Document: Data Processing Addendum (DPA)
Product: AskMike.AI (askmike.tools)
Provider / Processor: AskMike.AI, an MCubed company
Contact: info@mcubedbi.net
Related: Subprocessors, Master Service Agreement, AI data processing
Purpose
This Data Processing Addendum (“DPA”) forms part of the Master Service Agreement (or other services agreement) between AskMike.AI, an MCubed company (“Provider”) and the customer entity (“Customer”) and applies where Provider processes Personal Data on behalf of Customer in connection with the Ask Mike / AskMike.AI Services.
This DPA uses controller/processor framing common to GDPR/UK GDPR and similar regimes, including CCPA/CPRA “business/service provider” where those laws apply.
1. Definitions
Capitalized terms not defined here have the meaning in the MSA.
“Applicable Data Protection Law” means laws applicable to the processing of Personal Data under this DPA, including where applicable the EU GDPR, UK GDPR, Swiss FADP, and U.S. state privacy laws (e.g., CCPA/CPRA), as amended.
“Personal Data” means Customer Data that relates to an identified or identifiable natural person (or “personal information” under applicable U.S. state law).
“Processing” / “Process” have the meanings under Applicable Data Protection Law.
“Security Incident” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed by Provider.
“Subprocessor” means a third party engaged by Provider to Process Personal Data on behalf of Customer in connection with the Services.
“SCCs” means the European Commission Standard Contractual Clauses (Module 2 controller-to-processor, or Module 3 processor-to-processor, as applicable), and UK/Swiss addenda as required.
2. Roles of the Parties
2.1 Customer as Controller (or Business). Customer determines the purposes and means of Processing Personal Data Customer submits to the Services. Where Customer is a “business” under CCPA/CPRA, Customer is the business and Provider is the service provider/processor as applicable.
2.2 Provider as Processor (or Service Provider). Provider Processes Personal Data only on documented instructions from Customer as set out in this DPA, the MSA, Order Forms, and Customer’s configuration/use of the Services.
2.3 Independent controller activities. Provider may Process limited account, billing, and Usage Data as an independent controller (or business) for its own legitimate purposes (operating the platform, security, billing, product analytics). Such Processing is outside this DPA’s processor scope and should be described in Provider’s privacy notice.
2.4 AI Features. Where Customer uses AI Features, Personal Data included in prompts/context may be transmitted to model Subprocessors under this DPA and the Subprocessors page. See also AI data processing (non-contractual explainer unless incorporated).
3. Customer Instructions
3.1 Provider shall Process Personal Data only:
(a) to provide, maintain, secure, and support the Services;
(b) as initiated by Authorized Users through the Services (including AI Features);
(c) to comply with law; and
(d) as otherwise documented in writing by Customer.
3.2 If Provider believes an instruction violates Applicable Data Protection Law, it will notify Customer (unless legally prohibited).
3.3 Customer is responsible for the lawfulness of instructions and for providing any notices/consents to data subjects required for Customer’s use of the Services.
4. Details of Processing (Schedule summary)
| Item | Description |
|---|---|
| Subject matter | Hosting and Processing of Customer Data in a multi-tenant B2B analytics / CRM / collections SaaS with optional AI assist |
| Duration | Subscription Term + retention/deletion period in Section 10 |
| Nature & purpose | Storage, retrieval, transmission, display, backup, support, and (where enabled) AI inference via Subprocessors |
| Types of Personal Data | As determined by Customer; may include names, contact details, account identifiers, CRM/collections notes, payment-status related business data, prompts/chat content, and similar — Customer controls what is uploaded |
| Special categories | Not intended for Processing of special-category / sensitive data unless Customer configures otherwise; Customer should not submit such data unless covered by a written addendum |
| Categories of data subjects | Customer’s personnel (Authorized Users); Customer’s own customers/debtors/contacts as Customer elects to store |
| Frequency | Continuous / as initiated by Customer |
5. Confidentiality of personnel
Provider ensures persons authorized to Process Personal Data are bound by appropriate confidentiality obligations and Process only as needed for their role.
6. Security measures (high-level)
Without claiming certifications not held, Provider implements technical and organizational measures appropriate to the risk, which may include:
- Encryption in transit (TLS) for Service access
- Encryption at rest as provided by infrastructure Subprocessors (e.g., Neon, Vercel-related storage)
- Access controls, authentication, and least-privilege administrative access
- Multi-tenant logical isolation of Customer Data
- Logging and monitoring of administrative and security-relevant events
- Secure development and change practices appropriate to stage of company
- Vendor due diligence for Subprocessors
- Incident response procedures with contact info@mcubedbi.net
Details suitable for vendor questionnaires appear in the security questionnaire pack. Measures may evolve; material degradation relative to this DPA requires notice. This Section does not assert SOC 2, ISO 27001, or similar certifications.
