# Data Processing Addendum

Version: October 14, 2026

## About this Data Processing Addendum

This Data Processing Addendum forms part of every Platform License Agreement between Mindsmiths, Inc. and a Customer, together with the Terms of Service (www.mindsmiths.com/terms-of-service), the Security Addendum (www.mindsmiths.com/security-addendum) and the Service Level Agreement (www.mindsmiths.com/service-level-agreement). It governs the personal data that Mindsmiths processes on a Customer’s behalf when the Customer operates User Experiences on the Mindsmiths Platform, and it lists the subprocessors engaged for that processing.

The version in force on the Effective Date of a Platform License Agreement forms part of that agreement; any change to it requires a written amendment signed by both parties. Mindsmiths may publish new versions for future agreements. Customers based in the European Union contract with Mindsmiths d.o.o. (Zavrtnica 17, 10000 Zagreb, Croatia) and sign the corresponding Data Processing Addendum with it, under which their data is hosted in the European Union.

The following is the Data Processing Addendum incorporated in every Platform License Agreement with Mindsmiths, Inc.

This Data Processing Addendum ("DPA") forms part of and is subject to the Platform License Agreement (the "Main Agreement") between Mindsmiths, Inc. ("Mindsmiths" or the "Processor") and the entity or person defined as "Customer" thereunder ("Customer" or the "Controller"; and together with Mindsmiths, collectively the "Parties" and each individually a "Party").

This DPA applies to the processing of Customer Personal Data by Mindsmiths in the course of providing the Platform, and sets out the Parties' respective obligations under all data protection laws applicable to that processing ("Applicable Data Protection Law"), including, to the extent applicable, Regulation (EU) 2016/679 (the "GDPR") and the privacy and data protection laws of the United States and its constituent states. Where a provision of this DPA refers to a specific legal regime, that provision applies only in respect of processing governed by that regime.

## 1. Subject matter, nature and purpose of processing

1.1. This Data Processing Addendum applies where and only to the extent that Mindsmiths processes Customer Personal Data (meaning any Customer Data that constitutes personal data within the meaning of applicable data protection law) as Data Processor on behalf of the Customer as Data Controller, in the course of providing platform as a service functionalities of the Mindsmiths Platform according to the Platform License Agreement (hereinafter the "Main Agreement").

1.2. Customer Personal Data is hosted in the United States, in the Microsoft Azure East US region (Virginia). The Customer acknowledges that Mindsmiths performs certain processing activities, including platform operations, maintenance and support, through personnel and subprocessors located in the European Union, who may access Customer Personal Data hosted in the United States for those purposes. Mindsmiths shall ensure that any such access is subject to appropriate technical and organisational measures and complies with Applicable Data Protection Law.

## 2. Categories of data subjects, personal data and processing purposes

2.1. Categories of data subjects (as applicable):

- users who interact with User Experiences;
- members of the Customer's Builder Team;
- employees, suppliers, and other individuals whose Customer Personal Data the Customer processes through the Platform.

2.2. Categories of Customer Personal Data (as applicable):

- identification and contact details;
- user identifiers;
- conversation content and behavioral signals;
- consent, revocation and do-not-contact records;
- professional identifiers of Builder Team members;
- prompts, queries, design decisions and responses exchanged with Smith;
- other Customer Personal Data existing in the Customer's systems.

2.3. Processing purposes:

- operating the Customer's User Experiences and measuring their outcomes;
- recording and honouring consent, revocation and do-not-contact preferences;
- providing AI-assisted design capabilities to the Builder Team through Smith, where enabled by the Customer;
- providing the Platform services as described in the Platform License Agreement.

The data boundaries applicable to each processing purpose, including restrictions on Platform learning, are set out in Section 3 of the Terms of Service (www.mindsmiths.com/terms-of-service).

2.4. In addition to the purposes specified in Section 2.3 above, Mindsmiths may process Customer Personal Data pursuant to further documented, reasonable instructions from the Customer agreed upon by the Parties.

