Data Processing Terms

In short (a summary, not part of the terms)
When you use a Mantia service (Mantia Essentials, which you order online, or a managed assessment that our team runs for you), there may be personal data in what you give us to test with (your documents, example messages and test accounts) or in your agent's replies. We handle it only to test your agent for you, and to draw lessons, in our own words, that improve Mantia. Those lessons never include your data or anything that identifies you or anyone else. In data protection terms you are the controller and we are your processor.
Our team works on your order or engagement. Only the team members who work on it see your key and read the test conversations, which they do as part of the review, using an AI assistant to help. They may access your data from outside the UK and the EU, protected by: working only on our instructions, written confidentiality undertakings, the ICO's International Data Transfer Agreement where UK law requires one, disk-encrypted computers, and deletion on schedule. The providers listed under "They handle what you give us to test" on our sub-processors page also handle it, as does any other AI model provider we use under your order form. Our hosting provider stores Mantia Essentials orders in the EU (Frankfurt), but it is a US company and serves our sites from its global network. Our AI model providers and our email and file-storage provider process data in the US and other countries.
We delete it on a fixed schedule. For Mantia Essentials: your key 7 days after we deliver your results, everything else 30 days after delivery, and your results site 90 days after delivery, unless you ask us to delete it sooner or to keep it for up to 12 months after delivery. For a managed assessment: as your order form sets out, or the same periods counted from your final results if it is silent. Our AI model providers don't train their models on it, and keep what we send them only as their own rules allow, which our sub-processors page describes (for another provider we use under a managed assessment's order form, that order form).
If a breach affects your data, we tell you within 72 hours of finding out.
Please don't send us your customers' personal data. Test a staging environment with test accounts.

These terms have two parts: Part A, the Key Terms (with their Annexes and a Service Annex for each Mantia service), and Part B, the Standard Terms. If they conflict, the Key Terms win. Capitalised words have the meanings given in the Key Terms, the Standard Terms (Section 11) or the Agreement. If a row in the Key Terms is left blank, it means "none" or "not applicable", and the clause that relies on that row does not apply.

Part A: Key Terms

Key term
Agreement	These terms supplement the Mantia Terms of Service between Provider and Customer, which, with Customer's order for each service, form the "Agreement". They apply to every Mantia service Customer orders. Customer accepts them by accepting the Terms of Service: for Mantia Essentials, by ticking the box accepting them when it orders; for a managed assessment, by signing an order form that refers to them. If Provider and Customer have signed a separate written agreement, that agreement prevails over these terms for anything it covers (Section 9.1).
Services and Service Annexes	Each Mantia service has a Service Annex, at the end of Part A, setting out what is particular to it, including where its data is held and how long it is kept. A Service Annex may vary any row of Annex I(B) or Annex II for its service. When Provider offers a new service, it adds a Service Annex for it. Provider may publish new versions of these terms; the version in force when Customer places an order or signs an order form applies to that order or engagement.
Provider	Mantia Ltd, a company registered in England and Wales with company number 17172108, whose registered office is at 124-128 City Road, London, England, EC1V 2NX.
Customer	The business that orders a Mantia service, as named in its order.
Customer Personal Data	Personal Data that is in what Customer gives Provider for a service (its documentation, its example messages, test accounts and any other setup material), or in the replies Customer's agent gives during testing. It does not include Customer's own contact and order details: the names, work email addresses and other contact details of the people at Customer who order, pay and correspond with Provider, and the details of each order or engagement. Provider handles those as a controller, under its Privacy Policy.
Approved Subprocessors	The providers listed under "They handle what you give us to test" at mantia.co.uk/legal/sub-processors. The list gives each one's identity, country of location and Processing task. For a managed assessment, they also include any other AI model provider named under "Models we will use" in its order form. Customer approves each such provider by signing the order form, which gives the same details for it, together with how long it keeps data and the safeguard for data sent outside the United Kingdom.
Provider's people	The members of Provider's team who work on Customer's order or engagement: Provider's founder, and team members who work for Provider under written agreements. Only Provider's people see Customer's key and read the test conversations. Each works on their own computer, which is fully disk-encrypted, and may access Customer Personal Data from outside the United Kingdom and the European Union. Section 2.7 sets out the commitments each has made in writing. Where a person's access from outside the United Kingdom is a Restricted Transfer under the UK GDPR, Provider and that person have signed the International Data Transfer Agreement issued by the UK Information Commissioner, supported by a transfer risk assessment. Customer approves these people Processing Customer Personal Data. If the law treats any of them as a Subprocessor rather than as one of Provider's people, Customer approves them as Approved Subprocessors. Provider will tell Customer by email, with the same notice as a change to the Approved Subprocessors (at least 10 business days, Section 2.6(a)), before anyone new in its team starts Processing Customer Personal Data, and Customer may object as that Section allows.
Where Customer Personal Data goes	Provider is a UK company. For every service, unless its Service Annex says otherwise, Customer Personal Data is held on the computers of Provider's people, where the tests run, which may be outside the United Kingdom and the European Union. It is sent to Provider's AI model providers, which process it in the United States and in other countries where they or their cloud providers operate; an AI model provider named in a managed assessment's order form processes it where that order form says. Provider's email and file-storage provider holds emails about the order and the test round's results, kept as an encrypted file, and may process data in any country where it has facilities. Materials reach Provider only through Approved Subprocessors, and wherever they land, Provider's mailbox included, they are deleted on the schedule in the Service Annex. The results are shown to Customer on a results site run by Provider's hosting provider, a US company that serves Provider's sites from its global network. Each Service Annex says where else that service's data is held. The list of Approved Subprocessors gives each provider's location and transfer safeguard.
Provider Security Contact	hello@mantia.co.uk
Security Policy	The measures in Annex II. Provider holds no independent security certification and has no independent audit reports.
Governing Member State	EEA transfers: Ireland. UK transfers: England and Wales.

