Data Processing Agreement

This agreement forms part of the Maplith Terms & Conditions. It governs the personal data Maplith processes on behalf of a customer. It follows the structure of the European Commission's standard contractual clauses between controllers and processors (Article 28(7) GDPR, Decision (EU) 2021/915), written in plain English. Clause 5 of the Commission's clauses (the optional docking clause) is not used, so the numbering goes from 4 to 6.

This agreement states what the processing is and the minimum level of protection Maplith keeps. The Processing and security description ("the description") states how the service carries out the processing today, flow by flow. It is versioned and public, it is kept true to the product, and clause 6 governs how it changes.

Section I

Clause 1 — Purpose and scope

1.1 The purpose of these clauses is to ensure compliance with Article 28(3) and (4) of the GDPR.

1.2 The controller is the customer identified in Annex I. The processor is Maplith ApS, identified in Annex I.

1.3 These clauses apply to the processing of personal data described in Annex II.

1.4 Annexes I to IV form an integral part of these clauses. The description and the sub-processor list are incorporated as clauses 6 and 7.7 provide.

1.5 These clauses do not by themselves ensure compliance with the obligations on international transfers in Chapter V of the GDPR. Clause 7.8 governs transfers.

Clause 2 — Invariability

The parties may not modify these clauses except under clause 6 (the description), clause 7.7 (the sub-processor list) and section 13 of the Terms. This does not prevent the parties from including these clauses in a broader contract, or from adding other clauses, provided those do not contradict these clauses or prejudice the rights of data subjects.

Clause 3 — Interpretation

Terms defined in the GDPR have the same meaning here. These clauses are read in the light of the GDPR and never in a way that conflicts with the rights and obligations it provides.

Clause 4 — Hierarchy

Where these clauses contradict any related agreement between the parties, including the Terms & Conditions and the description, these clauses prevail.

Clause 5 — Docking clause

Not used.

Section II — Obligations of the parties

Clause 6 — Description of the processing

6.1 Annex II specifies the processing: its subject matter, duration, nature and purposes, and the categories of personal data and data subjects.

6.2 The description states, for each feature of the service, what personal data it processes, where, with which sub-processors, how long it is kept, and the measures that apply. It is the documentation of the processing for clause 7.6. It is public, versioned and dated, and has a changelog.

6.3 The processor updates the description when the service changes, so that it stays accurate. Every update must meet all of the following:

• (a) the processing it describes stays within the purposes and categories of Annex II;
• (b) the measures it describes are never below the level of Annex III;
• (c) it is published, with a dated changelog entry, before or when the change takes effect;
• (d) where it lengthens a retention period, adds a category of personal data or of data subjects, or adds a kind of record that survives the deletion of a workspace, it is announced at least 30 days before it takes effect, in the same way and with the same right to object as a sub-processor change under clause 7.7.2.

6.4 A change that would not meet 6.3(a) or 6.3(b) is a change to these clauses. It needs the controller's acceptance under section 13 of the Terms.

Clause 7 — Obligations of the parties

7.1 Instructions

7.1.1 The processor processes personal data only on documented instructions from the controller, unless Union or Member State law requires it to. In that case the processor informs the controller of that requirement before processing, unless the law prohibits it. The documented instructions are:

• these clauses with their annexes;
• the controller's use and configuration of the service through the people and agents it authorises: uploading exports and configuring connectors; settings, roles, access grants and masking choices; agent keys, their scopes and policies; signal rules and watches, and the reporters bound to them; the use of features such as the in-app assistant; and integrations it installs;
• any further written instruction sent to the contact address in Annex I.

The description says how each of these is carried out.

7.1.2 By accepting these clauses, the controller instructs the processor to make the transfers that the sub-processor list states, in the manner the description states (clause 7.8).

7.1.3 The processor immediately informs the controller if, in the processor's opinion, an instruction infringes the GDPR or other applicable data protection law.

