mDOS Data Processing Agreement

Version 2.0, effective 11 October 2026. For customers who accepted an earlier version, this version applies 30 days after we notify you of it.

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between MDOS AI LTD (“Processor”, “we”, “us”) and the Client (“Controller”, “you”) and governs the processing of personal data by the Processor on behalf of the Controller through the mDOS platform.

This DPA is entered into in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In the event of conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails.

1. Definitions

Terms not defined here have the meaning given in the mDOS Terms of Service or UK GDPR.

“Personal Data” means any data relating to an identified or identifiable natural person that is processed through the Platform on behalf of the Controller.

“Processing” means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.

“Sub-Processor” means any third party engaged by us to process Personal Data on behalf of the Controller.

“Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

2. Scope and Roles

2.1. You (the Client) are the Data Controller for all Personal Data that you collect, store, or manage through the Platform, including CRM contacts, form submissions, email subscriber lists, and End User data. This includes, where you switch the features on: website visitor intelligence, where the visitor's IP address is used only at the moment of the visit to look up which organisation holds that address range and is not stored, and the organisation identified, the pages viewed and the visit times are kept for you; and e-signature records for contracts you send for signature, namely each signer's name, email address, IP address, browser and device details, signature, how their email address was confirmed, and when the document was sent, viewed and signed, together with a fingerprint (SHA-256 hash) of the document. Where the Client buys the Coached or Managed Marketing tier or a Done-for-you Service, the staff of your mDOS Expert Partner (such as Founding Partner MDOS AI LTD) process personal data in the Client's account, including contacts supplied for email, SMS and outreach, only on the Client's documented instructions, which include the approvals and Autopilot rules set in the Platform. AI features make recommendations and do not send, publish or launch anything without those instructions.

2.2. We (MDOS AI LTD) are the Data Processor. We process Personal Data solely on your behalf and in accordance with your documented instructions.

2.3. This DPA applies to all Personal Data processed through the Platform, regardless of Subscription tier, including the Free Plan and Trial.

2.4. Agency Partners and White-label. Where an agency uses the Platform to serve its own clients, including under its own brand: for its clients' Personal Data the agency is either the Controller or, where it acts for its client, a Processor, and we are its Processor or Sub-Processor accordingly. The agency is responsible for having a data processing agreement in place with each of its clients that permits our processing under this DPA. White-label branding does not change our role or our obligations under this DPA.

3. Processing Instructions

3.1. We will process Personal Data only in accordance with your documented instructions, which are defined by:

• Your configuration of the Platform (what data you collect, how you use it)
• These Terms and the mDOS Terms of Service
• Any additional written instructions you provide

3.2. If we believe an instruction infringes UK GDPR, we will notify you promptly.

3.3. The categories of Personal Data processed, the categories of data subjects, and the purposes of processing are determined by how you use the Platform. Typical categories include:

Data Category	Data Subjects	Purpose
Contact details (name, email, phone)	Customers, leads, enquiries	CRM management, communication
Date of birth	Customers (where provided)	Loyalty programmes, birthday marketing
Form submission data	Website visitors	Enquiry handling, lead capture
Email subscriber data	Newsletter subscribers	Email marketing campaigns
Marketing consent records	All contacts	GDPR/PECR compliance
Booking/reservation data	Customers	Booking management, deposits
Order data	Customers	Order fulfilment, reporting
Event/ticketing data	Ticket purchasers	Event management, check-in
Loyalty data	Programme members	Points, tiers, rewards
WiFi portal data	Customers, visitors	WiFi access, CRM capture
Payment references	Paying customers	Transaction records
Website visitor analytics	Website visitors	Performance monitoring
Customer portal accounts	Registered customers	Self-service access
Review data	Reviewed customers	Reputation management

4. Security Measures

4.1. We implement appropriate technical and organisational measures to protect Personal Data, including:

Technical Measures:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Row Level Security (RLS) enforced on every database table using company-level isolation
• 68 CASCADE foreign keys converted to RESTRICT preventing accidental cascade deletes
• bcrypt password hashing (work factor 10, applied by our authentication provider) with leaked password protection
• AES-256-GCM encryption for OAuth tokens and integration credentials at rest
• HMAC-SHA256 signed state parameters on all OAuth flows (10-minute TTL)
• Stripe webhook signature verification on all payment endpoints
• Rate limiting via Upstash Redis on authentication and public API endpoints
• Content Security Policy (CSP) headers with violation reporting
• Role-based access control across a 10-role model spanning five scope levels, with permission controls across all 31 modules
• Automated daily database backups with point-in-time recovery
• Immutable audit logging of all data access and modifications
• Sentry error tracking with automatic PII redaction (email addresses stripped from error context)
• gitleaks secret scanning on every git push

Organisational Measures:

