Data Processing Agreement (DPA)

Version 2026-08-14 · part of the agreement between you (“Customer”, controller) and Meritxell Media trading as Mia Automation, Chamber of Commerce 80564186 (“Processor”)

1. Subject matter and duration

The Processor processes personal data on behalf of the Customer to the extent necessary to deliver the Mia services (assistant, Mia OS, apps, connected services). This DPA applies for the duration of the subscription and ends after deletion of all data (art. 11).

2. Nature and purpose

Carrying out the instructions the Customer or its users give Mia: email and calendar management, document processing, building and running apps, and storing these in the Customer's own environment.

3. Data categories and data subjects

• Data subjects: the Customer, its employees, its customers and contacts, and users of the Customer's apps.
• Data: contact details, communication content (email, chat), calendar items, documents, customer and order data in the Customer's apps. No special categories unless the Customer processes those itself; the Customer then warrants a legal basis exists.

4. Instructions

The Processor processes only on documented instructions from the Customer (the tasks given to Mia and the environment's settings), unless required by law — in which case we inform the Customer in advance, unless legally prohibited. If the Processor considers an instruction to infringe the GDPR or other data protection rules, it immediately notifies the Customer and may suspend execution of that instruction until the Customer confirms or amends it.

5. Confidentiality

Everyone with access to personal data under the Processor's authority is bound by confidentiality.

6. Security

The Processor implements appropriate technical and organisational measures, including: isolated per-customer environments with firewall separation, encrypted off-site backups (encrypted before upload), daily automated security audits, access management with a password vault, and 24/7 monitoring with automatic recovery. See also https://mia-automation.com/security.

7. Sub-processors

The Customer grants general authorisation for the following sub-processors:

New sub-processors are announced at least 30 days in advance; the Customer may object with reasons and, if unresolved, cancel. The Processor imposes on every sub-processor, by written agreement, the same obligations as set out in this DPA. If a sub-processor fails to fulfil its obligations, the Processor remains fully liable to the Customer for that failure.

8. Transfers outside the EU

The Customer's environment and the backups are located in the Netherlands. Transfers to a country outside the EEA only take place for the sub-processors listed in clause 7 and only under a valid transfer mechanism: the EU-US Data Privacy Framework, supplemented by the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, processor-to-processor module) as a fallback. The Processor assesses whether supplementary measures are needed and applies them; traffic is always encrypted in transit. On request, the Processor provides an overview of the transfers and the safeguards applied.

9. Assistance

The Processor assists the Customer, where reasonably possible, with data subject requests (access, erasure, etc.) and with obligations regarding security, breach notifications and DPIAs. If a data subject request reaches the Processor directly, it does not handle it itself but forwards it to the Customer without delay.

10. Data breaches

The Processor informs the Customer without undue delay, at the latest within 48 hours of discovering a personal data breach, providing the information the Customer needs for any notification to the supervisory authority and data subjects.

11. End of the agreement

After termination the Customer may request a full export of data and apps for up to 30 days. The Processor then permanently deletes all personal data, including backups within the following backup cycle, unless a legal retention obligation applies. On request, the Processor confirms the deletion in writing.

12. Audit

The Customer may have an audit performed at most once a year (or after a breach) by an independent expert bound by confidentiality, after reasonable notice and without access to other customers' data. The Processor first provides existing reports (such as the daily security audits) and makes available all information needed to demonstrate compliance with Article 28 GDPR.

13. Liability and precedence

The liability arrangement in the terms of service also applies to this DPA. In case of conflict regarding data protection, this DPA prevails.

Company details