Data Processing Agreement

• Controller — the customer, who determines purposes and means of processing.
• Processor — LeadersMind GmbH, who processes personal data on behalf of the controller.
• Subprocessor — a third party engaged by the processor to support processing.

This DPA applies where LeadersMind processes personal data on behalf of a customer in providing the platform. It is governed by Art. 28 GDPR.

Processing is performed only to provide the service per the Terms, for the duration of the customer relationship, and in line with the customer's documented instructions.

We engage subprocessors under written agreements providing equivalent protections (Art. 28(4) GDPR). We notify customers of material changes to subprocessors and allow objection on reasonable grounds.

• Cloud hosting & infrastructure — EU-hosted provider(s).
• AI model inference — EU-hosted provider (currently Mistral AI, France). No AI processing of customer business data is performed outside the EEA.
• Email & notifications — EU-hosted where applicable.

We implement the technical and organizational measures in Art. 32 GDPR — encryption, access control, logging, backups, and regular review. See our Security page.

Customer business data and AI inference are processed exclusively within the EEA. Any other transfer outside the EEA is made with adequacy decisions or Standard Contractual Clauses and supplementary measures where required (Chapter V GDPR).

On termination, we delete or return personal data at the customer's choice, subject to legal retention obligations. Deletion is confirmed on request.

We support customer audits and provide reasonable information, including current audit reports and certifications where available. We contribute to the customer's controller obligations under Art. 28(3)(h) GDPR.

Our personnel are bound by confidentiality obligations applicable to the personal data processed.

We notify the customer of a personal data breach without undue delay and assist with any required notifications to supervisory authorities and data subjects (Art. 33–34 GDPR).

Liability is allocated in line with the Terms and applicable law, including Art. 82 GDPR.

• Appendix 1 — Categories of data and data subjects [to be specified per customer].
• Appendix 2 — Technical and organizational measures [cross-reference Security page].