Data Processing Addendum

What it will cover

The headings, so you can tell us what is missing.

Publishing the outline before the prose is the honest version of “coming soon”: you can see the shape of what you would be agreeing to, and say what it leaves out, while it is still cheap for us to add.

• Roles: who is controller, who is processor, and where sub-processors sit
• Categories of data processed, and the purposes they may be processed for
• The technical and organisational security measures relied on
• The sub-processor list, and the notice period before it changes
• International transfers, and the transfer mechanism used
• Audit rights, and breach notification timelines and contacts
• Return and deletion of data at the end of the engagement

Questions before it lands, or a clause your own counsel needs to see: hello@memoth.ai. A real answer by email now beats a drafted paragraph later.