Data Processing Addendum
Last updated: [DATE — to be confirmed at legal review]
1. Parties and roles
This Addendum is between [LEGAL ENTITY NAME — placeholder] ("Processor") and the customer organisation ("Controller"). It governs processing of personal data through the MeetIQ platform.
2. Subject matter and duration
Processing of meeting content, transcripts, recordings, board materials and account data for the duration of the subscription, plus the 30-day deletion grace period.
3. Nature and purpose of processing
Hosting, transcription, AI-assisted summarisation, storage, retrieval, export and deletion of organisation data, as instructed by the Controller through the platform's controls.
4. Data subject rights
The platform provides self-service export and deletion for end users and organisation-level export and deletion for owners, assisting the Controller in meeting data subject requests.
5. Security measures
Encryption in transit and at rest, per-organisation tenant isolation, role-based permissions, two-step verification, tamper-evident audit logging, and configurable retention. [FULL TOMs ANNEX — placeholder.]
6. Sub-processors
[SUB-PROCESSOR LIST — placeholder for legal review.]
7. International transfers
[TRANSFER MECHANISM / SCCs — placeholder for legal review.]
8. Deletion
On termination or at the Controller's request, all organisation data is deleted after the 30-day grace period and a certificate of deletion is provided.