7. Subprocessors
7.1 Customer authorizes Provider to engage Subprocessors listed on the Subprocessors page, including current core infrastructure and AI providers: Vercel, Neon, and OpenAI.
7.2 Provider will impose data-protection obligations on Subprocessors substantially no less protective than those in this DPA, to the extent applicable to the subcontracted Processing.
7.3 Notice of changes. Provider will update the Subprocessors page and provide notice (e.g., email to Customer admin or in-product notice) before adding or replacing a Subprocessor, where practicable. Customer may object on reasonable data-protection grounds; Parties will discuss in good faith. If unresolved, Customer may terminate the affected Services as its exclusive remedy (pro-rata refund of prepaid unused fees).
7.4 Provider remains responsible for Subprocessors’ performance of delegated Processing obligations under this DPA.
8. International transfers
8.1 Personal Data may be Processed in the United States and other countries where Provider or Subprocessors operate.
8.2 Where required for transfers from the EEA/UK/Switzerland, the Parties will rely on:
(a) SCCs (and UK Addendum / Swiss adaptations);
(b) any applicable adequacy decision; and/or
(c) other lawful transfer mechanisms.
8.3 Customer authorizes Provider to enter into SCCs with Subprocessors on Customer’s behalf where needed, or to flow down transfer terms.
8.4 This DPA does not claim specific transfer frameworks (e.g., Data Privacy Framework certification).
9. Assistance with data subject rights; DPIAs; audits
9.1 Taking into account the nature of Processing, Provider will assist Customer by appropriate technical and organizational measures, insofar as possible, for Customer to respond to data subject requests. Customer remains primarily responsible for responding; Provider will not respond directly to Customer’s end users except to redirect to Customer, unless legally required.
9.2 Provider will assist with DPIAs and prior consultations reasonably required, at Customer’s expense if assistance is material.
9.3 Audits. Upon reasonable written notice (no more than once annually, absent Security Incident or regulator request), Provider will make available information reasonably necessary to demonstrate compliance (e.g., security questionnaire responses, high-level architecture summary). On-site audits only if questionnaire/docs are insufficient and under NDA, during business hours, without unreasonable disruption; Customer bears costs unless material non-compliance is found. No SOC 2 report is currently available (see Security certifications).
10. Return and deletion
10.1 Upon termination or expiry of Services, or upon Customer’s written request, Provider will:
(a) make Customer Data available for export; and then
(b) delete or destroy Personal Data in production systems, except:
• backup copies retained for a limited period under standard backup cycles, isolated from production use; and
• retention required by law or needed for dispute resolution (restricted access).
10.2 Provider will confirm deletion upon written request.
11. Security Incident / breach notice
11.1 Provider will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data (or sooner if required by law applicable to Provider as processor).
11.2 Notice will include, to the extent known: nature of the incident, categories/approximate numbers of data subjects and records, likely consequences, and measures taken or proposed. Contact for incidents: info@mcubedbi.net.
11.3 Provider will reasonably cooperate with Customer’s investigation and mitigation. Notification is not an admission of fault or liability.
12. CCPA/CPRA service provider terms
Where CCPA/CPRA applies: Provider shall not: (a) sell or share Personal Information; (b) retain, use, or disclose Personal Information outside the business purpose of providing the Services or as otherwise permitted by CPRA for service providers; (c) combine Personal Information with personal information from other sources except as permitted for service providers. Provider certifies it understands these restrictions. Customer may take reasonable steps to ensure compliance.
13. AI-specific processing notes (non-warranty)
13.1 Model Subprocessors may Process prompt/context data to generate outputs. Default vendor policies regarding training, retention, and abuse monitoring are summarized for operational awareness in AI data processing and the OpenAI MAM / ZDR checklist.
13.2 No warranty of Zero Data Retention, Modified Abuse Monitoring, or “no training” is made in this DPA.
14. Liability
Liability arising under this DPA is subject to the limitations and exclusions in the MSA, except where Applicable Data Protection Law prohibits limitation of certain liabilities.
15. Order of precedence; survival
If this DPA conflicts with the MSA on Personal Data Processing, this DPA controls. Obligations that by nature should survive (deletion, confidentiality, liability, transfer mechanisms) survive termination.
Signature block
AskMike.AI, an MCubed company — info@mcubedbi.net
Signature / Name / Title / Date: _______________________
Customer
Signature / Name / Title / Date: _______________________
End of DPA.