Data processing terms

Draft for legal review. This text has not yet been approved by m11 Solutions' counsel and is not in force. Highlighted passages are still to be confirmed. The page is excluded from search engines until it is final.

1. Scope and precedence

These data processing terms (“DPA”) form part of the Terms of Service (“Terms”) between m11 Solutions and the Customer, and apply whenever we process Customer Personal Data in providing the Service. They apply automatically; no signature is needed. To confirm: (Confirm whether a countersigned copy will be offered on request.) If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.

Capitalized terms not defined here have the meanings in the Terms.

2. Definitions

• Data Protection Laws: all laws on the processing of personal data that apply to a party in connection with the Service, which may include the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, Canada’s PIPEDA and provincial laws such as Quebec’s Law 25, and US state privacy laws such as the California Consumer Privacy Act (“CCPA”).
• Customer Personal Data: personal data in Customer Data that we process on the Customer’s behalf.
• controller, processor, data subject, personal data, processing and supervisory authority have the meanings given in the GDPR; business, service provider and sell and share have the meanings given in the CCPA.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in our systems.
• Standard Contractual Clauses or SCCs: the clauses approved by European Commission Implementing Decision (EU) 2021/914.
• Sub-processor: a third party we engage to process Customer Personal Data.

3. Roles and instructions

1. Roles. The Customer is the controller (or a processor acting for its own controller) and we are the processor (or sub-processor) of Customer Personal Data.
2. Instructions. We process Customer Personal Data only on the Customer’s documented instructions, unless the law requires otherwise, in which case we will tell the Customer first unless the law forbids it. The Terms, this DPA and the Customer’s configuration and use of the Service (including connecting sources, identity providers, AI providers and MCP clients) are the Customer’s complete instructions. They include processing by our AI model providers’ safety systems (content filtering and abuse monitoring) as described in section 7.4 of the Terms, and our own monitoring of the Service for security and abuse. We will tell the Customer if we believe an instruction infringes Data Protection Laws.
3. Customer responsibilities. The Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data, including providing notices and obtaining any consents data subjects need.
4. Details of processing are in Annex 1.

4. Our personnel

We give access to Customer Personal Data only to personnel who need it to provide, support or secure the Service, who are bound by confidentiality obligations, and who are trained on their data protection responsibilities.

5. Sub-processors

1. Authorization. The Customer gives general authorization for us to engage Sub-processors. The Sub-processors in use today are listed in Annex 3.
2. Our obligations. We impose data protection obligations on each Sub-processor that are no less protective than this DPA, and remain liable for its performance.
3. Changes. We will give at least To confirm: 30 days’ notice before a new Sub-processor processes Customer Personal Data, by updating Annex 3 and emailing the Customer’s administrators. To confirm: (Confirm the notice mechanism, e.g. email to admins or a subscription list.)
4. Objection. The Customer may object on reasonable data protection grounds within that notice period. We will then discuss a reasonable alternative in good faith. If we cannot offer one within 30 days, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.
5. Customer-chosen services. Third-Party Services the Customer connects, such as its identity provider, connected sources, its own AI provider or an MCP client, are not our Sub-processors. They process data under the Customer’s own agreements with them.

6. Security

1. Measures. We implement and maintain the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Data against Security Incidents and appropriate to the risk.
2. Updates. We may update these measures as technology and threats change, but we will not materially reduce the overall level of protection during the subscription term.

7. Security incidents

1. Notice. We will notify the Customer without undue delay, and in any case within To confirm: 72 hours, after becoming aware of a Security Incident.
2. Information. The notice will describe, as far as we then know, the nature of the incident, the categories and approximate numbers of data subjects and records affected, its likely consequences, and the measures taken or proposed. We will update the Customer as we learn more.
3. Response. We will take reasonable steps to contain, investigate and mitigate the incident, and give the Customer reasonable help to meet its own obligations to notify supervisory authorities and data subjects.
4. No admission. Notifying the Customer is not an admission of fault. This section does not apply to incidents caused by the Customer, its Users or Third-Party Services it chose.

8. Assistance

1. Data subject requests. Taking into account the nature of the processing, we will help the Customer respond to requests from data subjects to exercise their rights, including by finding, correcting or deleting Customer Personal Data the Customer cannot handle itself in the Service. If we receive a request from a data subject about Customer Personal Data, we will pass it to the Customer and not answer it ourselves, except to tell the data subject we have done so.
2. Assessments. We will give reasonable help with data protection impact assessments and prior consultations with supervisory authorities that relate to the Service, taking into account the information available to us.
3. Government requests. If a public authority requests Customer Personal Data, we will try to redirect it to the Customer, challenge requests we consider unlawful, disclose only the minimum required, and notify the Customer unless the law forbids it.