Annex I(A): List of parties

Data exporter	Customer, as named in its order, at the address it gives in its order (for Mantia Essentials, the billing address it gives when it pays). Contact: the person and email address named in its order. Activities: see Annex I(B). Role: Controller, or Processor where Customer Processes the data for someone else.
Data importer	Provider, Mantia Ltd, 124-128 City Road, London, England, EC1V 2NX. Contact: Jesse Lucas, Director, hello@mantia.co.uk. Activities: see Annex I(B). Role: Processor, or Subprocessor where Customer is a Processor.

Annex I(B): Description of the Processing

Service	The Mantia services Customer orders under the Agreement, each described in its Service Annex. Each tests Customer's AI agent: Provider connects to the staging environment Customer gives it, runs test conversations against the agent, and reports what it finds.
Categories of Data Subjects	Anyone whose Personal Data is in Customer Personal Data: for example, Customer's staff or contractors named in its documents, test users, and anyone Customer's agent mentions in its replies.
Categories of Personal Data	Whatever Personal Data is in those materials. This is typically names, contact details and job titles, and account, order or transaction details in test data. Provider asks Customer to test only a staging environment with no real customer data, and not to include its customers' Personal Data in what it sends.
Special Category Data	Not Processed. Customer will not provide it. If some is in Customer Personal Data anyway, Provider protects it with the same measures and deletes it on the same schedule.
Frequency of Transfer	For each order or engagement, during setup, testing and reporting. Not continuous.
Nature and Purpose of Processing	Provider will Process Customer Personal Data as instructed in Section 2.2 of the Standard Terms. The Processing involves: receiving it, through Provider's order site (Mantia Essentials) or by the route agreed in the order form (managed assessments), in either case only through Approved Subprocessors; holding it, in storage and on Provider's people's computers; using it to write the goals the tests check against, to send test messages to Customer's agent, to have AI models from Provider's AI model providers, in the roles the list of Approved Subprocessors gives, prepare the tests and play customers and attackers, and a model made by a different company from the model that played the conversation judge the agent's replies, for Provider's people to read the conversations and rule on any that the judging model declines to rule on (these are marked "Reviewed by the Mantia team" in the results), and to prepare the results with help from an AI assistant used under business terms that bar training on the data; anonymising it to draw lessons that improve Provider's services, as Section 2.9 sets out; sharing it with Approved Subprocessors and Provider's people; and erasing it. The purpose is to provide the Service to Customer and, as Section 2.9 sets out, to draw lessons that improve Provider's services.
Duration of Processing	As long as each order or engagement needs, and then until deletion on the schedule in that service's Service Annex. The AI model providers delete their copies on their own schedules, which the list of Approved Subprocessors describes. Provider's records of an order or engagement (its status and times, Customer's acceptance of the terms, and payment records) and its ordinary correspondence with Customer (names, work email addresses and order messages) are not Customer Personal Data: Provider keeps them as business records, as its Privacy Policy describes.

Annex I(C): Competent supervisory authority

The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II: Technical and organisational security measures

These are the measures Provider has in place. They are described as they are, and Provider does not claim more. Where a measure applies to one service only, it says so.