7.1.4 The controller is responsible for the lawfulness of the processing it instructs. It must have a lawful basis for the personal data in the exports it uploads or connects, and must have informed the data subjects as Articles 13 and 14 GDPR require. Maplith cannot do either on the controller's behalf.

7.2 Purpose limitation

The processor processes the personal data only for the purposes set out in Annex II, unless it receives further documented instructions from the controller. The processor does not use the personal data, the uploaded files or the map for its own purposes, including to train or improve models, and does not use one controller's data to build another controller's map.

7.3 Duration

Processing takes place for as long as the controller uses the service and until deletion under clause 10.4.

7.4 Security of processing

7.4.1 The processor implements at least the technical and organisational measures in Annex III to ensure the security of the personal data. That includes protection against breaches of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to the data. In assessing the appropriate level of security, the parties take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks for the data subjects. The measures may evolve, but never below the level of Annex III. The description states the measures in force.

7.4.2 The processor grants its personnel access to the personal data only to the extent strictly necessary for implementing, managing and monitoring the contract, and ensures that those persons are bound by confidentiality. Access to a controller's workspace follows Annex III.

7.5 Sensitive data

7.5.1 Maplith does not select, filter or restrict what the controller uploads, and the product is not built to. What the exports contain is the controller's decision. Where they contain special categories of personal data (Article 9 GDPR), data relating to criminal convictions and offences (Article 10), Danish civil registration (CPR) numbers (section 11 of the Danish Data Protection Act) or other data subject to specific restrictions, the controller decides whether to include it, and clause 7.1.4 governs the lawfulness of that decision. No notice to the processor is required beforehand.

7.5.2 The processor handles every upload the same way, whatever it contains, with the measures of Annex III. The description lists the settings with which the controller can limit what is sent for processing. A controller that does not want such data processed leaves it out of its exports.

7.5.3 This clause allocates a decision and its consequences between the parties. It does not reduce the processor's own obligations. Clause 7.4, the assistance under clause 8, the breach notification under clause 9 and every other obligation in these clauses apply to this data exactly as they apply to the rest.

7.6 Documentation and compliance

7.6.1 The parties can each demonstrate compliance with these clauses.

7.6.2 The processor deals promptly and properly with all reasonable enquiries from the controller about the processing.

7.6.3 The processor makes available to the controller all information necessary to demonstrate compliance with these clauses and with Article 28 GDPR. Compliance is shown through documentation: this agreement; the description with its changelog; the sub-processor list; the audit trail of privileged changes that the controller's owners and admins read, export and verify in the product, every Maplith staff access included; and, at the controller's choice, written answers to its questions or a completed security questionnaire, within 30 days. The controller may also commission an audit by an independent auditor bound by confidentiality, at its own cost, no more than once a year and on at least 30 days' notice, unless a supervisory authority requires otherwise or a personal data breach has occurred. The processor contributes to the audit and is given a copy of the report.

7.6.4 The processor keeps the record of processing activities required by Article 30(2) GDPR and produces an export of it on request.

7.7 Use of sub-processors

7.7.1 The controller gives the processor general written authorisation to engage sub-processors of the processor's choice, provided each is bound as 7.7.4 describes and any transfer outside the EEA meets clause 7.8. The sub-processors engaged at any time are listed in the sub-processor list published at maplith.com/sub-processors (Annex IV), with the purpose for which each is used. The list is kept current.

7.7.2 The processor informs the controller in writing at least 30 days before any of these changes takes effect:

• the addition or replacement of a sub-processor;
• the use of a listed sub-processor for a purpose its row does not state;
• a new processing location or transfer mechanism for a listed sub-processor.

Notice is given by updating the published list and by email to the controller's organisation owners and admins and to the addresses on the notice list described there. The email to owners and admins is on by default, and each of them can switch it off, and on again, in the product. The controller may object before the change takes effect on reasonable, documented data protection grounds, and the processor considers the objection in good faith. If the processor proceeds, the controller's sole remedy is to terminate the affected services without penalty. The processor then deletes or returns the controller's data as clause 10.4 describes.

