Data Processing Agreement

This DPA becomes binding when incorporated into an executed service agreement or otherwise accepted by both parties through a valid contracting process. The customer identified in that agreement is the Controller; Hospitality Mentors Inc is the Processor. If the customer acts as a processor for another controller, it must have authority to appoint MentoCore as a sub-processor and the same obligations apply to the customer as the instructing party.

“Personal data”, “processing”, “controller”, “processor”, “personal data breach” and “supervisory authority” have the meanings in the EU General Data Protection Regulation (GDPR). References include the UK GDPR where applicable. This DPA governs customer personal data; the Privacy Policy separately describes processing for which MentoCore acts as controller.

This DPA prevails over conflicting service terms concerning personal data processing. Mandatory law and any applicable executed Standard Contractual Clauses prevail over this DPA. Nothing here removes a data subject's statutory rights.

The subject matter, purposes, nature of processing, data types and data subjects are set out in Annex 1. Processing lasts for the service agreement's duration and the limited return, deletion and legally required retention periods in clause 10. The Processor shall not process customer personal data for unrelated purposes.

The Controller shall establish and document lawful bases, provide required notices, obtain consent where required, ensure the accuracy and proportionality of submitted data, respond to data subjects, and issue lawful instructions. It shall configure access appropriately, protect its credentials and determine workplace retention periods. It shall not submit special-category or criminal-offence data unless the additional legal conditions and agreed safeguards are satisfied.

The Controller is responsible for decisions made using inspection scores, risk indicators or AI suggestions. It shall arrange meaningful human review where required and shall not rely on those outputs alone for decisions with legal or similarly significant effects.

The Processor shall process customer personal data only on documented instructions from the Controller, including instructions concerning international transfers, unless applicable EU or Member State law (or applicable UK law for UK processing) requires otherwise. In that case it shall inform the Controller of that legal requirement before processing, unless the law prohibits disclosure on important public-interest grounds.

Instructions consist of this DPA, the service agreement, the Controller's authorized configuration and use of service features, and further written instructions agreed by the parties. If an instruction infringes applicable data protection law in the Processor's opinion, it shall inform the Controller immediately and pause the affected processing pending clarification, except where law requires otherwise.

The Processor shall not sell customer personal data, use it for its own advertising, or use it to train its own general-purpose AI models. Any third-party AI processing requires documented authorization through enabled features and provider terms consistent with this DPA; training restrictions and retention must be verified in those provider terms rather than assumed.

The Processor shall ensure that persons authorized to process customer personal data are bound by confidentiality obligations or an appropriate statutory obligation of confidentiality, and have access only as needed for their duties. It shall make personnel aware of the applicable data-protection obligations and maintain proportionate access-review and offboarding practices.

Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and risks to individuals, the Processor shall implement appropriate technical and organizational measures under Article 32 GDPR. The baseline measures and deployment-verification requirements appear in Annex 2.

Measures shall address confidentiality, integrity, availability and resilience; restoration of availability and access following an incident; and regular assessment of their effectiveness, with encryption or pseudonymization where appropriate. Measures may evolve, but the Processor shall not materially reduce the agreed overall protection during the term. No certification, recovery objective or audit result is promised unless separately documented and verified.

The Controller grants general written authorization for the sub-processors identified in the register confirmed at execution. The Processor shall give at least 30 days' advance written notice of an intended addition or replacement, including its identity, function and relevant processing location, so the Controller can object on reasonable data-protection grounds before the change takes effect. Notice shall be sent to the designated contact in Annex 1; updating a webpage alone is not the agreed notice.

The parties shall seek a reasonable resolution of an objection. If no resolution is available, the Controller may terminate the affected service without penalty before the new sub-processor receives its data, with return or deletion under clause 10 and any unused prepaid fees addressed by the service agreement.

Before granting access, the Processor shall impose by written contract data-protection obligations equivalent to those in this DPA, including sufficient guarantees of appropriate measures. The Processor remains fully liable to the Controller for a sub-processor's performance of those obligations under Article 28(4). The published list is on the Sub-processors page; the parties must verify actual providers, locations and contracts before execution.

Taking into account the nature of processing, the Processor shall assist the Controller through appropriate technical and organizational measures, insofar as possible, to fulfill requests under GDPR Chapter III. It shall promptly forward requests received directly and shall not respond on the Controller's behalf except on instructions or where law requires it.

Taking into account the processing and information available to it, the Processor shall assist with the Controller's obligations under Articles 32 to 36: security, breach assessment and notification, data protection impact assessments and prior consultation with supervisory authorities. It shall provide relevant information without undue delay so that the Controller can meet its statutory deadlines. In-app export and deletion tools supplement, but do not replace, this assistance.

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting customer personal data. The initial notice shall not be delayed while the investigation is completed. As an additional contractual outer limit, notification shall occur no later than 72 hours after awareness; this does not permit waiting 72 hours when earlier notification is possible.

To the extent known, the notice shall describe the nature of the breach; categories and approximate numbers of affected people and records; a contact for further information; likely consequences; and measures taken or proposed, including mitigation. Missing information shall be supplied in phases without undue further delay. The Processor shall take reasonable containment and remediation steps, preserve relevant evidence, document the incident and cooperate with the Controller.

Notices go to the security contact in Annex 1 or, until one is designated, the workspace owner's email. The Controller remains responsible for its authority and data-subject notifications, including the Article 33 deadline of 72 hours where applicable. The Processor shall not notify others on the Controller's behalf without instruction unless law requires it.

