DPA

This Data Processing Agreement ("DPA") forms part of the Midland Terms of Service between E2E Design AB, organisation number 559416-2843, Rehnsgatan 19, 113 57 Stockholm, Sweden ("Midland", "we") and the customer ("you"). You enter into it when you accept the Terms of Service. No signature is needed. If you want a countersigned copy, email support@midland.md.

Words defined in the EU General Data Protection Regulation ("GDPR") mean the same here.

1. Scope and roles

• This DPA applies to personal data contained in content: everything your people, agents and couriers store in your Midland workspace.
• For that data you are the controller and we are the processor. If you are yourself a processor for someone else, you are our instructing party and we are your sub-processor; you confirm that your instructions reflect your controller's.
• This DPA does not apply to account and usage data, for which we are the controller. Our Privacy Policy covers that.

2. Details of the processing

Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

3. Your instructions

We process the personal data only on your documented instructions. Your instructions are:

• the Terms of Service and this DPA;
• the settings in your workspace, such as who may read and write each item;
• what your people, agents and couriers do through the service using credentials issued to your workspace; and
• written requests you send us, such as a request to export or delete.

We do not use the personal data for any purpose of our own. We do not use it to train models, and we do not sell it.

If the law requires us to process the personal data in another way, we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you without delay and may wait for your answer before acting on it.

4. Your responsibilities

You are responsible for:

• having a lawful basis for the personal data you store, and informing the people concerned;
• deciding what personal data goes into your workspace, and keeping it to what you need;
• not storing the prohibited data listed in the Terms of Service, including special categories of personal data;
• whom you invite, which agents your people approve, and which couriers you add;
• the suppliers of the agents you connect (see section 7);
• answering requests from individuals, with our help under section 8.

5. Confidentiality and security

• Everyone we authorise to handle the personal data is bound by a duty of confidentiality.
• We apply the technical and organisational measures in Annex 2. We may change them as long as the level of protection does not fall.
• We have access to content only as needed to run, secure and support the service, or when you ask us to look at something.

6. Sub-processors

• You give us general permission to use sub-processors. The current ones are in Annex 3 and on our Sub-processors page.
• We bind each sub-processor by contract to data protection duties no weaker than those in this DPA, and we remain fully liable to you for what they do.
• Changes. We tell you by email at least 14 days before we add or replace a sub-processor. Where a supplier forces a change on shorter notice, we tell you as soon as we know.
• Objecting. You may object on reasonable data protection grounds within 10 days of our notice. We will try to resolve the objection. If we cannot, you may end the agreement and we will delete your workspace, with an export first if you want one.

7. Agents you connect are not our sub-processors

When your people approve an agent, or you add a courier, you choose that tool and its supplier. We do not engage them. Content that an agent reads from Midland is disclosed to that supplier on your instruction and is handled under your agreement with them. Putting a suitable agreement in place with that supplier is your responsibility.

Midland itself does not call any AI model. If that changes, the model provider would be our sub-processor and section 6 would apply.

8. Helping you

Taking into account what we can see and do as the host of your content, we help you:

• answer requests from individuals. You can find, correct, export and delete content yourself in the console or through your agents. Where you cannot, we help on request. If an individual writes to us directly about your content, we pass the request to you and do not answer it ourselves;
• meet your duties on security, breach notification, data protection impact assessments and consultation with a supervisory authority, by giving you the information we hold.

9. Personal data breaches

If we become aware of a personal data breach affecting your content, we tell you without undue delay and no later than 72 hours after becoming aware. We tell you what happened, what data and roughly how many people are affected as far as we know, what we have done about it, and whom to contact. We update you as we learn more. We send the notice to the email addresses of the people in your workspace.

10. Transfers outside the EU and EEA

Your content is stored in Stockholm, Sweden. Some sub-processors are US companies and may handle personal data outside the EU and EEA, as Annex 3 shows. We allow that only where the transfer is covered by an adequacy decision, including the EU–US Data Privacy Framework for certified companies, or by the European Commission's standard contractual clauses.

We do not promise that processing happens only in the EU.

11. Deletion and return

• You can delete items and files yourself at any time, and ask for an export at any time.
• When the agreement ends, you have 30 days to ask for an export. After that we delete your workspace and its content, unless the law requires us to keep something.
• Copies in backups are overwritten within a further 30 days.
• Midland keeps every version of a file until the file is deleted. Removing personal data from a file's current version does not remove it from earlier versions; deleting the file does.
• After an item or file is deleted, a record of its name, who deleted it and when remains in the workspace's logs until the workspace is deleted.

12. Showing that we comply

• On request, we give you the information you need to show that this DPA is being followed, including written answers to reasonable security questions.
• If that information is not enough, you may audit us, yourself or through an independent auditor bound by confidentiality, once a year, on 30 days' notice, during working hours, and without access to other customers' data. Each party bears its own costs, unless the audit finds a material breach by us.

13. Liability

The liability terms of the Terms of Service apply to this DPA. Nothing in this DPA or the Terms of Service limits the rights of individuals under data protection law, or either party's liability towards a supervisory authority.

14. Order of priority and changes

• If this DPA and the Terms of Service conflict on personal data, this DPA wins. If standard contractual clauses apply between us and they conflict with this DPA, the clauses win.
• We tell you by email at least 30 days before a change to this DPA takes effect, unless the law requires the change sooner.
• This DPA lasts as long as we process personal data for you.

Annex 1: Details of the processing

Annex 2: Security measures

Separation of customers

• Every table that holds customer data is tied to one workspace, and the database itself enforces that boundary with row-level security on every table. A table added without an access rule is closed by default.
• An agent's access token is bound to one workspace, and the database checks that binding on every request.
• An item you may not read, an item that does not exist and an item in another workspace all get the same answer, so nothing is revealed by the difference.

Access control inside a workspace

• Each item has its own read and write rules, enforced in the database for people and their agents alike.
• Every change passes one gate that checks permission, validates the input, checks the expected version and records who made it.
• Couriers cannot create or delete items.

Sign-in and credentials

• Sign-in is by a single-use email link that expires in about an hour. There are no passwords.
• Agent access tokens, courier connection keys and client secrets are stored only as keyed hashes. The originals are shown once and never stored.
• Agent access expires after 8 hours and renewals after 30 days. Renewal tokens are replaced on each use, and reuse of an old one revokes the whole chain.
• A person approves each agent on a screen that names the agent, the workspace and where the agent sends them back to, with a warning for agents we could not verify.
• Session cookies are not readable by scripts and are sent only over encrypted connections.

Protection against misuse

• Limits on sign-in emails, workspace creation, invitations, couriers and client registrations.
• Content written by automated writers is marked as data when served, so agents are told not to treat it as instructions.

Logging

• Every agent call and every write is logged with who made it, when, and the result. File content is never written to logs.
• Adding and removing couriers, and suspected token theft, are recorded.

Hosting

• Data is stored in Stockholm, Sweden.
• Connections to the service are encrypted in transit (TLS).
• The hosting suppliers encrypt stored data at rest and take daily backups.
• The application never connects to the database from a browser with a privileged key; that key is held only on the server.

People

• Access to production systems and data is limited to the staff of E2E Design AB who need it to run the service.

Annex 3: Sub-processors

The email and analytics suppliers named in our Privacy Policy do not receive content.