Last Updated: March 27, 2024

This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1 posted at commonpaper.com/standards/data-processing-agreement/1.0 (“DPA Standard Terms”), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be “none” or “not applicable” and the correlating clause, sentence, or section does not apply to this Agreement. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.

Key Terms

The key legal terms are as follows:

Agreement: Minard Terms of Service

Approved Subprocessors:
• Name: Amazon Web Services, Inc.
• Country of location: United States of America
• Anticipated processing task: Cloud infrastructure services
• Name: Aptible, Inc.
• Country of location: United States of America
• Anticipated processing task: Cloud infrastructure services

Provider Security Contact: security@minard.ai

Security Policy: As defined in the Agreement.

Changes to the Agreement

Service Provider Relationship: To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq (“CCPA”) applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.

Restricted Transfers

Governing Member State:
• EEA Transfers: Netherlands
• UK Transfers: England and Wales

Annex I(A) List of Parties

Data Exporter:
• Name: the Customer signing this DPA
• Activities relevant to transfer: See Annex 1(B)
• Role: Controller

Annex I(B) Description of Transfer and Processing Activities

Service: The Service is: Minard is a data analytics and visualization platform, including AI-assisted visualization generation, editing, querying, transformations, and suggestions.

Categories of Data Subjects Customer's end users or customers

Categories of Personal Data Contact information such as email, phone number, or address

Special Category Data Contact information such as email, phone number, or address

Frequency of Transfer Continuous

Nature and Purpose of Processing:
• Receiving data, including collection, accessing, retrieval, recording, and data entry
• Holding data, including storage, organization, and structuring
• Using data, including analysis, consultation, testing, automated decision making, and profiling
• Updating data, including correcting, adaption, alteration, alignment, and combination
• Protecting data, including restricting, encrypting, and security testing
• Sharing data, including disclosure, dissemination, allowing access, or otherwise making available
• Returning data to the data exporter or data subject
• Erasing data, including destruction and deletion

Duration of Processing Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.

Annex I(C)

Competent Supervisory Authority The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II

Technical and Organizational Security Measures See Security Policy.