Area	Measure
Who can access it	Within Provider, only the team members who work on the order or engagement ("Provider's people", as the Key Terms describe). Only they see Customer's key and read the test conversations, which they do as part of the review. Only they can open the folders that hold the results; advisers and anyone else have no access. Every account of Provider's that holds Customer Personal Data (including its hosting, email and file-storage, and AI assistant accounts) requires two-factor sign-in, and each of Provider's people has their own login; each downloads Mantia Essentials orders with a personal access token.
On Provider's people's computers	Whichever of Provider's people prepares an order or engagement downloads Customer's key and documents onto their computer, where the tests run, and they stay there until they are deleted on the schedule in the Service Annex. The results are also held on the computer of whichever of them reviews them. Every such computer is fully disk-encrypted. On the computer that runs the tests, the key is kept only in a private configuration file; if it reaches Provider any other way, that copy is deleted on the same schedule. Provider never puts it in test round files, the code repository, its AI assistant chats, its workspace or staff alerts. The connection code built for Customer's agent stays in that order's folder on the same computer, never reaches Provider's code repository, and is deleted on the same schedule as the documents.
Hosted storage (Mantia Essentials)	Orders, documents and Customer's key are held in the hosting provider's storage in Frankfurt, Germany (EU), private to the order site, and cached on its global network when read. The hosting provider encrypts this storage at rest and in transit. Provider does not add its own encryption on top of this.
In transit	Provider reaches its order site, its results site and its providers over encrypted (HTTPS) connections.
Customer's key	Provider asks for a key made only for Provider: for staging only, with the least access needed, a rate limit and an expiry where possible. The Mantia Essentials order site will not save an example message that still appears to contain a key.
Test results	The test round's results are kept on Provider's Google Drive as an AES-256 encrypted disk image, which is deleted, and emptied from the Drive bin, on the schedule in the Service Annex. Results are delivered on a results site hosted by the hosting provider and protected by its password protection, and the password is sent in a separate email.
AI model providers	Provider uses its AI model providers only on terms under which they do not train their models on what Provider sends them, and Provider will not opt in to training. They keep it only as their own rules allow, which the list of Approved Subprocessors describes, and Provider uses no feature of theirs that keeps it until Provider deletes it, other than the AI assistant below. Provider's people also use an AI assistant from one of those providers, on a business plan whose terms bar the provider from training on that data, to help review conversations and prepare results. Provider has switched off the assistant's chat-rating feature for its organisation and will not opt in to training; either would allow the provider to train on those chats. The assistant's memory feature is off for customer work. Provider's people never paste Customer's key into those chats. The chats, and any project files, stay in Provider's account until Provider deletes them on the schedule in the Service Annex, and the provider then removes them from its systems on its own schedule.
Keeping data to a minimum	Provider asks Customer to test only a staging environment with no real customer data and not to send its customers' Personal Data. Anything Customer marks as its agent's instructions is given only to the AI models that prepare the tests and judge the conversations, and to the AI assistant Provider's people use to review the results; Provider never gives it to the models that play customers and attackers. Provider's order tracker, in its Notion workspace, holds only the company name, the order's status and times, and Provider's own cost and hours: never a person's name or email address, Customer's key or documents, the conversations or the findings. For a managed assessment, the goal sets (rules Provider writes from Customer's documents) are written with no personal data and kept in Notion on a page shared only with Provider's people, and Provider does not use Notion's AI features on it.
Deletion	Customer Personal Data is deleted on the schedule in the Service Annex for that service, from every place Provider holds it: Provider's people's computers, Provider's Google Drive (including its bin), the order site's storage, the results site, Provider's AI assistant chats and project files about the order or engagement, and any emails in Provider's mailbox that carry personal data from Customer's materials or test results (documents, conversations, findings). Order folders and the private configuration file are never included in backups of Provider's people's computers.
People	Everyone who Processes Customer Personal Data is bound as described in Section 2.7.
Certification and testing	None. Provider has no independent certification, audit or penetration test.
Incidents	Provider notifies Customer as set out in Section 4.

Annex III: Approved Subprocessors

See the list of Approved Subprocessors in the Key Terms.

Service Annex: Mantia Essentials

Mantia Essentials is the testing service Customer orders and pays for online. What it includes, its turnaround and its refunds are in the Terms of Service.

