DATA PROCESSING AGREEMENT
OmniMinds Technologies B.V.
KVK number: 42130269
This Data Processing Agreement ("DPA") forms an integral part of the Master Services Agreement, Order Form or Terms of Service (together, the "Agreement") between OmniMinds Technologies B.V. ("Processor") and the contracting entity ("Controller").
1. SUBJECT MATTER, DURATION AND SCOPE
1.1 This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the MetroMinds platform and related support services.
1.2 Processing continues for the duration of the Agreement and any limited period required to return, export, secure or delete personal data, unless applicable law requires longer retention.
1.3 The subject matter, nature, purpose, categories of personal data and categories of data subjects are described in Schedule 1.
2. ROLES AND INSTRUCTIONS
2.1 The Controller determines the purposes and essential means of processing. The Processor processes personal data only on documented instructions from the Controller, including the Agreement, configured use of the Service and written support instructions.
2.2 The Processor will inform the Controller if, in its reasonable opinion, an instruction infringes applicable data protection law. The Processor may suspend the affected processing until the instruction is clarified or modified.
2.3 The Processor will not process personal data for its own marketing, profiling or for training public, third-party or multi-tenant artificial intelligence models.
2.4 If law requires processing beyond the Controller's instructions, the Processor will inform the Controller before processing unless the law prohibits notice.
3. CONTROLLER OBLIGATIONS
The Controller is responsible for the lawfulness, fairness and transparency of its processing; the accuracy and minimization of personal data; providing required notices; obtaining any required consent or other lawful basis; responding to data subjects; and ensuring that its instructions comply with applicable law.
4. CONFIDENTIALITY AND PERSONNEL
The Processor will ensure that persons authorized to process personal data are bound by contractual or statutory confidentiality obligations, receive appropriate instructions and have access only to the extent necessary for their role.
5. TECHNICAL AND ORGANIZATIONAL MEASURES
5.1 The Processor will implement and maintain measures appropriate to the nature, scope, context and purposes of processing and the risk to individuals. The measures are described in Schedule 2 and may be updated where the overall level of protection is not materially reduced.
5.2 The Processor does not guarantee that any system is immune from all threats. Security obligations are assessed according to Article 32 GDPR, the state of the art, implementation costs and the risks of processing.
6. ASSISTANCE TO THE CONTROLLER
6.1 Taking into account the nature of processing, the Processor will provide reasonable assistance through appropriate technical and organizational measures so the Controller can respond to requests to exercise data subject rights.
6.2 The Processor will provide reasonable assistance with security obligations, personal data breach notifications, data protection impact assessments and prior consultation with a supervisory authority, taking into account the information available to the Processor.
6.3 If the Processor receives a request directly from a data subject concerning Customer Data, it will not independently respond except to acknowledge or redirect the request, unless authorized by the Controller or required by law.
7. PERSONAL DATA BREACHES
7.1 The Processor will notify the Controller without undue delay and, where reasonably feasible, within thirty-six (36) hours after becoming aware of a confirmed Personal Data Breach affecting personal data processed under this DPA.
7.2 The notification will include available information concerning the nature of the breach, affected categories of data and data subjects, likely consequences, contact point, and measures taken or proposed. Information may be provided in phases where it is not available at the same time.
7.3 The Processor will take reasonable steps to contain, investigate, mitigate and document the breach and will cooperate with the Controller. Notification does not constitute an admission of fault or liability.
8. SUB-PROCESSORS
8.1 The Controller grants general written authorization for the Processor to engage sub-processors necessary to provide the Service.
8.2 The Processor will make current sub-processor information available through the Agreement, service documentation or upon request. It will provide reasonable advance notice of a new or replacement sub-processor that will process Customer Data.
8.3 The Controller may object on reasonable data protection grounds within the notice period. The parties will seek a reasonable solution. If no solution is available, the Controller may terminate the affected Service without penalty for the unused prepaid period.
8.4 The Processor will impose data protection obligations on each sub-processor that provide at least the level of protection required by this DPA and remains responsible for the sub-processor's performance to the extent required by law.
9. INTERNATIONAL TRANSFERS
The Processor will not transfer personal data outside the EEA unless authorized by the Controller through this DPA or another documented instruction and a lawful transfer mechanism is in place. Where required, the parties incorporate the applicable European Commission Standard Contractual Clauses and supplementary measures.
10. AUDITS AND COMPLIANCE INFORMATION
10.1 The Processor will make available information reasonably necessary to demonstrate compliance with this DPA, including relevant policies, security summaries, third-party assurance reports or responses to a reasonable questionnaire.