7.7.3 Where a sub-processor must be replaced at short notice for security or continuity reasons (for example a provider ceasing operations, or a security incident at a provider), the processor informs the controller as soon as possible, and in any case before the replacement starts processing the controller's personal data. The controller keeps the right to object and terminate under 7.7.2.

7.7.4 Where the processor engages a sub-processor, it does so under a written contract that imposes, in substance, the same data protection obligations as these clauses, and ensures that the sub-processor complies with them.

7.7.5 At the controller's request, the processor provides a copy of the sub-processor agreement and any later amendments. Commercial terms may be redacted.

7.7.6 The processor remains fully responsible to the controller for the sub-processor's performance of its obligations.

7.8 International transfers

7.8.1 The controller instructs and authorises the processor to transfer personal data to third countries, including the United States, to the extent that the processor or its sub-processors process it there, provided each transfer complies with Chapter V of the GDPR. Any other transfer takes place only on documented instructions from the controller or to comply with Union or Member State law.

7.8.2 The processor and its sub-processors may ensure compliance with Chapter V by any mechanism it permits, provided the conditions for its use are met. That includes an adequacy decision (and, where the recipient is certified under it, the EU–US Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795), the standard contractual clauses adopted by the Commission (Decision (EU) 2021/914), or another appropriate safeguard. Where standard contractual clauses are used, the processor assesses the transfer as the law requires.

7.8.3 The sub-processor list states, for each sub-processor, where it processes and the transfer mechanism. The controller's acceptance of these clauses is its documented instruction for those transfers (clause 7.1.2). A new location or mechanism is notified under clause 7.7.2.

Clause 8 — Assistance to the controller

8.1 The processor notifies the controller promptly, and at the latest within 5 working days, of any request it receives from a data subject concerning the controller's data. It does not respond to the request itself unless the controller has authorised it to.

8.2 The processor assists the controller in responding to data subjects' requests to exercise their rights, taking into account the nature of the processing. The description states how this is done today, what the controller can do itself in the product, and the deadlines. A request about one named person in the map is completed within 30 days, and in any case in time for the controller to meet its own deadline under Article 12(3) where it forwards the request within 5 working days of receiving it.

8.3 Taking into account the nature of the processing and the information available to it, the processor also assists the controller with: data protection impact assessments (Article 35); prior consultation of the supervisory authority (Article 36); security of processing (Article 32), through Annex III and the description; and notification of personal data breaches (Articles 33 and 34), through clause 9.

8.4 For an impact assessment or a prior consultation, the processor provides Annex III, the description and the sub-processor list, and answers written questions within 30 days.

Clause 9 — Notification of personal data breach

9.1 In the event of a personal data breach, the processor cooperates with and assists the controller so that the controller can comply with Articles 33 and 34 GDPR.

9.2 For a breach concerning data processed by the controller, the processor assists the controller in notifying the supervisory authority and, where relevant, in communicating with the data subjects.

9.3 For a breach concerning data processed by the processor, including at a sub-processor, the processor notifies the controller without undue delay, and no later than 48 hours after becoming aware of it, by email to the controller's contact address in Annex I. The notification contains at least: the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point for further information. Where not all of this is available at once, it is provided in phases without undue delay. The processor documents every breach, its effects and the remedial action taken, and makes the documentation available to the controller.

9.4 The processor keeps a written incident-response procedure covering detection, containment, assessment, notification under 9.3 and documentation.

Section III — Final provisions

Clause 10 — Non-compliance and termination

10.1 If the processor breaches its obligations under these clauses, the controller may instruct the processor to suspend the processing until the breach is remedied or the contract is terminated.

10.2 The controller may terminate the contract insofar as it concerns processing under these clauses if: the processing has been suspended for more than one month and the breach is not remedied; the processor is in substantial or persistent breach of these clauses; or the processor fails to comply with a binding decision of a competent court or supervisory authority.

10.3 The processor may terminate insofar as it concerns processing under these clauses where, after informing the controller that an instruction infringes applicable law, the controller insists on compliance with that instruction.

