Data Processing Addendum

Mendster's Terms of Use include this Data Processing Addendum (DPA) to help you comply with the UK GDPR, EU GDPR and the CCPA when using our applications.

Signing is optional. If you require a signed copy of the DPA, please contact [email protected] and we will countersign the version applicable to your account.

Scope

This DPA applies where Mendster processes personal data on your behalf as a processor in connection with your use of a Mendster application. It supplements, and forms part of, the Terms of Use.

Roles of the parties

As between the parties, you are the controller and Mendster is the processor of any personal data submitted to or processed through the Application. Where you act as a processor for a third-party controller, Mendster acts as a sub-processor on the same terms.

Subprocessors

Mendster engages a limited set of sub-processors to help us deliver the Applications. Our current list of sub-processors is maintained below and is updated when a sub-processor is added or removed:

• Amazon Web Services (AWS) — cloud hosting (EU / UK regions).
• Cloudflare — DNS, CDN and application security.
• Stripe — payment processing.
• Zendesk — support ticketing surface for our apps.
• Cisco Webex — telephony integration for Mendster Voice.
• OpenAI — AI summarisation of call transcripts (opt-in, per workspace).

Mendster will give you notice of any addition or replacement of a sub-processor at least 30 days in advance so that you can object on reasonable grounds.

International transfers

Personal data is processed in the United Kingdom and the European Union by default. Where personal data is transferred outside the UK or EEA, Mendster relies on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses as appropriate.

Security

Mendster implements appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, least-privilege access controls, production access logging and regular vulnerability scanning. Details are available on request.

Data subject requests and incidents

Mendster will assist you in responding to data subject requests and will notify you without undue delay — and in any event within 72 hours — after becoming aware of a personal data breach affecting your data.

Contact

Data protection questions can be sent to [email protected].