Data Processing Agreement

• Process personal data only on the controller's documented instructions, including with regard to transfers, unless required to do otherwise by law.
• Ensure persons authorized to process the data are subject to confidentiality.
• Implement appropriate technical and organizational security measures (Art. 32) — see §6.
• Not engage a sub-processor without the controller's general authorization, and inform the controller of any intended change, giving the controller an opportunity to object (§4).
• Assist the controller, insofar as reasonably possible, in responding to data-subject rights requests concerning the controller's employee-directory data.
• Assist the controller with its own Art. 32–36 obligations (security, breach notification, impact assessments), taking into account the information available to MindPolar as processor.
• Delete all personal data at the end of the provision of services, and delete existing copies unless retention is required by law (see §7's retention statement). The controller should copy or export what it needs before the deletion date; after it, the data is deleted and cannot be returned.
• Make available to the controller information necessary to demonstrate compliance with this article, and allow for and contribute to audits, including inspections, conducted by the controller or an auditor mandated by the controller.

• Have a lawful basis to provide MindPolar with the personal data described in §1, and to instruct MindPolar to process it as described.
• Provide any notice its own employees or other data subjects are legally owed about this processing — MindPolar's Privacy Policy covers MindPolar's own role as processor, but does not substitute for the controller's own notice to its people.
• Ensure the accuracy of the data it enters, and correct it using the product's own administrative tools where possible.

The controller authorizes MindPolar's general use of the sub-processors below to provide the service. MindPolar will inform the controller before adding a new sub-processor, giving the controller a reasonable opportunity to object on reasonable data-protection grounds.

No analytics, advertising, error-tracking, or session-replay third party is integrated into the product.

Stripe and Razorpay are payment providers, not sub-processors. Each is an independent controller of the payment data a payer gives it and handles that data under its own terms and privacy policy.

A customer organization can ask for the current named list of sub-processors at any time by writing to hello@mindpolarai.com; we send it without undue delay and tell organizations in advance of any change.

Some providers listed above process data outside the country the controller or its people are in. This DPA does not itself provide a transfer mechanism; where the controller's law requires one, it is agreed in writing between the controller and MindPolar.

• Data is encrypted in transit and at rest.
• Database-enforced tenant isolation (row-level security enforced in the database itself, on every organization-scoped table).
• Least-privilege access roles; no long-lived cloud access keys used by the application.
• Session-level controls: an account holder can view and revoke sessions signed in on other devices from their own account settings at any time.

MindPolar will make available information reasonably necessary to demonstrate compliance with this DPA, and will contribute to audits reasonably requested by the controller, subject to reasonable confidentiality, frequency, and cost terms to be agreed at execution.

Deleting a workspace is the customer's decision. An Owner can schedule the workspace for deletion, and an Owner can cancel it until the deletion date. The deletion date is 90 days after the deletion is scheduled, or the end of the period already paid for if that is later. A workspace whose plan is not renewed moves to the free plan and is not deleted. Members are told when a deletion is scheduled and when it is cancelled, and from the deletion date the workspace can no longer be opened.

On the deletion date, all of the workspace's data is permanently deleted. Deleted data cannot be restored or exported.

Deleted data may remain in encrypted backups for up to 7 days, until they expire. Backups are used only to recover the service after an incident and are never used to restore a deleted workspace.

MindPolar keeps the billing records of a deleted workspace, such as invoices and payments, for up to 10 years, as tax and accounting law requires.

Deleting a workspace does not delete the personal accounts of its members; they keep access to their other workspaces.

Where an employee's name or work email appears in the workspace activity feed — the system that narrates actions across the product, not the directory itself — that reference is kept for at least 90 days and deleted on a rolling monthly schedule after that, which in practice can hold it for up to about 120 days. Deleting a feed message never deletes the underlying record it describes, which continues to be governed by the retention terms of the feature that owns it.

A person marked as a former employee is retained as a terminal record (department, position, employment dates, reporting position) for the organization's own audit history, and the record has no automatic expiry. A controller with its own retention-limitation obligation toward its former employees should account for this when deciding what it enters into MindPolar and for how long.

As between the parties, liability under this DPA is subject to the limits in the Terms of Service. Each party remains liable to individuals as data-protection law requires.

This DPA forms part of the Terms of Service and takes effect when the organization first uses MindPolar. No signature is needed. A countersigned copy is available on request to hello@mindpolarai.com.

Questions about this agreement: hello@mindpolarai.com.