Where its data is held	Customer's order, documents and key are stored with Provider's hosting provider in Frankfurt, Germany (EU), and cached on its global network when read. The order site's server code also runs in Frankfurt. Whichever of Provider's people prepares the order downloads Customer's key and documents from that store onto their computer, where the tests run.
Signing in to the order site	One-time 6-digit codes are sent to a verified work email and last 10 minutes. Five wrong attempts cancel a code. No more than three codes are sent to one address in 15 minutes. A bot check runs before a code is sent. Sessions last 2 hours.
How long it is kept	Customer's key: 7 days after the results are delivered. The order itself (Customer's answers, example messages and any test account details), documents, conversations, the connection code built for Customer's agent, the test round's files (including the encrypted results file on Provider's Google Drive, which is also emptied from the Drive bin), Provider's AI assistant chats and project files about the order, and any emails carrying personal data from Customer's materials or test results (documents, conversations, findings): 30 days after the results are delivered. The results site: deleted 90 days after the results are delivered, unless Customer asks Provider to delete it sooner or to keep it for up to 12 months after delivery. Orders that end without results being delivered (for example, because they are refunded or cancelled): everything, 7 days after the order ends. Submissions that are never paid for: 7 days after they were last saved.

Service Annex: Managed assessments

A managed assessment is run for Customer by Provider's team under an order form, signed by both parties, that refers to the Terms of Service. The order form sets its scope, the AI models Provider will use, price, retention, how materials reach Provider and how Customer pays. What follows applies where the order form is silent.

Where its data is held	On the computers of Provider's people, on Provider's Google Drive (the results, as an encrypted file), on the results site, and wherever materials land on the route agreed in the order form (Provider's mailbox included), as the Key Terms and Annex II describe. The goal sets Provider writes from Customer's documents contain no personal data; they are kept in Notion and deleted, including from Notion's trash, on the end date in the order form or, if it sets none, 30 days after the final results are delivered.
How long it is kept	As the order form sets out. For anything it sets no period for, the Mantia Essentials periods apply, counted from the delivery of the final results. Documents Customer sends before an order form is signed are deleted within 30 days of receipt if no order form is signed, unless a signed non-disclosure agreement with Customer covers them.

Where its data is held

On the computers of Provider's people, on Provider's Google Drive (the results, as an encrypted file), on the results site, and wherever materials land on the route agreed in the order form (Provider's mailbox included), as the Key Terms and Annex II describe. The goal sets Provider writes from Customer's documents contain no personal data; they are kept in Notion and deleted, including from Notion's trash, on the end date in the order form or, if it sets none, 30 days after the final results are delivered.

How long it is kept

As the order form sets out. For anything it sets no period for, the Mantia Essentials periods apply, counted from the delivery of the final results. Documents Customer sends before an order form is signed are deleted within 30 days of receipt if no order form is signed, unless a signed non-disclosure agreement with Customer covers them.

Part B: Standard Terms

1. Processor and Subprocessor Relationships

1.1 Provider as Processor. In situations where Customer is a Controller of the Customer Personal Data, Provider will be deemed a Processor that is Processing Personal Data on behalf of Customer.

1.2 Provider as Subprocessor. In situations where Customer is a Processor of the Customer Personal Data, Provider will be deemed a Subprocessor of the Customer Personal Data.

2. Processing

2.1 Processing Details. Annex I(B) in the Key Terms describes the subject matter, nature, purpose, and duration of this Processing, as well as the Categories of Personal Data collected and Categories of Data Subjects. Each Service Annex adds what is particular to that service.

2.2 Processing Instructions. Customer instructs Provider to Process Customer Personal Data: (a) to provide and maintain the Service; (b) as may be further specified through Customer's use of the Service; (c) as documented in the Agreement, including to anonymise it to draw lessons that improve Provider's services, as Section 2.9 sets out; and (d) as documented in any other written instructions given by Customer and acknowledged by Provider about Processing Customer Personal Data under this DPA. Provider will abide by these instructions unless prohibited from doing so by Applicable Laws. If Applicable Laws require Provider to Process Customer Personal Data other than on Customer's instructions, Provider will tell Customer before doing so, unless that law prohibits it. Provider will immediately inform Customer if it is unable to follow the Processing instructions, or if, in its opinion, an instruction infringes Applicable Data Protection Laws. Customer has given and will only give instructions that comply with Applicable Laws.