## 3. Duration of the commission

3.1. The duration of this commission (“Term“) corresponds to the duration of the Main Agreement.

3.2. Irrespective of the provisions of the Main Agreement, the Controller may terminate this Agreement at any time without notice if the Processor has committed a serious breach of the provisions of this Agreement, if the Processor cannot or does not wish to carry out instructions from the Controller, or if the Processor refuses to provide information or to grant the Controller access within the context of inspections, contrary to the contract. After termination, the Processor may no longer process any personal data of the Controller.

## 4. Responsibility and authority to issue instructions

4.1 The Controller is responsible for compliance with data protection regulations, in particular for the lawfulness of data transfer to the Processor and for the lawfulness of data processing (Art. 4 no. 7 GDPR). The Processor shall not use the data for any other purpose and in particular shall not be entitled to pass them on to third parties. Copies and duplicates will not be made without the Controller's knowledge. Exceptions shall apply only to the extent specified in paragraph 2 of this clause.

4.2. The Processor processes personal data only on documented instruction from the Controller, unless otherwise required under Union law or the law of the Member State to which the Processor is subject. In the event of any contrary obligation, the Processor shall immediately inform the Controller of the corresponding legal requirements before processing.

4.3. If the Processor is of the opinion that an instruction infringes data protection regulations, the Processor shall inform the Controller without delay in accordance with Article 28 para. 3 sentence 3 GDPR. The Processor shall be entitled to suspend the execution of the instruction until such instruction has been confirmed or changed.

## 5. Confidentiality

5.1. The Processor shall only employ persons for the execution of the work who have committed themselves to confidentiality in accordance with Art. 28 para. 3 sentence 2 lit. b GDPR and who have previously been acquainted with the data protection provisions relevant to them. The Processor and any person under the Processor’s control who has access to personal data may process such data exclusively in accordance with the instructions of the Controller, including the powers conferred in this Agreement, unless they are under a statutory obligation to process the data.

## 6. Data Security

6.1. The Processor shall take appropriate technical and organisational measures for the appropriate protection of personal data, in accordance with Art. 28 para. 3 lit. c GDPR in conjunction with Art. 32 para. 1 GDPR, in order to guarantee the security of the processing by the Processor. For this purpose, the Processor shall

- ensure the confidentiality, integrity, availability and resilience of systems and services in connection with processing in the long term,
- ensure the ability to quickly restore the availability of and access to personal data in the event of a physical or technical incident; and
- maintain a procedure for the regular review, assessment and evaluation of the effectiveness of technical and organisational measures to ensure the safety of processing.

The state of the art, the costs of implementation and the nature, scope and purpose of processing, as well as the risk of varying likelihood and severity of the risk for the rights and freedoms of natural persons within the meaning of Art. 32 para. 1 GDPR must be taken into account.

6.2. The contracting Parties agree on the data security measures laid down in “Security Addendum" (www.mindsmiths.com/security-addendum).

6.3. The technical and organisational measures are subject to technical progress and further development. In this respect, the Processor is permitted to implement alternative adequate measures. The safety level may not fall below the specified measures. Significant changes must be documented and communicated to the Controller in writing.

## 7. Engagement of other processors (subcontractors)

7.1. For the purposes of this Section, "subcontractors" means processors commissioned by the Processor whose services relate directly to the provision of the main service. This does not include ancillary services used by the Processor, for example telecommunication services, postal and transport services, and cleaning. The Processor nevertheless remains obliged to put in place appropriate and legally compliant contractual arrangements and control measures to safeguard the protection and security of the Controller's personal data, including in the case of outsourced ancillary services.

7.2. The Controller grants the Processor general authorization to engage subcontractors for the provision of the Platform services, subject to the following conditions:

(a) The Processor shall maintain a current list of subcontractors, including the identity, location, and nature of processing performed by each subcontractor, and shall make this list available to the Controller upon request.

(b) The Processor shall notify the Controller in writing at least thirty (30) days prior to engaging any new subcontractor or materially changing the scope of processing performed by an existing subcontractor.