10.4 Following termination, the processor, at the controller's choice, deletes all personal data processed on behalf of the controller and certifies that it has done so, or returns the personal data and deletes existing copies, unless Union or Member State law requires storage. The controller states its choice within 30 days of termination; if it does not, the processor deletes. Deletion or return is completed within 30 days of the controller's choice or of the end of that period. Until the deletion is complete, the processor continues to comply with these clauses. Records that the description lists as surviving deletion (for example the audit trail of privileged changes, kept for security and legal claims, and records the law requires) are kept only as long as it states. Copies in the hosting provider's backups expire within the backup period of Annex III.

Annex I — List of parties

Controller: the customer — the organisation recorded in the workspace's organisation profile (Settings → Organisation: name, CVR number where entered, contact email) or, where no profile has been completed, the organisation on whose behalf the admin user created the workspace. The contact email of the organisation profile, or failing that the email address of the admin who created the workspace, is the controller's contact address for notices under these clauses. The controller may also register a privacy or data-protection contact in the organisation profile, which receives the staff-access notices of Annex III.

Processor: Maplith ApS, CVR 46843290, Ørnekulsvej 15, 2920 Charlottenlund, a Danish private limited company established in Denmark. Contact for all matters under this agreement: [email protected]. Supervisory authority: Datatilsynet (Denmark).

Entry into force: this agreement applies from the moment the customer accepts the Terms & Conditions of which it forms part, and in any case from the first upload or connector configuration. Each upload queued for a build records the version of this agreement in force at that moment: the newest published version whose effective date has passed, never a text that is not yet published or not yet in effect. Acceptance is given in the app by an explicit step that records the version accepted, the accepting user, the organisation and the time, and confirms it by email. The record and the exact text accepted are available under Settings → Organisation → Legal, and every published version is kept with its date. For a customer with whom Maplith has a separately signed copy of this agreement, the signed copy governs.

Annex II — Description of the processing

Subject matter. Providing the Maplith service to the controller: building, keeping and serving a map of the controller's business systems and data (business objects, fields, relations, processes, metrics, findings and signals), and the features built on that map.

Duration. For as long as the controller uses the service, and until deletion under clause 10.4.

Nature of the processing. Collection (from uploaded exports, from connectors the controller configures, and from reports the controller's own tools and agents send), automated analysis (including with language models), structuring, storage, masking, retrieval, use, disclosure to the controller's authorised users and agents, transmission to the sub-processors on the list, and erasure.

Purposes. The processor processes personal data only to provide the service to the controller, which covers:

1. Building and keeping the map: reading the exports and connector sources the controller provides to derive the map's metadata, and rebuilding it when the controller or a schedule it set asks.
2. Analysing the map and its sources: deriving findings, processes, metrics, personal-data flags, signals, proposed playbooks and other suggestions, and checking the controller's rules against the map.
3. Serving the map: making it available to the controller's users in the app, to the in-app assistant acting for a user, and to the agents the controller authorises, within the scope the controller sets. That includes answering questions about the map in plain language.
4. Receiving what the controller's tools report: reports from the controller's own tools and agents on conditions it defined (watches), records of actions its agents took, and the automations it registers, and raising signals from them.
5. Proposing and carrying out changes within the controller's policies: proposing changes to the map or to the controller's configuration for a person to apply, and recording and authorising actions by the controller's agents within the policies and limits the controller sets.
6. AI processing: carrying out the purposes above with language models operated by the sub-processors on the list, for the features the description names.
7. Notifications: messages to the controller's users about their workspace, its builds, signals, approvals, access, legal documents and the account.
8. Integrations the controller installs, such as the GitHub App, for the purposes above.
9. Support, security and the controller's assistance: support and diagnosis the controller asks for or a fault requires, abuse prevention, security monitoring, backups, the audit trail, and assistance under clauses 8 and 9.

Categories of data subjects. Determined by the controller through what it uploads, connects or reports. Typically the controller's customers, employees, suppliers and other business contacts appearing in its systems; persons whose identifiers appear in reports the controller's tools send; and the controller's own users of Maplith.