• Staff access to Client Data limited to those who require it for support or maintenance; every access is logged, and the account's administrators receive an email on any day our team accessed the account
• Staff bound by confidentiality obligations
• Security incident response procedures
• Regular review of security measures

5. Sub-Processors

5.1. You provide general authorisation for us to engage Sub-Processors to assist in providing the Platform. The authoritative and current list of Sub-Processors, including their purposes, data locations, and applicable transfer mechanisms, is maintained at mdos.ai/sub-processors. Key Sub-Processors include, but are not limited to: Supabase (database, authentication, and storage), Railway (application hosting), Cloudflare and Cloudflare R2 (CDN, WAF, and object storage), Stripe (payment processing), Resend (email delivery), Twilio (SMS and WhatsApp messaging), Trigger.dev (background jobs), Sentry (error tracking), PostHog (product analytics), Upstash (rate limiting and caching), Google Gemini, OpenAI, and Anthropic (AI Workforce and AI features), Google Calendar API and Microsoft Graph API (calendar synchronisation, opt-in only), and Channex (OTA channel connectivity for accommodation venues).

5.2. We will notify you at least 30 days before adding or replacing a Sub-Processor. You may object to the change within that period. If you object and we cannot accommodate your concern, you may terminate your Subscription.

5.3. All Sub-Processors are bound by data processing agreements that impose equivalent data protection obligations.

5.4. AI Data Processing & Multi-Model Sub-Processing. The Platform routes automated tasks across enterprise AI foundation models (including Google Gemini, OpenAI, and Anthropic). All AI sub-processors process Client Data in transit only under Enterprise Data Processing Terms that explicitly prohibit the use of Client Data for AI model training. Client Data is not retained by AI sub-processors after request execution. Clients may disable AI features per account via module settings.

6. Data Breach Notification

6.1. We will notify you of a Data Breach without undue delay and in any event within 72 hours of becoming aware of it.

6.2. The notification will include:

• A description of the nature of the breach
• The categories and approximate number of data subjects affected
• The categories and approximate number of records affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach

6.3. We will cooperate with you in investigating and remediating the breach, and in fulfilling your obligations to notify supervisory authorities and affected data subjects.

7. Data Subject Rights

7.1. We will assist you in responding to requests from data subjects exercising their rights under UK GDPR (access, rectification, erasure, restriction, portability, objection).

7.2. If we receive a request directly from a data subject regarding Client Data, we will redirect them to you unless legally required to respond directly.

7.3. The Platform provides tools to help you fulfil data subject requests:

• Data Export (for access and portability requests)
• Content editing (for rectification requests)
• Record deletion (for erasure requests)
• Contact anonymisation (for erasure where full deletion is not possible)

8. Data Retention and Deletion

8.1. We will process and retain Personal Data for the duration of your Subscription.

8.2. Upon termination of your Subscription, Personal Data will be handled in accordance with the cancellation and offboarding provisions in the Terms of Service (30-day grace period, 60-day archive, permanent deletion at 90 days).

8.3. You may request immediate deletion of specific records at any time through the Platform or by contacting us.

8.4. Upon request, we will provide written confirmation that Personal Data has been deleted.

8.5. On termination, and at the Controller’s choice, the Processor will return or delete all Personal Data, save where retention is required by law.

9. International Transfers

9.1. Personal Data may be transferred to and processed in the United States and European Union by our Sub-Processors.

9.2. Where personal data is transferred outside the UK, we rely on UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as appropriate. Transfer mechanisms for each Sub-Processor are detailed at mdos.ai/sub-processors.

9.3. Details of the specific transfer mechanisms in place are available upon request.

10. Audits and Compliance

10.1. We will make available to you all information necessary to demonstrate compliance with our obligations under this DPA.

10.2. We will allow and contribute to audits and inspections conducted by you or an independent auditor mandated by you, subject to reasonable notice and scope limitations.

10.3. Audits shall be conducted during normal business hours, no more than once per year (unless a Data Breach has occurred), and subject to confidentiality obligations.

11. Data Protection Impact Assessments

11.1. We will provide reasonable assistance to you in conducting Data Protection Impact Assessments (DPIAs) where required, particularly in relation to the types of processing carried out through the Platform.

12. Term and Termination

12.1. This DPA remains in effect for as long as we process Personal Data on your behalf.

12.2. This DPA automatically terminates when all Personal Data has been deleted or returned to you following account cancellation.

12.3. Provisions relating to confidentiality, liability, and data deletion obligations survive termination.

13. Liability

13.1. Each party's liability under this DPA is subject to the limitation of liability provisions in the mDOS Terms of Service.

14. Governing Law

14.1. This DPA is governed by the laws of England and Wales and subject to the exclusive jurisdiction of the courts of England and Wales.

15. Contact

Data Protection Contact:

MDOS AI LTD
3 Warren Close
Brighton, BN2 6DT
United Kingdom

Email: privacy@mr-digital.co.uk