(c) If the Controller has a legitimate, documented objection based on data protection grounds to the engagement of a new subcontractor, the Controller shall notify the Processor in writing within fifteen (15) days of receiving the notice under paragraph (b). The Parties shall work in good faith to resolve the objection, which may include Mindsmiths proposing an alternative subcontractor or configuration. If the Parties are unable to resolve the objection within thirty (30) days, the Controller may terminate this Data Processing Addendum and the Platform License Agreement upon written notice, without penalty and with a pro-rata refund of any prepaid, unused fees.

7.3. A contractual agreement is to be concluded with the subcontractor in accordance with Art. 28 para. 3 and 4 GDPR, which meets the requirements for confidentiality, data protection and data security of this Agreement. The Controller shall be entitled to inspect the Processor’s contracts with subcontractors and to demand that the Processor send a copy of these contracts.

7.4. Where a subcontractor processes Customer Personal Data in a jurisdiction other than the jurisdiction in which the Platform is hosted, the Processor shall ensure that the transfer is lawful under Applicable Data Protection Law and that appropriate safeguards are in place, including, where the transfer is subject to the GDPR, a valid transfer mechanism under Articles 44–49 GDPR. The Processor shall make copies of the relevant transfer mechanisms available to the Controller upon request.

7.5. The transfer of the Controller's personal data to the subcontractor and the subcontractor's first action shall only be permitted if all the prerequisites for subcontracting are met. The subcontractors approved by the Controller at the time of conclusion of the Platform License Agreement are:

| Company (subcontractor), address | Type of service |
|---|---|
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland | Cloud infrastructure on which the Platform runs - Azure Kubernetes Service (AKS), hosted in the United States, Azure East US region (Virginia) |
| Mindsmiths d.o.o. Zavrtnica 17, 10000 Zagreb, Croatia | Platform operations, maintenance and technical support, performed on behalf of Mindsmiths, Inc. |
| OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland | Large language model services used for refining User Experience content |
| Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland | Large language model services used for refining User Experience content |
| Google Ireland Limited Gordon House, Barrow Street, Dublin 4, D04E5W5, Ireland | Large language model services used for refining User Experience content |

## 8. Support in protecting the rights of data subjects

8.1. The Processor is obliged to support the Controller with appropriate technical and organisational measures to protect the rights of the data subjects as specified in Art. 12 to 22 GDPR (Art. 28 para. 3 sentence 2 lit. e GDPR). In particular, the Processor shall support the Controller in fulfilling the claims of data subjects for deletion of their personal data in accordance with Article 17 GDPR.

8.2. If data subjects are able to exercise the right to data portability against the Controller, the Processor shall ensure that they can receive the data, which they have provided to the Controller, in a structured, commonly used and machine-readable format.

8.3. The Processor may only correct, delete or restrict the processing of personal data in accordance with documented instructions from the Controller. The Processor may only provide information to third parties or the persons concerned after prior written consent by the Controller.

8.4. If a data subject contacts the Processor directly in order to assert his rights in accordance with Articles 12 to 22 of the GDPR, the Processor will forward the request to the Controller without delay.

## 9. Support with documentation and reporting obligations

9.1. The Processor is not obliged to appoint a data protection officer. The contact point for data protection issues at the Processor is privacy@mindsmiths.com (or such other address as the Processor may designate by written notice to the Controller). The Processor shall ensure that inquiries directed to this contact point are handled by personnel in a position to provide proof, upon the Controller's request, that the Processor complies with the requirements of applicable data protection law.

9.2. If the Processor becomes aware of a violation of the protection of personal data, he shall immediately notify the Controller of this violation pursuant to Art. 28 para. 3 lit. f, Art. 33 para. 2 GDPR. The same applies if persons employed by the Processor violate this Agreement.

9.3. After consultation with the Controller, the Processor shall immediately take the necessary measures to secure the data and to minimise any possible adverse consequences for the data subjects.

