Data Processing Agreement

Cover Page — Key Terms

Agreement

This DPA supplements the m8tes Terms of Service between Provider and Customer.

Approved Subprocessors

https://www.m8tes.ai/privacy-policy#subprocessors

Provider Security Contact

privacy@m8tes.ai

Security Policy

https://www.m8tes.ai/security-policy.md

Compliance reports

SOC 2 Type II is on our roadmap. We do not claim SOC 2 certification today. Current technical and organizational measures are described in the Security Policy and Privacy Policy §8.

Standard Terms §5.2 (Reports)

Section 5.2 (Reports) of the DPA Standard Terms does not apply. Provider does not currently maintain independent third-party audit Reports for Customer review. When a Report becomes available, Provider will update this Cover Page.

Service Provider Relationship (CCPA)

To the extent the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. ("CCPA") applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.

Restricted Transfers

• EEA Transfers — Governing Member State: Ireland
• UK Transfers — Governing Law: England and Wales

Module Two (Controller → Processor) and Module Three (Processor → Sub-Processor) of the EEA SCCs apply as set out in the DPA Standard Terms. The UK Addendum is incorporated as set out there. Swiss transfers follow the Standard Terms' Swiss adaptation.

Annex I(A) — List of Parties

Annex I(B) — Description of Transfer and Processing

Service

m8tes is an autonomous-agent platform: customers configure AI Mates that run tasks, use connected tools, retain memory and documents, and produce outputs on the customer's behalf.

Categories of Data Subjects

• Customer's employees, contractors, and authorized Users of the Service
• Customer's end users or customers, when Customer submits their personal data through the Service (API/embed or Platform)

Categories of Personal Data

• Account and profile identifiers (name, email, optional phone)
• Authentication and connection metadata for integrations the Customer enables
• Task instructions, chat/run inputs and outputs, memories, documents, and uploaded files the Customer or its Users submit
• Usage, billing, and support communications related to the Service

Special Category Data

No. Customer must not submit special-category data (GDPR Art. 9) or equivalent sensitive data unless the parties agree otherwise in writing with appropriate safeguards.

Frequency of Transfer

Continuous, for as long as Customer uses the Service

Nature and Purpose of Processing

• Receiving data, including collection, accessing, retrieval, recording, and data entry
• Holding data, including storage, organization, and structuring
• Using data, including analysis, consultation, testing, and automated processing to operate autonomous agents on Customer's instructions
• Updating data, including correcting, adaptation, alteration, alignment, and combination
• Protecting data, including restricting, encrypting, and security testing
• Erasing or returning data on Customer's instruction or at termination, subject to Applicable Laws

Duration of Processing

Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed under the DPA Standard Terms, or (ii) by Applicable Laws. On termination, Provider will return or delete Customer Personal Data in accordance with the Agreement and Applicable Laws, except for copies retained solely for legal compliance or backup retention windows disclosed in the Privacy Policy.

Annex I(C) — Competent Supervisory Authority

The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II — Technical and Organizational Security Measures

See the Security Policy and Privacy Policy §8 (Data Security). Measures include TLS in transit, authenticated encryption of integration credentials at rest, isolated sandboxed agent execution with cleaned tool environments, access controls, and monitoring. Provider may update measures without reducing the overall level of protection.

How to accept

By creating a m8tes account, using the Service under the Terms of Service, or otherwise agreeing to this DPA in writing (including by countersigning a Common Paper or other order form that incorporates this Cover Page), Customer agrees to this DPA as of the Effective Date above (or the later date of Customer's acceptance). For a countersigned PDF or enterprise paper process, email privacy@m8tes.ai.