2.3 Processing by Provider. Provider will only Process Customer Personal Data in accordance with this DPA, including the details in the Key Terms. If Provider updates the Service to update existing or include new products, features, or functionality, Provider may change the Categories of Data Subjects, Categories of Personal Data, Special Category Data, Frequency of Transfer, Nature and Purpose of Processing, and Duration of Processing as needed to reflect the updates by notifying Customer of the updates and changes.

2.4 Customer Processing. Where Customer is a Processor and Provider is a Subprocessor, Customer will comply with all Applicable Laws that apply to Customer's Processing of Customer Personal Data. Customer's agreement with its Controller will similarly require Customer to comply with all Applicable Laws that apply to Customer as a Processor. In addition, Customer will comply with the Subprocessor requirements in Customer's agreement with its Controller.

2.5 Consent to Processing. Customer has complied with and will continue to comply with all Applicable Data Protection Laws concerning its provision of Customer Personal Data to Provider and/or the Service, including making all disclosures, obtaining all consents, providing adequate choice, and implementing relevant safeguards required under Applicable Data Protection Laws.

2.6 Subprocessors.

(a) Provider will not provide, transfer, or hand over any Customer Personal Data to a Subprocessor unless Customer has approved the Subprocessor. The current list of Approved Subprocessors includes the identities of the Subprocessors, their country of location, and their anticipated Processing tasks. Provider will inform Customer at least 10 business days in advance and in writing (by email to the address in Customer's order, and by updating the list) of any intended changes to the Approved Subprocessors whether by addition or replacement of a Subprocessor, which allows Customer to have enough time to object to the changes before the Provider begins using the new Subprocessor(s). Provider will give Customer the information necessary to allow Customer to exercise its right to object to the change to Approved Subprocessors. Customer has 30 days after notice of a change to the Approved Subprocessors to object, otherwise Customer will be deemed to accept the changes. If Customer objects to the change within 30 days of notice, Customer and Provider will cooperate in good faith to resolve Customer's objection or concern. If they cannot resolve it before the new Subprocessor starts Processing Customer Personal Data, Customer may cancel any order on which testing has not started by emailing the Provider Security Contact, and Provider will refund in full what Customer has paid for that order. This Section 2.6(a) does not apply to an AI model provider that Customer approves in its order form.

(b) When engaging a Subprocessor, Provider will have a written agreement with the Subprocessor that ensures the Subprocessor only accesses and uses Customer Personal Data (i) to the extent required to perform the obligations subcontracted to it, and (ii) consistent with the terms of the Agreement.

(c) If the GDPR or the UK GDPR applies to the Processing of Customer Personal Data, (i) the data protection obligations described in this DPA (as referred to in Article 28(3) of the GDPR or the UK GDPR, if applicable) are also imposed on the Subprocessor, and (ii) Provider's agreement with the Subprocessor will incorporate these obligations, including details about how Provider and its Subprocessor will coordinate to respond to enquiries or requests about the Processing of Customer Personal Data. In addition, Provider will share, at Customer's request, a copy of its agreements (including any amendments) with its Subprocessors. To the extent necessary to protect business secrets or other confidential information, including personal data, Provider may redact the text of its agreement with its Subprocessor prior to sharing a copy.

(d) Provider remains fully liable for all obligations subcontracted to its Subprocessors, including the acts and omissions of its Subprocessors in Processing Customer Personal Data. Provider will notify Customer of any failure by its Subprocessors to fulfil a material obligation about Customer Personal Data under the agreement between Provider and the Subprocessor.

2.7 Provider's People. Provider will ensure that everyone it authorises to Process Customer Personal Data (a) has committed in writing to keep it confidential; (b) Processes it only on Provider's instructions and only for the purposes in Section 2.2; and (c) follows the measures in Annex II. Provider is responsible for their acts and omissions as if they were its own.

2.8 Security. Provider will maintain the measures in Annex II (the Security Policy) and take the other measures that Article 32 of the GDPR or the UK GDPR requires of it, taking into account the nature of the Processing. Provider will reasonably help Customer to meet Customer's own obligations under Article 32, taking into account the information available to Provider.

2.9 Lessons for Improving Provider's Services. Customer instructs Provider to anonymise Customer Personal Data in order to draw lessons that improve Provider's services, for example which of its testing goals and techniques worked and how to sharpen its tests. This records the instruction Customer gives when it accepts the Terms of Service. Provider writes the lessons in its own words. They never include Customer Personal Data, Customer's documents or its agent's replies, Customer's name, or anything else that could identify Customer or any individual. The lessons are not Customer Personal Data, and Provider may keep them after this DPA ends and use them only to improve its services. Provider never uses Customer Personal Data to train an AI model.

