPA's authorisation, advance notice, objection, written instruction, and applicable transfer duties must be met. A public provider list that has not been approved does not authorise a transfer. |
| First review date | The Start Date, before reliance on the completed IDTA. |
| Review frequency | Each time there is a change to the Transferred Data, Purposes, Importer Information, TRA or risk assessment, as permitted by the official Table 2. The parties review Security Requirements as part of that review. Any additional calendar review option must be expressly agreed. |
Part 1 Table 3 Transferred data
Transferred Data
The Customer Personal Data described in DPA Schedule 1, limited to the Customer's recorded instructions, enabled features, and actual service use. It can include:
- Viewer and session identifiers, video and personalised link identifiers, and customer-supplied identifiers.
- Names, email addresses, telephone numbers, company information, tags, custom fields, and other identity information supplied by the Customer or a viewer.
- Viewing and interaction activity, including times, progress, watched portions, pauses, seeks, clicks, answers, scores, paths, replies, and submitted text, drawings, files, audio or video responses.
- Technical data including IP address, browser, user agent, device and screen information, language, page and referral information, network-derived location, and permitted location inputs.
- Personal data contained in customer media, documents, audio, transcripts, captions, prompts, feature inputs, responses, outputs, and authorised integration content.
- Account user or administrator data handled on the Customer's instructions as part of the processing service. Independent Mindstamp controller processing is outside this schedule and requires its own applicable analysis.
Data is received or made available during delivery of the service, including continuous hosting and access and individual feature or integration requests. The completed record includes the standard service scope. Actual processing follows the Customer's lawful settings and requests; this is not a statement that every category or feature is in use. Disabling viewer IP or location fields does not remove the remaining categories or make all records anonymous.
The categories of Transferred Data do not update automatically when the Linked Agreement changes. Changes follow Section 5.3 of the Mandatory Clauses.
Special category and criminal offence data
The Customer must record the actual categories in its processing profile before such data is transferred: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data used for unique identification; physical or mental health; sex life or sexual orientation; or criminal convictions and offences. If none is transferred, the record expressly states none. This selection is not inferred from the video title or a lack of required identity fields.
Free text, responses and media can contain these categories. Where they are present, the parties must document the lawful processing conditions, risks, and suitable extra measures under DPA section 4 and the transfer assessment before use. No automatic expansion of these categories is permitted. Changes follow Section 5.3.
Relevant Data Subjects
The Customer's viewers, learners, employees, contractors, prospects, contacts, account users, and people named or depicted in customer materials, to the extent their data is actually transferred under the Customer's instructions. The standard schedule covers these categories where applicable. A change outside its permitted scope follows Section 5.3.
Purpose
To provide the instructed interactive video service: receive, host, store, organise, secure and deliver content; record configured viewer activity and responses; provide reports and exports; support the Customer's use; perform its enabled optional processing and integrations; and carry out instructed return or deletion and required legal retention. The scope is governed by DPA Schedule 1 and documented instructions. This does not authorise a new independent use by Mindstamp. Supported feature choices and requests supply instructions within this standard purpose. A change outside the agreed purpose follows Section 5.3.
Part 1 Table 4 Security requirements
These contractual requirements are linked to DPA Schedule 2. Mindstamp maintains evidence of the measures for the processing covered by this schedule.
| Required item | Agreed requirements |
|---|---|
| Security of transmission | Encrypted transport for personal data through service, API, integration, support and administrative transfer paths; protected credentials; authorised access to protected content; proportionate safeguards for externally directed disclosures. |
| Security of storage | Appropriate encryption and access controls for databases, object storage, archives and backups; restricted privileged access; tenant access controls; protected recovery; documented retention, deletion and disposal; reapplication of deletion instructions after restoration. |
| Security of processing | Processing only on lawful documented instructions; access limited to authorised roles and tasks; protected authentication and recovery; appropriate application permissions; minimised and controlled logging; controlled exports, support access and optional provider disclosures. |
| Organisational measures | Confidentiality duties, relevant staff training, assigned privacy and security responsibilities, provider due diligence and binding agreements, incident handling, access changes, vulnerability and change management, and documented request and deletion procedures. |
| Technical minimum requirements | Appropriate password hashing; secure authentication and credential handling; organisation permissions; encrypted transport; protected storage and privileged access; monitoring with suitable redaction; security maintenance; protected backup and recovery; effective restriction and deletion measures. No unsupported certification, algorithm, recovery deadline or storage region is asserted. |
| Updates to Security Requirements | They do not update automatically when the Linked Agreement changes. Changes follow Section 5.3 and must not reduce protection contrary to the Mandatory Clauses or DPA. Necessary operational security improvements remain subject to those duties. |
Service transfer assessment: AECH-UK-US-TRA-v1
Assessment date: 26 October 2026. Importer: AECH CO trading as Mindstamp, United States. Brett Lindenberg confirmed counsel's approval of the UK scope selection, this assessment method and the extra-protection conclusion on that date.