Categories of personal data. Determined by the controller through what it uploads, connects or reports: whatever its exports contain, typically identification and contact details, customer and order history, employment data and free-text correspondence. Maplith does not select, filter or restrict the content of exports before processing. Separately and always: the controller's users' account data (email address, name, workspace membership and roles, sign-in events, agent keys and their use), and what users write to the in-app assistant.

Special categories. Not requested and not technically restricted (clause 7.5). A field whose header names a special category is flagged as such, as a best-effort label; nothing is filtered or handled differently because of the flag.

Retention. Personal data is kept no longer than the retention schedule in the description states, and in any case not after deletion under clause 10.4, except records the description lists as surviving deletion. A longer period is a change under clause 6.3(d).

Account and usage data. For the account and usage data of the controller's users, Maplith acts as a controller in its own right, and the privacy policy governs it. It is listed here for completeness.

Annex III — Technical and organisational measures (the floor)

The measures below are the minimum. Maplith may change how it implements them and may add to them, but never below this level (clause 7.4.1). The description states the measures in force, in detail, and its changelog records every change.

1. Hosting in the EU. The database, the file storage and the application and build services run in the European Economic Area. Personal data leaves the EEA only to the sub-processors and under the mechanisms the sub-processor list states.
2. Uploaded export files are not kept. An uploaded export file is deleted after the build that reads it, whether the build succeeds or fails, and a sweep removes any upload older than a day. Working copies in the build service exist only during a run (or a scheduled check of the controller's rules) and are removed when it ends or, if the service stops mid-way, by its sweep or when its container is replaced. Uploaded files are not backed up.
3. No secondary use. Customer data is not used to train models, not used to build another customer's map, and not used for Maplith's own purposes. Sub-processors that provide language models are bound not to train on it.
4. Encryption. TLS on every connection. Encryption at rest of the database and the file storage. Connector credentials and other secrets the controller gives Maplith are encrypted at the application layer, with the key held outside the database.
5. Tenant isolation and access control. Every table that holds customer data is protected by row-level security, so a user sees only the workspaces they are a member of, within their grants. Roles are enforced on the server. Tenant isolation is tested automatically before every deployment.
6. Agent access. Agent keys are stored only as hashes, shown once, scoped, rate-limited, revocable at once, and read-only unless an admin chooses otherwise. Every action an agent takes through Maplith is recorded.
7. Masking before AI processing. Before the service sends customer file content or map text to a language-model provider, and before it stores text a model wrote, Maplith tries to mask at least email local parts, Danish CPR numbers, IBANs and payment card numbers, and the masking terms the controller names. Masking is a safeguard: it cannot guarantee that every identifier is caught. Content from the controller's files is marked to the model as data, never as instructions.
8. Personnel. Only personnel bound by confidentiality have access, and only as far as strictly necessary. Administrative access to the systems is held only by the personnel the description names, and is used only to operate the service and to carry out the controller's requests. In the product, Maplith staff see a controller's workspace only through access opened for a support case: read-only, time-limited, recorded with a written reason, shown in the workspace, and notified to the controller at once. It never reaches uploaded files, masking terms, agent keys, connections or settings, and allows no change.
9. Audit trail. Every privileged change to an account, every Maplith staff access included, is recorded in an append-only, tamper-evident audit trail that the controller's owners and admins can read, export and verify.
10. Change control and secrets. No secrets in the source code. Production changes deploy only after the automated test suite has passed. Dependencies are kept current and scanned.
11. Backups. The database is backed up by the hosting provider, and backups expire within 30 days.
12. Monitoring and incidents. Automated monitoring and alerts. A written incident-response procedure. Breach notification as clause 9.3.

Annex IV — Sub-processors

The sub-processor list at maplith.com/sub-processors is Annex IV. It states, for each sub-processor, its purpose, the categories of data it receives, where it processes them, and the transfer mechanism. Changes follow clause 7.7. The description states, per feature, what each sub-processor receives.