9. Audits

1. Information. On request, we will provide the information reasonably necessary to demonstrate compliance with this DPA, such as answers to the Customer’s security questionnaire and summaries of our security controls. To confirm: (Add any third-party audit reports or certifications only once they exist and the PO has confirmed them in writing.)
2. Audits. If that information is not sufficient, or a supervisory authority requires it, the Customer may audit our compliance once a year, with at least 30 days’ notice, during business hours, at the Customer’s cost, and under confidentiality. The audit will not give access to other customers’ data or compromise the security of the Service. The parties will agree the scope in advance.

10. International transfers

1. Location. The Service is hosted on Microsoft Azure in To confirm: (production region: Canada Central or East US 2). Sub-processors may process Customer Personal Data in the countries listed in Annex 3.
2. EEA. Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the SCCs are incorporated into this DPA: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where it is a processor. For each Module: clause 7 (docking) applies; under clause 9, option 2 (general written authorization) applies with the notice period in section 5.3; the optional wording in clause 11 does not apply; under clauses 17 and 18 the governing law and courts are those of To confirm: Ireland; and Annexes I to III are completed by Annexes 1 to 3 of this DPA.
3. United Kingdom. For transfers subject to UK data protection law, the International Data Transfer Addendum issued by the UK Information Commissioner applies, completed with the information in this DPA. Either party may end it as its section 19 allows.
4. Switzerland. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent authority, and “Member State” including Switzerland.
5. Canada. We will protect Customer Personal Data transferred outside Canada, or outside Quebec, by contract and the measures in this DPA, so that it receives protection comparable to that required by Canadian law.

11. US state privacy laws

Where the CCPA or a similar US state law applies, we act as the Customer’s service provider or processor. We will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Terms, or outside our direct business relationship with the Customer; or combine it with personal data we receive from others, except as those laws permit. We will tell the Customer if we can no longer meet these obligations, and the Customer may then take reasonable steps to stop and remediate unauthorized use.

12. Return and deletion

During the subscription, the Customer can download finalized questionnaires from the Service. When the subscription ends, we will delete Customer Personal Data within To confirm: (e.g. 30 days, with backups expiring within a further 35 days), unless the law requires us to keep it, in which case we will keep it confidential and process it only for that purpose. On request, we will confirm deletion in writing.

13. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws or the SCCs require otherwise.

Annex 1: Details of processing

Annex 2: Security measures

These are the measures in place today. Read more on our Security page.

• Tenant isolation. Every assessment, answer, document, audit record and setting belongs to one organization, every query is scoped to it, and automated tests check that one organization cannot read another’s data.
• Authentication. Every password sign-in requires multi-factor authentication with an authenticator app and one-time recovery codes. Passwords are hashed with Argon2id. Repeated failed sign-ins are rate limited. Organizations can require single sign-on over OIDC or SAML 2.0 and provision Users with SCIM 2.0 or Google directory sync.
• Access control. Role-based permissions (user, reviewer, approver, admin) limit what each User can see and do. AI tools can only propose changes; people approve them.
• Encryption. Data in transit is protected with TLS 1.2 or later. Integration credentials, identity-provider secrets and multi-factor secrets are encrypted with AES-256-GCM, with the key held in Azure Key Vault. Access tokens are stored as hashes. Data at rest is encrypted by Microsoft Azure storage encryption.
• Least-privilege integrations. Connected sources are read with read-only access, and their credentials are never shown after they are saved.
• Logging. Changes to assessments, knowledge, members, roles, sign-in and configuration are written to the organization’s audit log, which administrators can review.
• AI controls. Search indexes are computed within our own infrastructure. AI usage is metered against a per-organization budget with a hard stop. Prompts keep retrieved content in delimited blocks treated as data, not instructions, and drafts cite their sources. AI tools connected over MCP are rate limited per organization and per member, can only propose changes for human review, and every call is audit-logged without question or answer text.
• Resilience. To confirm: (Confirm backup frequency, retention and geo-redundancy before stating them.)
• Organizational measures. To confirm: (Confirm personnel confidentiality agreements, security training, access reviews and incident-response procedure.)

Annex 3: Sub-processors

Website analytics (Google Analytics) does not process Customer Data and is not a Sub-processor; see the Privacy policy.

Contact

Questions about this DPA, or to receive Sub-processor notices: legal@tradecrafthub.ai