This service assessment covers restricted UK transfers to AECH CO in the United States for the processing described in Tables 1 to 4 and the Customer's completed processing profile. It includes ongoing hosting, US administrative access and instructed features within that profile. The standard categories and supported services are recorded at acceptance. Actual processing depends on the Customer's lawful use; acceptance does not enable features or assert that all categories are collected. The standard profile excludes special category data, criminal offence data and significant automated decisions unless separately approved. The relevant UK viewer-analytics processing falls within the approved Yes selection for whether UK GDPR applies to the Importer.
The safeguard is the completed UK IDTA, including its unmodified Mandatory Clauses. The Linked Agreement supplies the Article 28 duties, DPA Schedule 2 security requirements and section 8 duties for government requests. This assessment does not replace the IDTA or establish that every operating requirement has been met. AECH CO does not claim Data Privacy Framework certification.
For US law and practice, this assessment incorporates by reference the Department for Science, Innovation and Technology's Analysis of the UK Extension to the EU-US Data Privacy Framework, published in September 2023. Its analysis addresses third-party access, including government access for national security and law enforcement, and the ability to enforce the safeguard. DSIT concluded that the relevant US framework provides adequate protection for these risks. Following the ICO's published US assessment method, reliance on that analysis is reasonable and proportionate: its statutory assessment scope addresses these risks, and the UK government and Parliament enacted the adequacy regulations on that basis. This reliance concerns the broader US analysis that the ICO permits for transfers under safeguards, including recipients without DPF certification.
For the covered US transfers, the conclusion is that US law and practice do not materially lower protection when the completed IDTA and the agreed DPA protections apply. No additional transfer-specific measures are required beyond those protections. This conclusion does not remove a duty to meet those protections or respond to a conflicting law or government request under the Mandatory Clauses.
The Customer initiating the restricted transfer must review this service assessment against its actual processing, complete its own transfer decision before reliance, and record any additional facts or measures its use requires. Publication or acceptance of the DPA alone does not establish that the Customer has completed that assessment. A use outside the standard profile requires a further review.
This assessment covers the US destination analysis only. The provider directory also records processing in other countries, including Bunny replication in Germany, the UK, Sweden, Singapore, Australia and Brazil. Each relevant recipient and onward transfer must have an applicable route and required protections before reliance. This US analysis does not approve those onward routes or supply an EU GDPR transfer instrument.
Brett Lindenberg owns the service assessment record. Mindstamp must regularly review published DSIT updates and review this conclusion when the relied-on analysis changes or is withdrawn, or when relevant processing, recipients, countries, law or required protections change. The Exporter remains responsible for reviewing its own transfer decision. Required changes must be made before continued reliance where the applicable law or Mandatory Clauses require them.
Sources: DSIT analysis, September 2023, UK government supporting documents, and ICO guidance on using the government analysis for US transfers.
Part 2 Extra protection clauses
For the UK-to-US transfers covered by AECH-UK-US-TRA-v1, no additional transfer-specific measures are required beyond the IDTA and the protections already required by DPA Schedule 2 and section 8. The parties will review this conclusion if the relevant processing, recipients, countries, legal framework or relied-on government analysis changes.
If a transfer assessment requires further protection for processing outside this assessment's scope, the parties must identify, agree and implement it before relying on the IDTA for that processing.
Part 3 Commercial clauses
The Linked Agreement supplies the required processor terms under Article 28. No additional commercial clause is proposed within this IDTA. Commercial exclusions, liability caps, arbitration terms, fees and service restrictions cannot override the Mandatory Clauses or reduce data subject protection.
Part 4 Mandatory clauses
Part 4: Mandatory Clauses of the Approved IDTA, being the template IDTA A.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 5.4 of those Mandatory Clauses.
The official Mandatory Clauses are incorporated without a custom rewrite. They control conflicts. The acceptance record must preserve access to the approved version used and the completed tables.
Official sources: ICO IDTA and Addendum guidance, official IDTA PDF, and official IDTA Word template. The acceptance record includes the approved version and a durable copy of the official instrument.