Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the organisation that holds a MirageCHAT workspace (the “Workspace”, acting as controller) and Mirage Global Technologies LLC, a Wyoming limited liability company (“MGT”, “we”, acting as processor). It applies whenever the EU General Data Protection Regulation (“GDPR”), the UK GDPR, the Swiss Federal Act on Data Protection or a comparable law governs personal data that MGT processes on the Workspace’s behalf through MirageCHAT (“Customer Personal Data”).

The Workspace accepts this DPA by accepting the Terms of Service; no separate signature is needed. A Workspace that wants a countersigned copy for its records can request one at privacy@miragechat.io.

1. Roles and scope

• For the conversations, contacts, comments, media, notes and other data the Workspace handles in MirageCHAT, the Workspace is the controller (or, where it acts for its own client, a processor) and MGT is its processor.
• For the account, billing, security and product-usage data MGT needs to run the service, MGT is an independent controller, as described in the Privacy Policy. This DPA does not cover that data.
• Terms used here and not defined — personal data, processing, data subject, personal data breach, supervisory authority — have the meaning given in the GDPR.

2. Details of the processing

The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex I.

3. Instructions

• MGT processes Customer Personal Data only on the Workspace’s documented instructions. The Terms, this DPA and the way the Workspace configures and uses the service — the channels it connects, the automations and AI features it turns on, the exports and deletions it requests — are those instructions.
• MGT informs the Workspace without delay if, in its opinion, an instruction infringes data-protection law, and may suspend that instruction until it is confirmed or changed.
• MGT does not sell Customer Personal Data, does not use it for advertising or to build profiles, and does not use it to train general-purpose AI models.
• Where the law of the European Union, a Member State or the United Kingdom requires MGT to process Customer Personal Data otherwise, MGT informs the Workspace before processing unless that law prohibits it.

4. Confidentiality

MGT ensures that every person authorised to process Customer Personal Data is bound by confidentiality, and that access is limited to what support, security and operation of the service require. When MGT opens a Workspace to give support, this is recorded in the Workspace’s own tamper-evident audit log, which its owner can read.

5. Security

MGT implements the technical and organisational measures described in Annex II, appropriate to the risk under Article 32 GDPR. MGT may update those measures provided the overall level of protection is not reduced.

6. Sub-processors

• The Workspace gives MGT general authorisation to engage the sub-processors listed in Privacy Policy §4 (Annex III).
• MGT informs the Workspace by e-mail to its owner at least 14 days before adding or replacing a sub-processor. The Workspace may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, MGT may switch off the affected feature for that Workspace, or the Workspace may terminate the affected service without penalty.
• MGT engages each sub-processor under written terms that impose data-protection obligations no less protective than this DPA, and remains responsible to the Workspace for its sub-processors’ performance.
• Platforms the Workspace connects. When the Workspace connects its own WhatsApp, Messenger, Instagram, TikTok or Telegram account, messages travel through that platform because the Workspace chose it; the platform processes them under its own terms with the Workspace.
• The Workspace’s own AI keys. Where the Workspace supplies its own API key for an AI provider, that provider processes the data under the Workspace’s own agreement with it; MGT only transmits the request the Workspace configured.

7. Assistance with data subjects’ rights

Taking into account the nature of the processing, MGT assists the Workspace, by appropriate technical and organisational measures, in answering requests from data subjects. The service lets the Workspace find, export and erase a contact’s data itself. If MGT receives a request directly, it forwards it to the Workspace and does not answer it except on the Workspace’s instruction.

8. Personal data breaches

• MGT notifies the Workspace of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it and, where feasible, within 24 hours.
• The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information not yet available follows in phases without undue delay (Article 33(3)–(4) GDPR).
• MGT takes reasonable steps to contain and remedy the breach, and does not notify supervisory authorities or data subjects about Customer Personal Data on the Workspace’s behalf unless the Workspace instructs it or the law requires it.

9. Other assistance

MGT provides the Workspace with the information reasonably needed for its data protection impact assessments and prior consultations (Articles 35–36 GDPR), taking into account the nature of the processing and the information available to MGT.

