Data Processing Addendum
This Data Processing Addendum ("DPA") supplements the agreement between you ("Customer") and Manda Labs. It applies whenever Manda processes Customer personal data subject to GDPR, UK GDPR, or Israel’s Privacy Protection Law. To execute a counter-signed copy, request one at the bottom of this page.
1. Scope
This DPA covers all processing activities described in our Privacy Policy. Definitions follow GDPR Art 4 unless otherwise stated.
2. Roles
Customer is the controller of Customer personal data. Manda is the processor and acts on the Customer’s documented instructions. Where Customer is itself a processor for its own clients, Manda is a sub-processor.
3. Processing on instructions
Manda processes Customer personal data only to provide and improve the Service, to the extent permitted by the agreement and this DPA. Manda will not sell Customer personal data, will not use it to train third-party AI models, and will inform the Customer if it believes an instruction infringes data-protection law.
4. Security
Manda implements appropriate technical and organisational measures, summarised in the "Security" section of the Privacy Policy and detailed in our security whitepaper (available on request under NDA).
5. Sub-processors
Customer authorises Manda to engage the sub-processors listed at /subprocessors. Manda will give Customer at least 14 days’ notice before adding or replacing a sub-processor and will impose data-protection terms no less protective than this DPA.
6. International transfers
Where Manda transfers Customer personal data outside the EEA / UK, it relies on the EU-US Data Privacy Framework, Standard Contractual Clauses (Commission Decision 2021/914), or an applicable adequacy decision.
7. Data-subject rights assistance
Manda provides self-service tools (Settings → Privacy) so the Customer can fulfil access, portability, and erasure requests. For more complex requests, Manda will assist the Customer at no additional charge within 30 days of a written request.
8. Breach notification
Manda will notify the Customer without undue delay, and in any event within 72 hours, of becoming aware of a personal-data breach affecting Customer personal data, providing the information required by GDPR Art 33(3).
9. Return / deletion
On termination of the Service, Manda will delete Customer personal data from production systems within 30 days, and from rolling encrypted backups within a further 30 days (60 days total), unless retention is required by law. Customer can also export data at any time via Settings → Privacy.
10. Request a signed copy
Email legal@mandalabs.ai to request a counter-signed PDF of this DPA on Manda letterhead.