Data Processing Addendum

Template copy. Replace it with your own policy, reviewed by your legal advisor, before you launch.

1. Scope

This addendum forms part of your agreement with Meridel and applies whenever we process personal data on your behalf as a processor.

2. Roles

You are the controller of customer personal data. We act as your processor and follow your documented instructions, including those given through the product.

3. Confidentiality

Everyone who can access customer personal data is bound by confidentiality obligations and receives regular security training.

4. Security measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256)

• Single sign-on and role-based access for staff

• Logged and reviewed production access

• Annual penetration tests and a SOC 2 Type II audit

5. Sub-processors

We keep a current list of sub-processors and give at least 30 days’ notice before adding a new one. You may object on reasonable data protection grounds.

6. International transfers

Where data leaves the EEA or UK, we rely on Standard Contractual Clauses and supplementary measures. Enterprise customers can pin processing to a region.

7. Breach notification

We will notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.

8. Deletion and return

When your agreement ends you can export your data for 30 days. After that we delete it from production within 30 days and from backups within 90.

9. Audits

We make our latest audit reports available on request. Enterprise customers may conduct one additional audit per year with reasonable notice.