1. Purpose
This Addendum explains how we meet data protection laws (such as GDPR and POPIA) when we process personal data on your behalf.
2. When this applies
The DPA applies when:
- You are subject to data protection laws, and
- We process personal data as part of our services to you
It sits on top of the Global Terms of Service and the Global Privacy Policy.
3. Who does what
- You decide what personal data to process and for what business purposes
- We process that personal data only to provide the services and as otherwise permitted in the DPA
We may also use de-identified, aggregated data for service improvement as a Controller.
4. Types of personal data
Depending on how you use the services, personal data may include:
- Business contact details (names, emails, roles)
- User activity logs
- Limited sample or transactional data that you choose to expose to MM or to LLMs
You should not use MM services to process special categories of personal data unless you have a lawful basis and explicit internal approval.
5. Our obligations as Processor
When we act as Processor, we will:
- Follow your documented instructions (within technical and legal limits)
- Use appropriate security measures
- Keep authorised staff under confidentiality
- Help you with data subject requests and impact assessments where reasonably possible
- Notify you without undue delay if we become aware of a personal data breach affecting your data
- Delete or return personal data at the end of the engagement, subject to minimal audit and legal retention
6. Sub-processors
We use sub-processors to run the services (hosting, email, AI/LLM, etc.). These are listed in the Sub-processor and AI Provider List.
We require them to protect data appropriately and only use it to provide their services to us.
7. AI and LLM processing
If you enable AI features or approve sample data for LLM classification:
- We may send prompts, metadata and limited rows of data to AI/LLM providers
- We cannot control how those providers internally implement their models
- You remain responsible for deciding whether the use of AI for your data is lawful and appropriate