10. Deletion and return

• During the subscription the Workspace can export its data and delete conversations, contacts and channels.
• When the Workspace’s account ends, MGT deletes Customer Personal Data from the live systems within 30 days, unless the Workspace asks for an export first. Invoices and payment records are kept only as long as the law requires and hold no message content.
• Encrypted backups rotate out on their own schedule — daily copies after 30 days, monthly copies after 12 months. Backups are never used except to recover from a failure; if one is restored, deleted data is removed again.

11. Audits

• MGT makes available the information reasonably necessary to demonstrate compliance with Article 28 GDPR: this DPA and its annexes, written answers to reasonable questions, and — under confidentiality — MGT’s security policies.
• Where that is not sufficient, or a supervisory authority requires it, the Workspace may carry out an audit, itself or through an independent auditor bound by confidentiality, no more than once in any 12 months unless a personal data breach justifies it, on at least 30 days’ written notice, during business hours, at the Workspace’s cost and without access to other customers’ data.

12. International transfers

• Customer Personal Data is hosted in the European Union. MGT is established outside the European Economic Area and its administration takes place outside it; transfers therefore take place under appropriate safeguards.
• For transfers from the EEA, the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference: Module 2 (controller to processor) where the Workspace is a controller, and Module 3 (processor to processor) where it is a processor. The Workspace is the data exporter and MGT the data importer. Clause 7 (docking) applies; under Clause 9(a) Option 2 (general authorisation, 14 days’ notice) applies; the optional wording of Clause 11 does not apply; under Clauses 17 and 18 the law and courts of Ireland apply; the competent supervisory authority under Clause 13 is the one competent for the Workspace. Annexes I to III of this DPA complete the Annexes of the Clauses.
• For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0) is incorporated, with the information in Tables 1 to 3 taken from this DPA; for transfers from Switzerland, the Clauses apply with the adaptations required by the Swiss Federal Act on Data Protection.
• If these Clauses and this DPA conflict, the Clauses prevail.

13. United States privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, MGT acts as the Workspace’s service provider (or processor): it does not sell or share Customer Personal Data, does not retain, use or disclose it for any purpose other than providing the service, does not combine it with personal data from other sources except as that law permits, and complies with the obligations that law places on service providers.

14. Liability, precedence and changes

• Each party’s liability under this DPA is subject to the limitations in the Terms, except where the law does not allow such a limitation.
• If this DPA conflicts with the Terms on the protection of personal data, this DPA prevails.
• MGT may update this DPA to reflect changes in law or in the service, without reducing the protection it gives, and notifies Workspaces of material changes at least 14 days before they take effect.

15. Contact

Privacy Officer, Mirage Global Technologies LLC — privacy@miragechat.io. Security vulnerabilities: security@miragechat.io.

Annex I — Details of the processing

Annex II — Technical and organisational measures

• Encryption in transit: TLS 1.2 or higher on every public web and mail endpoint.
• Encryption at rest: the access tokens and keys of connected accounts are encrypted with AES-256-GCM, with the key kept outside the database; database backups are encrypted (AES-256) to a key held off the server.
• Isolation: every query, file and real-time event is scoped to a single Workspace; this is verified by automated checks before every release.
• Access control: individual accounts with roles; agents reach only the channels assigned to them; a second sign-in factor by e-mail for every user; temporary lock after repeated failed sign-ins; administrator access to MGT systems by SSH key only, with multi-factor authentication on provider accounts.
• Logging: a tamper-evident audit log of administrative and security events.
• Resilience: nightly backups, restored and verified before they are kept, and copied to a separate server in the European Union.
• Operations: host firewall with default deny, automatic security updates, database not reachable from the internet, changes to production only through a controlled and verified release process.
• Vulnerabilities and incidents: a published security contact (security@miragechat.io, also listed at miragechat.io/.well-known/security.txt), dependency and configuration scans, and a written incident response plan.

Annex III — Sub-processors

The current list of sub-processors, with their purpose and region, is kept in Privacy Policy §4, which forms part of this Annex. Changes are notified as described in §6.