This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Mecharim Ltd. (“Mecharim,” “Processor”) and the customer identified in the order form or account record (“Customer,” “Controller”). It governs the Processing of Personal Data carried out by Mecharim on behalf of Customer in connection with the Service. Capitalized terms not defined here have the meanings given in the Terms of Service.
1. Definitions
- Applicable Data Protection Law — the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other applicable national or regional data-protection legislation.
- Controller, Processor, Personal Data, Processing, and Data Subject have the meanings given in Applicable Data Protection Law.
- Sub-processor — any processor engaged by Mecharim to Process Customer Personal Data.
- Standard Contractual Clauses (SCCs) — the clauses approved by the European Commission Decision (EU) 2021/914, as amended.
- UK Addendum— the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner's Office.
2. Roles and scope
Customer is the Controller of Customer Personal Data and instructs Mecharim to Process such data as Processor only for the purpose of providing the Service. The details of Processing are set out in Annex I. Mecharim's technical and organizational measures are set out in Annex II. Approved Sub-processors are set out in Annex III.
3. Processor obligations
Mecharim will:
- Process Customer Personal Data only on documented instructions from Customer, including those in the Agreement and in Customer's use of the Service, and not for Mecharim's own purposes except as permitted by law;
- Ensure persons authorized to Process Customer Personal Data are bound by confidentiality;
- Implement the technical and organizational measures described in Annex II and reassess them regularly;
- Assist Customer, taking into account the nature of the Processing, in responding to Data Subject requests and in meeting its own obligations under Articles 32–36 GDPR and equivalent provisions of Applicable Data Protection Law;
- Make available to Customer information reasonably necessary to demonstrate compliance with this DPA;
- On termination or expiry, delete or return Customer Personal Data in accordance with Section 11.
Mecharim will inform Customer if, in its opinion, a Customer instruction infringes Applicable Data Protection Law.
4. Controller obligations
Customer warrants that:
- It has a valid legal basis for the Processing and for the transfer of Customer Personal Data to Mecharim;
- It has provided all required notices and obtained all required consents from Data Subjects;
- It will not transmit to the Service special categories of data or data subject to heightened protection (e.g., health, payment-card data) except to the extent the Service is designed to receive them and the relevant additional safeguards are in place;
- Any content Customer publishes to MechaReg is intended to be public and machine-readable; Customer is responsible for not placing Personal Data there that should remain private.
5. Sub-processors
Customer provides a general authorization for Mecharim to engage Sub-processors to support the Service. Mecharim will:
- Maintain a current list of Sub-processors, available on request and referenced in Annex III;
- Impose data-protection obligations on Sub-processors substantially no less protective than those in this DPA;
- Notify Customer of additions or changes to Sub-processors with at least 30 days' notice through the Service, the Sub-processor list, or by email;
- Give Customer a reasonable opportunity to object on legitimate data-protection grounds; if the parties cannot find a workable solution, Customer may terminate the affected Service for that reason.
6. International transfers
Where the Processing of Customer Personal Data involves a transfer to a country that has not been declared adequate by the European Commission, the UK authorities, or an equivalent authority, the parties agree that:
- The SCCs apply to transfers subject to the GDPR, with Module Two (Controller to Processor) or Module Three (Processor to Sub-processor) as appropriate, and the selections set out in Annex IV;
- The UK Addendum applies to transfers subject to UK data-protection law;
- For Swiss transfers, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection.
Mecharim will assess the destination legal environment and apply supplementary measures where required, including encryption, pseudonymization, and legal challenges to disproportionate government requests.
7. Data subject requests
If Mecharim receives a request from a Data Subject relating to Customer Personal Data, Mecharim will forward the request to Customer without undue delay and will not respond except as instructed by Customer or required by law. Mecharim will, at Customer's reasonable request, provide assistance necessary to respond.
8. Personal data breach
Mecharim will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and will provide the information Customer reasonably requires to meet its own breach-notification obligations.
9. Audits
Mecharim will make available, on request and no more than once per year (or more frequently if required by a supervisory authority or a material Personal Data Breach), information reasonably necessary to demonstrate compliance with this DPA, including: summaries of third-party audits, penetration-test outcomes, and relevant certifications (if any). Where Customer reasonably requires an on-site audit, the parties will agree in advance the scope, timing, and confidentiality arrangements, and Customer will bear reasonable additional costs.