10.2 If the information is insufficient, the Controller may conduct an audit itself or through an independent auditor bound by confidentiality, no more than once annually unless a breach, supervisory request or material compliance concern justifies an additional audit.
10.3 Audits require reasonable prior notice, must occur during normal business hours, must avoid access to other customers' data and must not unreasonably disrupt operations or weaken security. The Controller bears its audit costs unless the audit identifies a material breach by the Processor.
11. RETURN AND DELETION
11.1 At the end of the Service, the Processor will, at the Controller's choice, return or delete personal data and existing copies within thirty (30) calendar days, unless applicable law requires retention.
11.2 Data may remain in protected backups until overwritten under the normal backup rotation. Such data will remain subject to this DPA and will not be restored except for disaster recovery or legal necessity.
11.3 Upon request, the Processor will confirm completion of deletion, subject to the backup and legal retention exceptions described above.
12. GOVERNMENT AND THIRD-PARTY REQUESTS
Unless prohibited by law, the Processor will notify the Controller of a legally binding request for Customer Data and will limit disclosure to what is legally required. The Processor will reasonably challenge a request where there are lawful grounds to do so.
13. LIABILITY, PRECEDENCE AND GOVERNING LAW
13.1 Liability arising under this DPA is subject to the limitations and exclusions in the Agreement, except to the extent such limitation is prohibited by applicable data protection law.
13.2 If this DPA conflicts with the Agreement regarding processing of personal data, this DPA prevails. Standard Contractual Clauses, where applicable, prevail over conflicting terms.
13.3 This DPA is governed by the laws of the Netherlands. Disputes are submitted to the courts identified in the Agreement, without limiting the rights or powers of competent supervisory authorities.
SCHEDULE 1 - DETAILS OF PROCESSING
| Element | Description |
|---|---|
| Subject matter | Provision, hosting, administration, security, support and use of the MetroMinds enterprise SaaS platform. |
| Duration | The term of the Agreement plus the limited export, deletion, legal retention and backup periods described in this DPA. |
| Nature and purpose | Storing, organizing, displaying, calculating, scoring, mapping, sharing within authorized workspaces, transmitting invitations, supporting users, securing the Service, backing up data and deleting or returning data. |
| Data subjects | Authorized Users; invited AI Readiness participants; Client employees, contractors and business contacts; and individuals described in Customer Data, uploaded documents, notes, workflows or use cases. |
| Personal data | Names, business email addresses, job titles, organization and role information, identifiers, invitation and account data, assessment responses, notes, workflow and use-case content, uploaded materials, activity records, technical logs and other personal data submitted by the Controller. |
| Special categories | Not intentionally required for normal use. The Controller must not submit special-category or criminal-offence data unless expressly agreed, necessary, lawful and subject to appropriate safeguards. |
| Frequency | Continuous or intermittent according to the Controller's and Authorized Users' use of the Service. |
SCHEDULE 2 - TECHNICAL AND ORGANIZATIONAL MEASURES
| Control area | Measures |
|---|---|
| Access control | Role-based authorization, organization and portfolio scoping, controlled administrative access, password hashing and personal invitation links with defined validity. |
| Application security | Prepared database access patterns, input validation, output encoding, CSRF protections, security headers, login throttling and authorization checks appropriate to the application function. |
| Transmission security | HTTPS/TLS for production web traffic and protected SMTP transport where transactional email is enabled. |
| Storage and secrets | Restricted database and upload access, secrets kept outside the public webroot where configured, and encryption at rest where supported and enabled by the hosting or storage provider. |
| Logging and monitoring | Authentication, mail and relevant application logging; production security checks; incident investigation capability; and review of security-relevant events. |
| Availability and recovery | Backups and recovery arrangements appropriate to the selected hosting service, with controlled restoration and backup rotation. |
| Vulnerability management | Security review, dependency and configuration maintenance, remediation of identified vulnerabilities and periodic testing proportionate to risk. |
| Personnel and governance | Confidentiality obligations, least-privilege access, documented incident handling and access removal when no longer required. |
| Deletion | Controlled deletion from active systems and expiry through backup rotation, subject to legal retention requirements. |
SCHEDULE 3 - SUB-PROCESSOR INFORMATION
The current sub-processor list will identify the legal entity, service, processing location and relevant transfer mechanism for each provider used for production hosting, database and storage, backups, transactional email and other processing of Customer Data. The list is made available through the applicable Order Form, service documentation or upon request and is maintained under the change procedure in Section 8.