3. Restricted Transfers

3.1 Authorisation. Customer agrees that Provider may transfer Customer Personal Data outside the EEA, the United Kingdom, or other relevant geographic territory as necessary to provide the Service. If Provider transfers Customer Personal Data to a territory for which the European Commission or other relevant supervisory authority has not issued an adequacy decision, Provider will implement appropriate safeguards for the transfer of Customer Personal Data to that territory consistent with Applicable Data Protection Laws.

3.2 Ex-EEA Transfers. Customer and Provider agree that if the GDPR protects the transfer of Customer Personal Data, the transfer is from Customer from within the EEA to Provider outside of the EEA, and the transfer is not governed by an adequacy decision made by the European Commission, then by entering into this DPA, Customer and Provider are deemed to have signed the EEA SCCs and their Annexes, which are incorporated by reference. Any such transfer is made pursuant to the EEA SCCs, which are completed as follows:

(a) Module Two (Controller to Processor) of the EEA SCCs apply when Customer is a Controller and Provider is Processing Customer Personal Data for Customer as a Processor.

(b) Module Three (Processor to Sub-Processor) of the EEA SCCs apply when Customer is a Processor and Provider is Processing Customer Personal Data on behalf of Customer as a Subprocessor.

(c) For each module, the following applies (when applicable): (i) the optional docking clause in Clause 7 does not apply; (ii) in Clause 9, Option 2 (general written authorisation) applies, and the minimum time period for prior notice of Subprocessor changes is 10 business days; (iii) in Clause 11, the optional language does not apply; (iv) all square brackets in Clause 13 are removed; (v) in Clause 17 (Option 1), the EEA SCCs will be governed by the laws of the Governing Member State; (vi) in Clause 18(b), disputes will be resolved in the courts of the Governing Member State; and (vii) the Key Terms contain the information required in Annex I, Annex II, and Annex III of the EEA SCCs.

3.3 Ex-UK Transfers. Customer and Provider agree that if the UK GDPR protects the transfer of Customer Personal Data, the transfer is from Customer from within the United Kingdom to Provider outside of the United Kingdom, and the transfer is not governed by an adequacy decision made by the United Kingdom Secretary of State, then by entering into this DPA, Customer and Provider are deemed to have signed the UK Addendum and its Annexes, which are incorporated by reference. Any such transfer is made pursuant to the UK Addendum, which is completed as follows:

(a) Section 3.2 of this DPA contains the information required in Table 2 of the UK Addendum.

(b) Table 4 of the UK Addendum is modified as follows: neither party may end the UK Addendum as set out in Section 19 of the UK Addendum; to the extent the ICO issues a revised Approved Addendum under Section 18 of the UK Addendum, the parties will work in good faith to revise this DPA accordingly.

3.4 Other International Transfers. For Personal Data transfers where Swiss law (and not the law in any EEA member state or the United Kingdom) applies to the international nature of the transfer, references to the GDPR in Clause 4 of the EEA SCCs are, to the extent legally required, amended to refer to the Swiss Federal Data Protection Act or its successor instead, and the concept of supervisory authority will include the Swiss Federal Data Protection and Information Commissioner.

4. Security Incident Response

4.1 Upon becoming aware of any Security Incident, Provider will: (a) notify Customer without undue delay when feasible, but no later than 72 hours after becoming aware of the Security Incident; (b) provide timely information about the Security Incident as it becomes known or as is reasonably requested by Customer; (c) promptly take reasonable steps to contain and investigate the Security Incident; and (d) reasonably help Customer meet its obligations to notify the supervisory authority and affected individuals. Provider's notification of or response to a Security Incident as required by this DPA will not be construed as an acknowledgement by Provider of any fault or liability for the Security Incident.

5. Audit and Reports

5.1 Audit Rights. Provider will give Customer all information reasonably necessary to demonstrate its compliance with this DPA and Provider will allow for and contribute to audits, including inspections, by Customer or an auditor it appoints, to assess Provider's compliance with this DPA. However, Provider may restrict access to data or information if Customer's access to the information would negatively impact Provider's intellectual property rights, confidentiality obligations, or other obligations under Applicable Laws. Customer will first ask for information under Section 5.3, and will only carry out an audit or inspection if that information is not enough to demonstrate Provider's compliance, giving reasonable notice and bearing its own costs. Provider will maintain records of its compliance with this DPA for 3 years after the DPA ends.