9.4. The Processor shall support the Controller with all information at his disposal in fulfilling the information obligations in relation to the competent supervisory authority in accordance with Art. 33 GDPR and, if applicable, in relation to the data subjects affected by the violation of the protection of personal data in accordance with Art. 34 GDPR.

9.5. The Processor shall support the Controller with all information at his disposal in the data protection impact assessment pursuant to Art. 35 GDPR and, if necessary, in a prior consultation with the competent supervisory authority pursuant to Art. 36 GDPR.

9.6. The Processor shall inform the Controller without delay of any checks and measures taken by the supervisory authority insofar as they relate to this Agreement.

## 10. Termination of the commission

10.1. At the choice of the Controller, the Processor deletes or returns all the personal data to the Controller after the end of the provision of services relating to processing, and deletes existing copies, unless applicable law requires continued storage of the personal data. Where the Processor is required by applicable law to retain any Customer Personal Data after the end of the provision of services, the Processor shall notify the Controller of that requirement, retain the data only for as long as and to the extent required, continue to protect it in accordance with this DPA and the Security Addendum, and process it for no purpose other than that required by law.

10.2. The Processor shall, without explicit request, prove to the Controller in text form with date indication that he has returned all data carriers and other documents to the Controller or that he has destroyed or deleted them in accordance with data protection regulations and has therefore not retained any of the Controller’s data.

10.3. The Processor shall keep any and all documentation which serves as evidence of the orderly and lawful data processing for the Controller beyond the end of the Platform License Agreement. The Processor can return them to the Controller at the end of the Platform License Agreement for his discharge.

## 11. Control rights of the Controller

11.1. The Controller is entitled to regularly check the technical and organisational measures as well as compliance with this Agreement and data protection regulations before and during the provision of services relating to processing. For this purpose, the Controller or an authorized auditor may inspect the data processing equipment and the data processing systems of the Processor.

11.2. For this purpose, the Processor shall be obliged to grant the Controller, during normal business hours: (a) access to the Processor's premises from which the Controller's personal data is managed and administered, for the purpose of inspecting physical and operational security controls applicable to workstations, access management and personnel; and (b) access to relevant documentation, configurations, and logs pertaining to the cloud infrastructure on which the Controller's personal data is processed and stored. The Controller shall coordinate inspections with the Processor in such a way that the operating procedures of the Processor are affected as little as possible.

11.3. The Processor shall provide the Controller with all necessary information to prove the technical and organisational measures as well as compliance with this Agreement and data protection regulations. This information especially includes current attestations, reports or report extracts from independent bodies (e. g. financial auditors, external experts, IT security or data protection auditors) and suitable certification. The Processor provides immediately the Controller with specific information on a case-by-case basis.

11.4. The Processor may satisfy the Controller's audit and inspection rights under this Section by providing current, independently certified attestation reports, including ISO 27001 certification, SOC 2 Type II reports (when available) or equivalent third-party audit reports covering the technical and organisational measures applicable to the processing of the Controller's personal data. Where the Controller has a specific, documented concern that cannot be reasonably addressed by the attestation reports provided, the Controller retains the right to conduct or commission an on-site inspection in accordance with Sections 11.1 and 11.2, provided that such inspection shall be limited in scope to the specific concern raised and shall not take place more than once per calendar year.

## 12. Liability

12.1. Each Party is liable for damage caused by processing which infringes Applicable Data Protection Law to the extent of its own responsibility for that damage. Where both Parties are responsible for the same damage, they shall be liable as between themselves in proportion to their respective shares of responsibility, and a Party against which a claim is made in whole or in part may recover from the other Party the amount corresponding to that other Party's share of responsibility.

12.2. The Processor is also liable to the Controller for compliance with data protection regulations by the subcontractors, which he uses to fulfil his tasks. The fault of subcontractors shall be attributed to the Processor as if it were his own fault.

12.3. The Processor shall assist the Controller with all information at its disposal if the Controller is subject to administrative or criminal proceedings, to the liability of an affected person or a third party or to any other claim in connection with the processing of data with the Processor.

