Annex A to the data processing agreement between Mynder AS and the end customer: purposes, nature of the processing, categories of personal data, categories of data subjects and duration.
Annex A — Information about the processing
Annex A to the Data Processing Agreement — Mynder AS and the end customer
Overview of processing activities
No.
Processing activity
Scope
BA-1
User administration, identity and access management
Standard
BA-2
Compliance documentation in Core: workspaces, systems, processes, records of processing (RoPA), tasks and projects
BA-3
Assets and technical integrations: device and security posture data
Optional per integration
BA-4
Incidents and events
When the module is activated
BA-5
Supplier management, requests and Trust Center/Trust Profile
BA-6
AI functionality (Lara) and the controller's own agents via MCP
Standard; agent connection is optional
BA-7
Operations, customer support, security monitoring, logging and traceability
BA-8
Transactional communication and notifications
BA-9
The partner's access to the controller's workspace
Only where the controller has engaged a partner, cf. Annex D
A.1 Purpose of the processing
Mynder AS processes personal data in order to deliver, operate, secure and further develop the Mynder platform (the "Service") for the controller. The Service supports work on compliance, risk management, information security, privacy and supplier management.
Mynder AS does not process the personal data for its own independent purposes. Further development of the Service includes, among other things, bug fixing, security, stability, performance and improvement of functionality. Personal data is not used for cross-customer analysis or training of general models, unless the data is anonymised so that it is no longer personal data.
Purpose per processing activity:
Purpose of the processing
To create, authenticate and administer users, assign roles and access rights, enforce access control, and document which terms and agreements each user has accepted, including version and time.
To enable the controller to map and document workspaces, systems, processes, processing activities (records of processing/RoPA), tasks, projects such as DPIA, risk assessments, TIA and audits, measures, control points, maturity and evidence.
To establish and maintain a register of the controller's assets and systems, including configuration and security posture data from sources connected by the controller, or by a partner on the controller's behalf, as a basis for control, documentation and evidence.
To register, assess, follow up and close incidents and events at the controller, including personal data breaches.
To support the controller's supplier management, including supplier assessments, collection and follow-up of documentation, requests and correspondence, and to display, publish or share the Trust Profile as chosen by the controller.
To provide AI-supported analysis, suggestions, drafts and guidance based on content the controller has entered into the Service, and to give the controller's own agents limited access to the Service within a documented mandate.
To operate, maintain and secure the Service, provide technical support, troubleshoot, monitor performance and stability, detect and handle security incidents, unauthorised use and misuse, take backups, restore data, and ensure traceability for actions performed by users, partners and agents.
To send transactional messages necessary to deliver the Service, such as user invitations, deadline notifications, status updates, requests and receipts.
To give a partner engaged by the controller limited access to the controller's workspace within a documented mandate, and to log the partner's activity so that it is visible to the controller.
A.2 Nature of the processing
The processing comprises the activities necessary to deliver the Service, including collection, registration, organisation, storage, display, use, compilation, sharing as chosen by the controller, logging, securing, backup, restore, troubleshooting, support, maintenance, restriction, deletion and return of personal data.
The processing takes place in a cloud-based software service (SaaS) where the controller and its users decide what content is entered. The Service is primarily designed for configuration, status and documentation data, and is not built for systematic import of the controller's underlying personal data registers or operational raw data, unless this follows from an activated integration or feature.
The Service is not used for automated individual decisions with legal effect under GDPR Article 22 or for profiling of individuals. The AI functionality provides suggestions and drafts that the controller assesses and approves. Content processed in the AI functionality is not used to train general language models, cf. Annex B.
When the Service is displayed in another language, as a rule only the Service's own interface texts are translated. Customer content is not sent to a translation service unless such functionality is activated. If customer content is to be translated, the relevant provider must be listed in Annex B with the necessary information about processing location and transfer basis.