5.2 Security Reports. Provider is not independently audited or certified, and has no third-party audit reports to share. On written request, Provider will describe its security measures to Customer in writing, on a confidential basis.

5.3 Security Due Diligence. Provider will respond to reasonable requests for information made by Customer to confirm Provider's compliance with this DPA, including responses to information security, due diligence, and audit questionnaires, or by giving additional information about its security measures. All such requests must be in writing and made to the Provider Security Contact and may only be made once a year, except after a Security Incident or where a supervisory authority requires it.

6. Coordination and Cooperation

6.1 Response to Inquiries. If Provider receives any enquiry or request from anyone else about the Processing of Customer Personal Data, Provider will notify Customer about the request and Provider will not respond to the request without Customer's prior consent. Examples of these kinds of enquiries and requests include a judicial or administrative or regulatory agency order about Customer Personal Data where notifying Customer is not prohibited by Applicable Law, or a request from a data subject. If allowed by Applicable Law, Provider will follow Customer's reasonable instructions about these requests, including providing status updates and other information reasonably requested by Customer. If a data subject makes a valid request under Applicable Data Protection Laws to delete or opt out of Customer's giving of Customer Personal Data to Provider, Provider will assist Customer in fulfilling the request according to the Applicable Data Protection Law. More generally, Provider will help Customer, by appropriate technical and organisational measures and so far as possible, to respond to requests from individuals to exercise their rights under Applicable Data Protection Laws. Provider will cooperate with and provide reasonable assistance to Customer, at Customer's expense, in any legal response or other procedural action taken by Customer in response to a third-party request about Provider's Processing of Customer Personal Data under this DPA.

6.2 DPIAs and DTIAs. If required by Applicable Data Protection Laws, Provider will reasonably assist Customer in conducting any mandated data protection impact assessments or data transfer impact assessments and consultations with relevant data protection authorities, taking into consideration the nature of the Processing and Customer Personal Data.

7. Deletion of Customer Personal Data

7.1 Deletion by Customer. Customer may ask Provider to delete Customer Personal Data at any time by writing to the Provider Security Contact. Provider will comply with this instruction as soon as reasonably practicable except where further storage of Customer Personal Data is required by Applicable Law.

7.2 Deletion at the End of the Service.

(a) When a Service ends for an order or engagement (the results are delivered, or the order or engagement ends without them), Provider will return or delete Customer Personal Data at Customer's instruction, and otherwise will delete it on the schedule in Section 7.3, unless further storage of Customer Personal Data is required or authorised by Applicable Law. If return or destruction is impracticable or prohibited by Applicable Laws, Provider will make reasonable efforts to prevent additional Processing of Customer Personal Data and will continue to protect the Customer Personal Data remaining in its possession, custody, or control. For example, Applicable Laws may require Provider to continue hosting or Processing Customer Personal Data.

(b) If Customer and Provider have entered the EEA SCCs or the UK Addendum as part of this DPA, Provider will only give Customer the certification of deletion of Personal Data described in Clause 8.1(d) and Clause 8.5 of the EEA SCCs if Customer asks for one.

7.3 Deletion Schedule. Unless Customer instructs otherwise, Provider will delete Customer Personal Data on the schedule in the Service Annex for that service (and, for a managed assessment, in its order form): from its order site, its results site, its Google Drive (including its bin), its mailbox, its AI assistant account and its people's computers. Copies held by Provider's AI model providers are deleted on those providers' own schedules, and Provider cannot delete them sooner. Provider's other providers then remove deleted data from their own systems on their own schedules. The list of Approved Subprocessors describes those schedules.

7.4 Confirmation of Deletion. On Customer's request, Provider will confirm to Customer in writing that it has deleted Customer Personal Data, giving the date and each place it was deleted from (Section 7.3). Provider keeps a dated record of each deletion for the period in Section 5.1.

8. Limitation of Liability

8.1 Liability Caps and Damages Waiver. To the maximum extent permitted under Applicable Data Protection Laws, each party's total cumulative liability to the other party arising out of or related to this DPA will be subject to the waivers, exclusions, and limitations of liability stated in the Agreement.

8.2 Related-Party Claims. Any claims made against Provider or its Affiliates arising out of or related to this DPA may only be brought by the Customer entity that is a party to the Agreement.

8.3 Exceptions. This DPA does not limit any liability to an individual about the individual's data protection rights under Applicable Data Protection Laws. In addition, this DPA does not limit any liability between the parties for violations of the EEA SCCs or UK Addendum.