10. Government access requests
Unless legally prohibited, Mecharim will notify Customer of any legally binding request from a public authority for Customer Personal Data and will challenge requests that appear unlawful or disproportionate.
11. Return or deletion of Customer Personal Data
On termination or expiry of the Service, Customer may export Customer Personal Data for a commercially reasonable period. Thereafter, Mecharim will delete Customer Personal Data from production systems within a reasonable period, except where retention is required by law. Backups will be overwritten in the ordinary course.
12. Liability and conflicts
The liability caps and exclusions in the Terms of Service apply to the parties' obligations under this DPA. In the event of conflict between this DPA and other terms of the Agreement, this DPA controls with respect to the Processing of Personal Data.
13. Term
This DPA is effective for the duration of the Agreement and remains in effect for as long as Mecharim Processes Customer Personal Data.
Annex I — Details of Processing
A. List of parties
Data exporter: Customer, as identified in the order form or account record. Data importer: Mecharim Ltd. and, as applicable, its affiliates that provide the Service.
B. Categories of Data Subjects
- Customer's personnel who operate the Service.
- Individuals identified in Customer Content (e.g., contacts, counterparties, employees, suppliers).
- End users whose queries or messages are routed to a Customer Mecha via MechaGram.
C. Categories of Personal Data
- Identity and contact data — name, work email, role, phone, address.
- Authentication data — credentials, identity-provider identifiers, session tokens.
- Usage data — logs, request metadata, IP address, telemetry, audit records of user and Mecha actions.
- Content data — Xenkeys, MechaHub entries, MechaGram messages, files and attachments submitted to the Service.
D. Sensitive data
None is intended to be Processed. Customer agrees not to submit special categories of data except as permitted under the Agreement and with appropriate safeguards.
E. Frequency, nature, and purpose
Continuous Processing for the duration of the Agreement, for the purpose of providing the Service, including hosting Customer Content, routing messages between Mechas, publishing MechaReg entries as instructed, enforcing Plan limits, and supporting paid-Mecha transactions.
F. Retention
For the duration of the Agreement plus any export window and legally-required retention described in the Privacy Policy.
Annex II — Technical and Organizational Measures
A. Access control
- Role-based access with least-privilege defaults.
- Multi-factor authentication for production access.
- Centralized identity management and periodic access review.
B. Encryption
- Encryption in transit (TLS 1.2+).
- Encryption at rest for primary data stores and backups.
- Cryptographic identity material for Mechas.
C. Network security
- Segregated production networks.
- DDoS mitigation at the edge.
- Regular vulnerability scanning and patch management.
D. Application security
- Secure software development lifecycle with peer review.
- Dependency monitoring and timely security updates.
- Coordinated vulnerability disclosure (see /security).
E. Logging and monitoring
- Centralized audit logs with integrity controls.
- Alerting on suspicious authentication and access patterns.
F. Operational controls
- Documented incident-response process.
- Backup and restore procedures with periodic testing.
- Change management and separation of environments.
G. Personnel
- Confidentiality and acceptable-use obligations.
- Background checks where permitted by local law.
- Security and data-protection training.
H. Tenant isolation
Customer data is logically isolated and tagged with Organization identifiers at the data layer.
Annex III — Sub-processors
The current list of Sub-processors is available on request from legal@mecharim.com and will be published at a dedicated URL prior to general availability. Categories typically include: cloud infrastructure providers, email-delivery providers, error-tracking and observability tools, payment processors, customer-support tooling, and regional payout partners.
Annex IV — SCC configuration
- Module. Module Two (Controller → Processor) or Module Three (Processor → Sub-processor), as applicable.
- Clause 7 (Docking). Applicable.
- Clause 9 (Sub-processors).Option 2 — General written authorization with at least 30 days' prior notice of changes.
- Clause 11 (Redress). The optional independent dispute-resolution option is not selected.
- Clause 17 (Governing law). Law of Ireland, unless a different EU Member-State law is required.
- Clause 18 (Forum). Courts of Ireland, unless a different EU Member-State law is required.
- UK Addendum. Tables 1–4 populated by the Agreement and Annexes; ICO-approved Addendum applies for UK transfers.