mDOS Data Processing Agreement
Archived version. This is the version dated 18 October 2026, kept for reference after Version 3.0 replaced it on 21 October 2026. It no longer applies. The current version is at mdos.ai/dpa.
Version 2.1, effective 18 October 2026. For customers who accepted an earlier version, this version applies 30 days after we notify you of it.
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between MDOS AI LTD, Company No. 17526969 (“Processor”, “we”, “us”) and the Client (“Controller”, “you”) and governs the processing of personal data by the Processor on behalf of the Controller through the mDOS platform.
This DPA is entered into in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
In the event of conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails.
1. Definitions
Terms not defined here have the meaning given in the mDOS Terms of Service or UK GDPR.
“Personal Data” means any data relating to an identified or identifiable natural person that is processed through the Platform on behalf of the Controller.
“Processing” means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
“Sub-Processor” means any third party engaged by us to process Personal Data on behalf of the Controller.
“Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
2. Scope and Roles
2.1. You (the Client) are the Data Controller for all Personal Data that you collect, store, or manage through the Platform, including CRM contacts, form submissions, email subscriber lists, and End User data. Where the Client buys the Coached or Managed Marketing tier or a Done-for-you Service, those services are supplied by the Client's mDOS Expert Partner (such as our Founding Partner Agency, Mr Digital Ltd) under its own contract with the Client, and the Expert Partner's staff process personal data in the Client's account, including contacts supplied for email, SMS and outreach, only on the Client's documented instructions, which include the approvals and Autopilot rules set in the Platform. AI features make recommendations and do not send, publish or launch anything without those instructions.
2.2. We (MDOS AI LTD) are the Data Processor. We process Personal Data solely on your behalf and in accordance with your documented instructions.
2.3. This DPA applies to all Personal Data processed through the Platform, regardless of Subscription tier, including the Free Plan and Trial.
2.4. Agency Partners and White-label. Where an agency uses the Platform to serve its own clients, including under its own brand: for its clients' Personal Data the agency is either the Controller or, where it acts for its client, a Processor, and we are its Processor or Sub-Processor accordingly. The agency is responsible for having a data processing agreement in place with each of its clients that permits our processing under this DPA. White-label branding does not change our role or our obligations under this DPA.
3. Processing Instructions
3.1. We will process Personal Data only in accordance with your documented instructions, which are defined by:
- Your configuration of the Platform (what data you collect, how you use it)
- These Terms and the mDOS Terms of Service
- Any additional written instructions you provide
3.2. If we believe an instruction infringes UK GDPR, we will notify you promptly.
3.3. The categories of Personal Data processed, the categories of data subjects, and the purposes of processing are determined by how you use the Platform. Typical categories include:
| Data Category | Data Subjects | Purpose |
|---|---|---|
| Contact details (name, email, phone) | Customers, leads, enquiries | CRM management, communication |
| Date of birth | Customers (where provided) | Loyalty programmes, birthday marketing |
| Form submission data | Website visitors | Enquiry handling, lead capture |
| Email subscriber data | Newsletter subscribers | Email marketing campaigns |
| Marketing consent records | All contacts | GDPR/PECR compliance |
| Booking/reservation data | Customers | Booking management, deposits |
| Order data | Customers | Order fulfilment, reporting |
| Event/ticketing data | Ticket purchasers | Event management, check-in |
| Loyalty data | Programme members | Points, tiers, rewards |
| WiFi portal data | Customers, visitors | WiFi access, CRM capture |
| Payment references | Paying customers | Transaction records |
| Website visitor analytics | Website visitors | Performance monitoring |
| Customer portal accounts | Registered customers | Self-service access |
| Review data | Reviewed customers | Reputation management |
4. Security Measures
4.1. We implement appropriate technical and organisational measures to protect Personal Data, including:
Technical Measures:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Row Level Security (RLS) enforced on every database table using company-level isolation
- 68 CASCADE foreign keys converted to RESTRICT preventing accidental cascade deletes
- bcrypt password hashing (work factor 10, applied by our authentication provider) with leaked password protection
- AES-256-GCM encryption for OAuth tokens and integration credentials at rest
- HMAC-SHA256 signed state parameters on all OAuth flows (10-minute TTL)
- Stripe webhook signature verification on all payment endpoints
- Rate limiting via Upstash Redis on authentication and public API endpoints
- Content Security Policy (CSP) headers with violation reporting
- Role-based access control across a 10-role model spanning five scope levels, with permission controls across all 31 modules
- Automated daily database backups with point-in-time recovery
- Immutable audit logging of all data access and modifications
- Sentry error tracking with automatic PII redaction (email addresses stripped from error context)
- gitleaks secret scanning on every git push
Organisational Measures:
- Staff access to Client Data limited to those who require it for support or maintenance; every access is logged, and the account's administrators receive an email on any day our team accessed the account
- Staff bound by confidentiality obligations
- Security incident response procedures
- Regular review of security measures
5. Sub-Processors
5.1. You provide general authorisation for us to engage Sub-Processors to assist in providing the Platform. The authoritative and current list of Sub-Processors, including their purposes, data locations, and applicable transfer mechanisms, is maintained at mdos.ai/sub-processors. Key Sub-Processors include, but are not limited to: Supabase (database, authentication, and storage), Railway (application hosting), Cloudflare and Cloudflare R2 (CDN, WAF, and object storage), Stripe (payment processing), Resend (email delivery), Twilio (SMS and WhatsApp messaging), Trigger.dev (background jobs), Sentry (error tracking), PostHog (product analytics), Upstash (rate limiting and caching), Google Gemini, OpenAI, and Anthropic (AI Workforce and AI features), Google Calendar API and Microsoft Graph API (calendar synchronisation, opt-in only), and Channex (OTA channel connectivity for accommodation venues).