9. Conflicts Between Documents

9.1 This DPA forms part of and supplements the Agreement. If there is any inconsistency between this DPA, the Agreement, or any of their parts, the part listed earlier will control over the part listed later for that inconsistency: (1) the EEA SCCs or the UK Addendum, (2) a separate written agreement signed by Provider and Customer, for anything it covers, (3) for a managed assessment, its signed order form, for anything it covers (for example, retention periods, or opting out of the lessons in Section 2.9), (4) the Key Terms, including the Service Annexes, (5) these Standard Terms, and then (6) the rest of the Agreement. An order form cannot remove anything that Article 28 of the UK GDPR, or of the GDPR where it applies, requires a contract with a processor to contain.

10. Term of Agreement

10.1 This DPA starts when Customer accepts it. For Mantia Essentials, that is when Customer ticks the box accepting the Terms of Service; it then covers anything Customer submitted through Provider's order site before then, whether or not Customer goes on to pay. For a managed assessment, it is when Customer signs the order form; it then covers anything Customer gave Provider for the assessment before then. It continues until Provider has deleted all Customer Personal Data in its own possession under Section 7. However, Provider and Customer will each remain subject to the obligations in this DPA and Applicable Data Protection Laws until Customer stops transferring Customer Personal Data to Provider and Provider stops Processing Customer Personal Data.

11. Definitions

11.1 "Affiliate" means an entity that controls, is controlled by, or is under common control with a party.

11.2 "Applicable Laws" means the laws, rules, regulations, court orders, and other binding requirements of a relevant government authority that apply to or govern a party.

11.3 "Applicable Data Protection Laws" means the Applicable Laws that govern how the Service may process or use an individual's personal information, personal data, personally identifiable information, or other similar term, including the UK GDPR, the Data Protection Act 2018 and, where it applies, the GDPR.

11.4 "business day" means a day other than a Saturday, Sunday or bank holiday in England.

11.5 "Controller" will have the meaning(s) given in the Applicable Data Protection Laws for the company that determines the purpose and extent of Processing Personal Data.

11.6 "Customer Personal Data" has the meaning given in the Key Terms.

11.7 "DPA" means these Data Processing Terms: the Key Terms, these Standard Terms, and the policies and documents they refer to, including the list of Approved Subprocessors.

11.8 "EEA SCCs" means the standard contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

11.9 "European Economic Area" or "EEA" means the member states of the European Union, Norway, Iceland, and Liechtenstein.

11.10 "GDPR" means European Union Regulation 2016/679 as implemented by local law in the relevant EEA member nation.

11.11 "Key Terms" means Part A of these Data Processing Terms, including its Annexes and the Service Annexes.

11.12 "Order form" means the order form, signed by Provider and Customer, for a managed assessment.

11.13 "Personal Data" will have the meaning(s) given in the Applicable Data Protection Laws for personal information, personal data, or other similar term.

11.14 "Processing" or "Process" will have the meaning(s) given in the Applicable Data Protection Laws for any use of, or performance of a computer operation on, Personal Data, including by automatic methods.

11.15 "Processor" will have the meaning(s) given in the Applicable Data Protection Laws for the company that Processes Personal Data on behalf of the Controller.

11.16 "Restricted Transfer" means (a) where the GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; and (b) where the UK GDPR applies, a transfer of personal data from the United Kingdom to any other country which is not subject to adequacy regulations adopted pursuant to Section 17A of the United Kingdom Data Protection Act 2018.

11.17 "Security Incident" means a Personal Data Breach, as defined in Article 4 of the GDPR or the UK GDPR, affecting Customer Personal Data.

11.18 "Service" means each Mantia service Customer orders under the Agreement, as the Agreement and that service's Service Annex describe it.

11.19 "Service Annex" means the annex in Part A for a Mantia service.

11.20 "Special Category Data" will have the meaning given in Article 9 of the GDPR or the UK GDPR.

11.21 "Subprocessor" will have the meaning(s) given in the Applicable Data Protection Laws for a person or company that, with the approval and acceptance of Controller, assists the Processor in Processing Personal Data on behalf of the Controller.

11.22 "UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018.

11.23 "UK Addendum" means the international data transfer addendum to the EEA SCCs issued by the Information Commissioner for Parties making Restricted Transfers under S119A(1) Data Protection Act 2018.

Based on the Common Paper Data Processing Agreement (Cover Page and Standard Terms), version 1.1, licensed under CC BY 4.0. Mantia Ltd has modified it. Common Paper has not reviewed or endorsed these terms.