Nature of the processing per processing activity:
Nature of the processing
Collection, registration, storage, modification and deletion of user and access data, authentication, and logging of logins, access changes and acceptance of terms.
Storage, structuring, display, compilation, modification, export and deletion of content entered by the controller or its users, including free text, attachments and documents.
Retrieval from connected sources, storage, compilation and display of configuration and security posture data, including aggregation before display where this is set for the relevant data level.
Registration, storage, updating, assignment, notification, reporting and deletion of information about incidents and events.
Registration and storage of supplier and contact details, sending and receiving requests, receipt, analysis and storage of documentation, gap assessment, and making the Trust Profile available via link or publication as chosen by the controller.
Transfer of selected content and the user's instruction to the AI service stated in Annex B, generation of suggestions and drafts, storage of the result in the Service, and logging of agent actions with actor, mandate and context.
Logging, security monitoring, troubleshooting, support, configuration changes, backup, restore, testing, and deletion or anonymisation of logs.
Sending, temporary storage and logging of email and notifications via the service stated in Annex B.
Access management, display, storage and logging of the partner's actions in the controller's workspace.
A.3 Categories of personal data
The processing may include the following categories of personal data, depending on which features and integrations the controller uses:
Categories of personal data
Name, email address, phone number where registered, in practice for designated security and emergency contacts, company name and affiliation, user identifier, authentication data (password stored in hashed form, status and method of multi-factor authentication), role and access rights in the Service, key role at the controller, language and notification preferences, time of creation, invitation, last login and access changes, and an acceptance log for terms with document name, version and date.
Name, email address, phone number, role, position or function, including system owner, workspace owner, data protection officer, security manager, compliance manager, AI governance manager and CEO; name, email address and role for owners, participants, approvers and invited external participants in tasks and projects; deadlines and status related to the individual; free text in descriptions, assessments, justifications and comments; content in documents, evidence and attachments that are uploaded.
Device name, device type, operating system and version, the device's assigned user or owner, security posture such as encryption, EDR status, patch level, backup status and time of last backup, and an aggregated software overview at company level where the controller has chosen this option.
Description of the event in free text, time, affected systems, assets and suppliers, name and contact details of the reporter, owner and participants in the follow-up, information about affected individuals to the extent the controller registers this, and measures, assessments, deadlines and status.
Name, email address, phone number, position and role of contacts at the controller's suppliers and other third parties; content of documentation the supplier uploads or shares; correspondence and answers in requests; contact points and owners the controller chooses to display in a published or shared Trust Profile.
The personal data contained in the content and instructions the user or agent sends to the AI functionality, and in the generated result, as well as user or agent identifier, organisation, mandate, time and log of agent actions.
User identifier, IP address, time, browser and device information, action performed, actor organisation, active context, affected resource, mandate and before/after values for changes; the content of support requests, including attachments and screenshots the user submits; the same data in backups.
Name, email address, subject and content of transactional messages, time of sending, delivery status and any error messages.
The partner user's name, email address, role, organisational affiliation, assigned mandate with scope and duration, and an activity log for actions performed in the controller's workspace.
The Service is not designed for processing national identity numbers, payment card data, health data or location tracking of individuals, and such data must not be entered into the Service. The Service must also not display software use, incidents or risk findings linked to a named employee, and no drill-down from aggregated views to employee or device level that in practice makes individual employees identifiable shall be established.
The Service is not designed for systematic processing of special categories of personal data under GDPR Article 9 or data on criminal convictions and offences under GDPR Article 10. The controller must not enter such data in structured fields, free-text fields, documents or the AI functionality beyond what is necessary to document the controller's own compliance.
As part of documenting incidents, events, risk assessments and records of processing, the controller may nevertheless need to state that such data forms part of the controller's own processing, or describe an event that affects such data. Such descriptions must be limited to what is necessary for the purpose and must as far as possible be written at category level, using roles or pseudonyms instead of identifying information about individuals. Stating that a category of data forms part of the controller's processing is not the same as entering such data about an identified individual, and it is the latter that is covered by the restriction in the first paragraph.
