Data Processing Addendum

This Data Processing Addendum ("DPA") meets the requirements of Article 28(3) of Regulation (EU) 2016/679 (GDPR). It sets out how MADD processes personal data contained in requests to MaddLabs on behalf of the Customer.

Parties and conclusion

1. The parties are a Customer that is a business or other organisation and has accepted the Terms of Service (the "Customer"), and MADD Marcin Kisielinski, ul. Kajki 10-12, 10-547 Olsztyn, Poland, VAT ID PL7422297084 ("MADD").
2. This DPA is concluded automatically when the Customer accepts the Terms and applies without a separate signature. It does not apply to Consumers using the services for private purposes.
3. Where the Customer is a controller, MADD is a processor. Where the Customer is itself a processor, MADD is a subprocessor and the Customer warrants that the controller has authorised this.
4. Where MADD has concluded a separate data processing agreement with the Customer (in particular with a Marketplace), that agreement takes precedence over this DPA.

Definitions

Terms defined in the GDPR (in particular personal data, processing, controller, processor and personal data breach) have the meaning given in the GDPR. Customer Personal Data means personal data contained in Customer Content, that is, in requests sent to the API and in Model responses. Other capitalised terms have the meaning given in the Terms.

Subject matter, nature, purpose and duration

1. The subject matter of processing is Customer Personal Data. Its type and the categories of data subjects are determined by the Customer through the content of its requests. A description of the processing is in the annex at the end of this DPA.
2. Nature of processing: receiving a request, passing it to a Model running on a GPU server, generating the response and sending it to the Customer, in memory only.
3. Purpose: solely providing the API service to the Customer. MADD does not process Customer Personal Data for any other purpose and in particular does not use it to train models.
4. Duration: each request is processed for the time needed to generate and deliver the response. This DPA remains in force for as long as the agreement under the Terms.

Documented instructions

1. MADD processes Customer Personal Data only on the Customer's documented instructions. The instructions are the Terms including this DPA and the parameters of the requests the Customer sends to the API.
2. Where Union or Member State law requires MADD to process data otherwise, MADD informs the Customer before processing, unless that law prohibits such information on important grounds of public interest.
3. MADD informs the Customer without delay if, in its opinion, an instruction infringes the GDPR or other data protection law.
4. The Customer is responsible for the lawfulness of processing, in particular for having a legal basis for sending data to the API and for informing data subjects. The Customer sends special categories of data (Article 9 GDPR) and data relating to criminal convictions (Article 10 GDPR) only where it has a legal basis to do so, and at its own responsibility.

Confidentiality

Only the owner of MADD has access to the systems in which Customer Personal Data is processed and is bound to keep it confidential. If MADD authorises other persons to process data, it will bind them to confidentiality. The confidentiality obligation survives the end of this DPA.

Security measures

MADD implements technical and organisational measures under Article 32 GDPR appropriate to the risk, in particular:

1. zero retention: Customer Personal Data is processed in memory only and is not written to logs, databases or backups;
2. encryption of all communication: TLS between the Customer and the API gateway and between the API gateway and Runpod GPU servers, an SSH tunnel between the API gateway and MADD's server in Poland;
3. authentication of every request with an API Key; only hashes of API Keys and sign-in codes are stored;
4. administrative access to the servers limited to the business owner;
5. processing of content on servers in the European Economic Area;
6. Limits and budgets that reduce the impact of a compromised API Key;
7. regular software updates and availability monitoring based on metadata.

MADD may change the security measures provided the level of protection is not reduced.

Subprocessors

1. The Customer gives MADD general authorisation to engage subprocessors. The current list is on the Subprocessors page, which identifies the providers that handle Customer Personal Data.
2. MADD informs Customers of an intended addition or replacement of a subprocessor that handles Customer Personal Data by e-mail and by updating the Subprocessors page at least 30 days before the change. A shorter period is possible where the change is necessary for the continuity or security of the service; MADD then informs Customers without delay.
3. The Customer may raise a reasoned objection to the change within the period referred to in section 7.2 by e-mail to prywatnosc@madd.im. The parties will try to resolve it. If they cannot, the Customer may terminate the agreement with immediate effect and recover unused Balance funds without deductions.
4. MADD imposes on subprocessors data protection obligations that are in substance equivalent to this DPA, in particular through the data processing agreements offered by those providers, and remains liable to the Customer for their performance.

Transfers outside the EEA

Customer Personal Data is processed in the European Economic Area: the API gateway on an OVH server in the European Union, MADD's own GPU server in Poland, and Runpod GPU servers in Sweden and Iceland. The location for each model is published in /v1/models. If processing were to involve a third country, MADD will give notice under section 7.2 and put in place safeguards under Chapter V GDPR, in particular the Standard Contractual Clauses.

Assistance

1. Taking into account the nature of processing, MADD assists the Customer in responding to requests from data subjects. Because Customer Personal Data is not stored, MADD will normally hold no data to which such a request could relate. MADD forwards any request addressed directly to it to the Customer without delay, if it can determine which Customer it concerns.
2. MADD provides the Customer with the information needed for data protection impact assessments and prior consultation (Articles 35 and 36 GDPR) and for compliance with Articles 32 to 34 GDPR, to the extent they concern the API service.

Personal data breaches

1. MADD notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay and in any case within 48 hours of becoming aware of it, by e-mail to the Account address.
2. The notification includes, as far as available, the information listed in Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken or proposed. Information that cannot be provided at once is provided in phases.
3. MADD documents breaches and cooperates with the Customer to mitigate their effects.

Deletion

Customer Personal Data is removed from memory after each response is delivered, so on termination of this DPA there is no data to return or delete. Request metadata, which contains no content, is processed by MADD as controller under the Privacy Policy.

Audits and information

1. MADD makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, in particular this DPA, the Data Policy, the Subprocessors list and written answers to the Customer's reasonable questions, within 30 days of receiving them.
2. An audit or on-site inspection at MADD is possible where required by a supervisory authority or where the information under section 12.1 is not sufficient to demonstrate compliance, in particular after a personal data breach. The audit takes place with at least 30 days' notice, on business days, without disrupting MADD's business, at the Customer's cost, by the Customer or an auditor bound by confidentiality, no more than once a year unless caused by a breach.
3. For the infrastructure of subprocessors, MADD provides the documentation and information made available by those providers.

Liability

The parties' liability for damage resulting from a breach of this DPA is subject to the limitations in the Terms, except liability towards data subjects and supervisory authorities that the GDPR does not allow to be limited.

Term and precedence

1. This DPA remains in force for as long as the agreement under the Terms and, as regards confidentiality, also after it ends.
2. In matters of personal data protection this DPA takes precedence over the Terms. Otherwise the Terms apply.
3. Changes to this DPA are made in the same way as changes to the Terms. The Polish version is binding.

Annex: description of processing