5.2. We will notify you at least 30 days before adding or replacing a Sub-Processor. You may object to the change within that period. If you object and we cannot accommodate your concern, you may terminate your Subscription.
5.3. All Sub-Processors are bound by data processing agreements that impose equivalent data protection obligations.
5.4. AI Data Processing & Multi-Model Sub-Processing. The Platform routes automated tasks across enterprise AI foundation models (including Google Gemini, OpenAI, and Anthropic). All AI sub-processors process Client Data in transit only under Enterprise Data Processing Terms that explicitly prohibit the use of Client Data for AI model training. Client Data is not retained by AI sub-processors after request execution. Clients may disable AI features per account via module settings.
6. Data Breach Notification
6.1. We will notify you of a Data Breach without undue delay and in any event within 72 hours of becoming aware of it.
6.2. The notification will include:
- A description of the nature of the breach
- The categories and approximate number of data subjects affected
- The categories and approximate number of records affected
- The likely consequences of the breach
- The measures taken or proposed to address the breach
6.3. We will cooperate with you in investigating and remediating the breach, and in fulfilling your obligations to notify supervisory authorities and affected data subjects.
7. Data Subject Rights
7.1. We will assist you in responding to requests from data subjects exercising their rights under UK GDPR (access, rectification, erasure, restriction, portability, objection).
7.2. If we receive a request directly from a data subject regarding Client Data, we will redirect them to you unless legally required to respond directly.
7.3. The Platform provides tools to help you fulfil data subject requests:
- Data Export (for access and portability requests)
- Content editing (for rectification requests)
- Record deletion (for erasure requests)
- Contact anonymisation (for erasure where full deletion is not possible)
8. Data Retention and Deletion
8.1. We will process and retain Personal Data for the duration of your Subscription.
8.2. Upon termination of your Subscription, Personal Data will be handled in accordance with the cancellation and offboarding provisions in the Terms of Service (30-day grace period, 60-day archive, permanent deletion at 90 days).
8.3. You may request immediate deletion of specific records at any time through the Platform or by contacting us.
8.4. Upon request, we will provide written confirmation that Personal Data has been deleted.
8.5. On termination, and at the Controller’s choice, the Processor will return or delete all Personal Data, save where retention is required by law.
9. International Transfers
9.1. Personal Data may be transferred to and processed in the United States and European Union by our Sub-Processors.
9.2. Where personal data is transferred outside the UK, we rely on UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as appropriate. Transfer mechanisms for each Sub-Processor are detailed at mdos.ai/sub-processors.
9.3. Details of the specific transfer mechanisms in place are available upon request.
10. Audits and Compliance
10.1. We will make available to you all information necessary to demonstrate compliance with our obligations under this DPA.
10.2. We will allow and contribute to audits and inspections conducted by you or an independent auditor mandated by you, subject to reasonable notice and scope limitations.
10.3. Audits shall be conducted during normal business hours, no more than once per year (unless a Data Breach has occurred), and subject to confidentiality obligations.
11. Data Protection Impact Assessments
11.1. We will provide reasonable assistance to you in conducting Data Protection Impact Assessments (DPIAs) where required, particularly in relation to the types of processing carried out through the Platform.
12. Term and Termination
12.1. This DPA remains in effect for as long as we process Personal Data on your behalf.
12.2. This DPA automatically terminates when all Personal Data has been deleted or returned to you following account cancellation.
12.3. Provisions relating to confidentiality, liability, and data deletion obligations survive termination.
13. Liability
13.1. Each party's liability under this DPA is subject to the limitation of liability provisions in the mDOS Terms of Service.
14. Governing Law
14.1. This DPA is governed by the laws of England and Wales and subject to the exclusive jurisdiction of the courts of England and Wales.
15. Contact
Data Protection Contact:
MDOS AI LTD
Company No. 17526969
Brighton
United Kingdom
Email: privacy@mr-digital.co.uk