Mevrik Data Processing Addendum

Version 1.0 · Effective 26 October 2026

This Data Processing Addendum ("DPA") forms part of the Mevrik Terms of Service (the "Agreement") between MEVRIK LTD, company number 13435597, 14 Saville Road, Romford, Essex, RM6 6DT, United Kingdom ("Mevrik") and the Customer. It applies where Mevrik processes personal data on the Customer's behalf. It is incorporated automatically; a countersigned copy is available from legal@mevrik.com.

1. Definitions

"Data Protection Law" means the UK GDPR, Data Protection Act 2018 and PECR and, where applicable, the EU GDPR and US state privacy laws. "Customer Personal Data" means personal data processed by Mevrik on the Customer's behalf. "Sub-processor" means a third party Mevrik engages to process Customer Personal Data. Other terms have the meanings in Data Protection Law.

2. Roles

The Customer is the controller (or a processor for its own controller) and Mevrik the processor of Customer Personal Data. Mevrik is an independent controller of the Customer's users' account, billing, security and usage data (Privacy Policy Part B), which is outside this DPA. Annex 1 describes the processing.

3. Mevrik's obligations

Mevrik will: (a) process Customer Personal Data only on the Customer's documented instructions — the Agreement, this DPA and the Customer's configuration of the Service — unless required by law, in which case Mevrik will inform the Customer unless prohibited; (b) inform the Customer if an instruction appears to infringe Data Protection Law; (c) bind authorised personnel to confidentiality; (d) implement the measures in Annex 2; (e) engage Sub-processors only under clause 5; (f) assist with data subject requests (clause 6), security, breach notification, impact assessments and consultations, taking into account the information available to it; (g) delete or return Customer Personal Data at the end of the Agreement (clause 8); (h) make available information to demonstrate compliance and allow audits (clause 7); (i) not sell Customer Personal Data and not use it to train or improve general-purpose AI models, and contractually prohibit its AI Sub-processors from doing so.

4. Customer's obligations

The Customer warrants it has a lawful basis for the processing, has given data subjects required notices, has obtained consents where required (including under PECR, TCPA and channel rules for outbound messaging), and will not direct special category or criminal-offence data to the Service except as Annex 1 permits.

5. Sub-processors

5.1 The Customer authorises the Sub-processors in Annex 3 (current list: mevrik.com/legal/subprocessors).

5.2 Mevrik gives at least 30 days' notice of a new Sub-processor by updating that list and emailing the account owner. The Customer may object on reasonable data-protection grounds within that period; if unresolved, the Customer may terminate the affected Service with a pro-rata refund of prepaid fees.

5.3 Mevrik imposes obligations on Sub-processors no less protective than this DPA and remains liable for their performance.

6. Data subject requests

Mevrik will forward to the Customer within 5 business days any data subject request relating to Customer Personal Data and will not respond except to refer the data subject to the Customer. The Service provides tools to access, export (DSAR package) and delete a contact's data; Mevrik provides reasonable further assistance at the Customer's cost.

7. Audit

Mevrik will provide on request its current security documentation and any third-party audit or penetration-test summaries. Where these are insufficient, the Customer or an independent auditor bound by confidentiality may audit relevant controls once in any 12-month period on 30 days' notice, during business hours, without unreasonable disruption, at the Customer's cost — and additionally where required by a supervisory authority or following a personal data breach.

8. Deletion and return

On termination the Customer may export Customer Personal Data through the Service for 30 days. Mevrik then deletes it from active systems within 30 days and from backups within 90 days, except where law requires retention, and confirms deletion on request.

9. Personal data breach

Mevrik will notify the Customer without undue delay and within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available (nature, categories and approximate numbers of data subjects and records, likely consequences, measures taken), updating as more becomes known. Mevrik will not notify authorities or data subjects on the Customer's behalf unless instructed.

10. International transfers

Customer Personal Data is stored in the EU (AWS Ireland, eu-west-1). Where Mevrik or a Sub-processor transfers it outside the UK, the transfer is made to a country with UK adequacy regulations or under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which the parties incorporate by reference with Mevrik as data importer where applicable.

11. Liability and precedence

Liability under this DPA is subject to the limitations in the Agreement, except that nothing limits liability to data subjects under Data Protection Law. This DPA prevails over conflicting terms of the Agreement for personal data and remains in force while Mevrik processes Customer Personal Data.

Annex 1 — Processing

Annex 2 — Technical and organisational measures

• Tenant isolation: row-level security and workspace-scoped authorisation; isolation tests in CI.
• Access control: roles (owner, admin, agent, viewer), least privilege, 2FA, session revocation on role change, fail-closed route guards.
• Encryption: TLS 1.2+ in transit; AES-256 at rest for databases, object storage and backups; managed secret store with rotation.
• PII protection: masking of card numbers, national identifiers, addresses and similar before transmission to AI providers; providers contractually barred from training on Customer data.
• AI safeguards: actions reported only on confirmed tool success; confidence-based escalation to humans; configurable human approval for sensitive actions; prompt-injection and refusal evaluations in the release pipeline; per-tenant kill switch.
• Logging and monitoring: audit log of console actions; application and security monitoring with alerting; security logs retained 12 months.
• Vulnerability management: dependency and secret scanning in CI; high/critical patching SLAs; periodic penetration testing.
• Resilience: daily encrypted backups with tested restore; documented rollback; status page.
• Incident response: documented procedure, on-call rota, breach notification per clause 9.

Annex 3 — Sub-processors (as at 26 October 2026)

Contact:legal@mevrik.com · Mevrik Ltd, 14 Saville Road, Romford, Essex, RM6 6DT, United Kingdom