12.4. Liability under this Data Processing Addendum is subject to the limitations and exclusions set out in Section 12 of the Terms of Service. Nothing in this Section limits either Party's liability to a data subject or to a supervisory or regulatory authority.

## 13. United States financial services requirements

13.1. This Section applies where the Customer is a "financial institution" within the meaning of the Gramm-Leach-Bliley Act, 15 U.S.C. §6801 et seq., and its implementing regulations ("GLBA"), and where Customer Personal Data includes "nonpublic personal information" within the meaning of GLBA ("NPI").

13.2. Mindsmiths shall: (a) implement and maintain administrative, technical and physical safeguards designed to protect the security, confidentiality and integrity of NPI, as further described in the Security Addendum; (b) hold NPI in confidence and use and disclose it solely for the purpose of providing the Platform and performing its obligations under the Main Agreement, and for no other purpose; and (c) not disclose NPI to any third party other than subprocessors engaged in accordance with Section 7 and bound by obligations no less protective than those set out in this Section.

13.3. Mindsmiths shall notify the Customer of any security event affecting NPI in accordance with §9 of the Security Addendum, and shall provide the Customer with such information and assistance as the Customer reasonably requires in order to satisfy its own notification obligations, including under 16 C.F.R. §314.4(j).

13.4. Mindsmiths shall, upon reasonable request, provide the Customer with information sufficient to enable the Customer to assess Mindsmiths' safeguards for the purposes of 16 C.F.R. §314.4(f)(3), including the reports and attestations referred to in §19 of the Security Addendum.

13.5. Where the Customer is subject to supervision by the Consumer Financial Protection Bureau or any other United States federal or state regulatory authority, Mindsmiths shall provide reasonable cooperation in connection with any examination or information request by that authority relating to the services provided under the Main Agreement.

## 14. Customer representations and responsibilities

14.1. The Customer represents and warrants that it has determined which data protection, privacy, consumer protection and communications laws apply to its processing of Customer Personal Data through the Platform, and that its instructions to Mindsmiths comply with those laws.

14.2. The Customer represents and warrants that it has a lawful basis for the processing it instructs, and has provided all notices and obtained all consents, authorisations and permissions required under applicable law for: (a) the collection and processing of Customer Personal Data through the Platform; (b) the transfer of Customer Personal Data to Mindsmiths and its subprocessors; and (c) the delivery of communications to data subjects through each Channel used by the Customer.

14.3. Without limiting Section 14.2, the Customer is solely responsible for compliance with the Telephone Consumer Protection Act, 47 U.S.C. §227, the CAN-SPAM Act, and any equivalent state or federal law governing electronic or telephonic communications, in respect of all communications delivered through the Platform at the Customer's direction. The Customer shall obtain and maintain records of all consents required for such communications, and shall promptly honour all opt-out, revocation and do-not-contact requests received from data subjects.

14.4. The Customer determines the categories of Customer Personal Data submitted to the Platform and is responsible for ensuring that it does not submit any special category, sensitive or regulated data beyond the categories set out in Section 2, unless agreed in writing by the Parties.

14.5. Mindsmiths acts on the Customer's instructions and does not verify the Customer's compliance with the matters set out in this Section.

## 15. Final provisions

15.1. Data carriers and data records provided to the Processor remain the property of the Controller.

15.2. If individual or several clauses of this Agreement should be ineffective, the effectiveness of the remaining agreement is not affected. In the event that individual or several provisions of the Platform License Agreement are invalid, the Parties shall immediately replace the invalid provision with a provision which most closely resembles the invalid provision in terms of commercial interests and data protection.

15.3. In the event of a contradiction between the Main Agreement and this Agreement, this Agreement shall take precedence in so far as the contradiction concerns the processing of personal data.

15.4. All services provided by the Processor in connection with the fulfilment of his obligations under this Agreement shall be settled with the remuneration from the Main Agreement.

© 2026 Mindsmiths, Inc.