Processing of data under GDPR Article 9 or 10 on a larger scale, or as a permanent part of the controller's use of the Service, requires a separate written agreement, including clarification of the legal basis, risk assessment and necessary additional measures.
The controller must not enter data under GDPR Article 9 or 10 into the AI functionality. This restriction applies until Mynder AS has documented that content flagged in the AI provider's abuse monitoring is not made available for human review, cf. Annex B.
Because the Service contains free-text fields, document uploads and other features where the controller decides the content, Mynder AS cannot technically prevent such data from being entered. If the controller nevertheless enters such data, the processing takes place on the controller's instruction and responsibility, within the framework of the Agreement and applicable law. Mynder AS shall display help text or a warning when registering incidents, uploading documents and in the AI functionality, reminding the controller's users of the restrictions in this section.
A.4 The processing covers the following categories of data subjects
The controller's employees, contractors and other users granted access to the Service (BA-1, BA-2, BA-7)
Key persons and contact points at the controller, including the CEO, data protection officer, security manager, compliance manager, AI governance manager, system owners and workspace owners (BA-2)
Employees and other individuals assigned to devices registered in the asset register, or who can be linked to device and security posture data (BA-3)
Individuals who report, follow up or are affected by incidents and events the controller registers in the Service (BA-4)
Contacts and representatives at the controller's suppliers and other third parties who receive or answer requests (BA-5)
External participants the controller invites to tasks and projects, for example auditors, advisors and other partners (BA-2)
Recipients of transactional communication from the Service (BA-8)
Individuals mentioned or identifiable in assessments, documentation, comments, measures, free text, attachments or logs entered into the Service by the controller (BA-2, BA-4, BA-5, BA-6)
Where a partner is engaged by the controller: the partner's employees and representatives granted access to the controller's workspace in the Service (BA-9)
A.5 Duration of the processing
The processor's processing of personal data on behalf of the controller may begin after the Terms have entered into force.
The processing lasts as long as the processing services are delivered to the controller, and thereafter for the period necessary for deletion, return, documentation of deletion or fulfilment of statutory obligations, cf. section 11 and Annex C.4. The controller may at any time instruct earlier deletion of content the controller has entered.
Duration per processing activity:
Duration
As long as the user account is active in the controller's workspace. User and access data is deleted or anonymised when the account is removed, and at the latest on termination under section 11. The acceptance log for terms is retained as long as necessary to document the contractual relationship.
As long as the controller chooses to keep the content in the Service, and in any event no longer than the agreement period plus the period for deletion or return under section 11 and Annex C.4.
As long as the integration is active and the asset is registered. When the integration is disconnected, collected device and security posture data is deleted or anonymised within 30 days, unless the controller instructs continued retention as evidence.
As long as the controller chooses to keep the incident, and thereafter as BA-2. The controller determines the retention period for incident history intended to document compliance.
As long as the supplier is registered and the documentation is relevant to the controller's supplier management, and thereafter as BA-2. A shared or published Trust Profile is available until the controller unpublishes or deactivates the sharing link.
Requests to the AI service are processed per call and are not stored in the Service beyond the generated result. The AI provider may retain requests and responses for up to 30 days for abuse monitoring, in the same region as the AI resource, cf. Annex B. Generated results are stored in the Service on the same terms as BA-2. Logs of agent actions are retained as BA-7.
Access and activity logs are retained for 12 months, security logs for 6 months, and backups for 35 days in the ordinary backup cycle, cf. Annex C.2 and C.4. Thereafter the data is deleted, overwritten or anonymised. Support requests are retained for 12 months after the case is closed.
Message content is retained for 90 days. Sending time, delivery status and any error messages are retained for 12 months for documentation and troubleshooting.
As long as the partner's mandate is active. The activity log for the partner's actions is retained as BA-7 and is available to the controller also after the mandate has ended.
Related documents