At the Controller's choice, the Processor shall return or delete all customer personal data after the services end and delete existing copies, unless applicable law requires storage. The Controller shall specify its choice and request an export before termination where possible. The Processor shall support a machine-readable return and complete deletion from active systems within 30 days of a valid termination or deletion instruction, subject to required legal retention.

Any legally retained data shall be identified to the Controller where permitted, isolated from ordinary use, protected and removed when the legal requirement ends. Residual backup copies shall remain protected, shall not be used for other purposes and shall be deleted under the backup-expiry period confirmed in Annex 2. If restored for recovery, deletion instructions must be reapplied. The published target is up to 35 days, but the provider-specific period must be verified and agreed before execution.

The Processor shall confirm completion on request. Individual account deletion does not itself authorize deleting organization-owned compliance records; the Controller must instruct their return, deletion or anonymization separately.

The Processor shall make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the Controller or its mandated auditor. The parties may use current documentation or independent reports where appropriate, but those do not eliminate the audit right.

Routine audits shall normally use reasonable advance notice, confidentiality safeguards and arrangements that protect other customers and service security. A 30-day notice period is a coordination preference, not a restriction where a breach, credible noncompliance concern, supervisory authority request or urgent legal deadline requires earlier or additional inspection. Any agreed cost arrangements must not frustrate statutory assistance or audit rights.

The Processor shall not make a restricted transfer without the Controller's documented authorization and a valid GDPR Chapter V mechanism. Where applicable, the parties shall use an adequacy decision or execute the appropriate European Commission Standard Contractual Clauses, ordinarily Module 2 for controller-to-processor or Module 3 for processor-to-processor transfers, with completed annexes. UK transfers require the applicable UK Addendum or International Data Transfer Agreement.

Annex 3 must identify the parties, roles, destinations, recipients, competent authority, selected clauses and transfer safeguards. Required transfer assessments and supplementary measures must be completed. This DPA does not incorporate incomplete clauses by reference or establish that every listed provider qualifies for an adequacy framework. The Processor shall inform the Controller if it cannot comply with an applicable transfer safeguard and suspend or end affected processing as required.

Processor privacy and security contact: support@mentocore.app. Registered address: Registered mailing address pending confirmation. The Controller's contacts are recorded in Annex 1.

Changes to a binding DPA must follow the agreed contracting process. A website update does not silently amend an executed agreement or reduce mandatory protections. Obligations concerning confidentiality, return, deletion and lawful retention continue for as long as the Processor retains customer personal data.

Customer particulars to complete at execution

Legal name, registered address, authorized signatory, workspace identifier, controller or processor capacity, privacy contact and breach-notification email.

Subject matter and purpose

Provision of the customer's enabled MentoCore inspection, workplace safety, quality, training, scheduling, traceability and notification services.

Nature and frequency

Collection, recording, organization, hosting, storage, retrieval, display, permitted sharing, analysis, export and deletion throughout use of the service; optional integrations and AI requests only when enabled or instructed.

Data subjects

Customer employees, contractors, trainees and business contacts, and any other people lawfully included in the customer's records.

Personal data types

Identity and contact details; organization, role and site assignments; inspection answers, scores, signatures and location; actions, incidents, training and certifications; uploaded evidence and documents; sensor and traceability data insofar as personal; and associated activity, notification and audit metadata.

Sensitive data and additional restrictions

Not requested by default. Record any authorized special-category or criminal-offence data, lawful conditions, access restrictions and additional safeguards before processing it.

Duration and retention instructions

Service term plus clause 10 return/deletion periods. Record any customer-specific recordkeeping duties, legal holds and agreed provider backup periods.

The application provides the controls below. Before signing, the parties must confirm deployed settings and operational evidence, not merely the presence of a feature.

• Access control: authenticated access, organization-scoped data policies, server-side permission checks and optional TOTP two-factor authentication. Confirm administrator MFA requirements, access reviews and personnel offboarding.
• Transport and storage: encrypted network transport and restricted access to uploaded media. Confirm hosting-region selection, provider encryption-at-rest arrangements, key management and authorized support access.
• Accountability: application audit events and organization-admin export tools. Confirm event coverage, retention, integrity controls and review responsibilities.
• Resilience: confirm backup configuration, actual backup expiry, recovery procedures, tested restoration and any separately agreed recovery or availability targets.
• Secure maintenance: confirm vulnerability assessment, dependency and configuration reviews, patching responsibilities and periodic testing of security measures.
• Incident handling: designated breach contact, escalation and notification procedures under clause 9. Confirm staffing, incident records and training.
• Minimization and devices: least-privilege permissions, data export and deletion workflows, account-scoped blank offline checklists and sign-out cleanup. Customer-managed devices must protect locally saved work and credentials.
• Provider governance: confirm written sub-processor terms, actual AI providers and usage/retention restrictions, confidentiality commitments and transfer safeguards.

Record verified deployment details and any additional agreed measures in the execution copy. The Security page supplies further product information, not an independent certification or substitute for this annex.

Attach the dated, verified sub-processor register at execution. For each relevant provider record its legal entity, service, processing locations, data categories, contract and any onward processors. Include the actual underlying AI providers if AI features are authorized.

For each restricted transfer complete the exporter and importer details; transfer purpose, frequency, data subjects and data types; applicable adequacy basis or signed transfer instrument and module; competent supervisory authority; retention period; technical and organizational measures; and the transfer assessment and supplementary safeguards. Confirm the UK instrument separately where applicable.

No restricted transfer is authorized merely because a provider appears on the website. The completed execution copy and applicable instruments are available to the Controller on request at support@mentocore.app, subject to appropriate redaction.