Effective date: May 25, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Mint Candi, Inc. ("Processor", "we") and the customer ("Controller", "you") and applies to the processing of personal data we carry out on your behalf when providing the MintCheck service.
Where the GDPR or equivalent laws apply, this DPA reflects the parties' obligations as controller and processor.
You are the controller of personal data contained in Customer Data; we are the processor. We process such personal data only on your documented instructions — including the Terms, this DPA, and your use of the Service — unless required by law.
We will: process personal data only on your instructions; ensure that persons authorized to process it are bound by confidentiality; implement appropriate technical and organizational security measures (Annex C); assist you, taking into account the nature of processing, with data subject requests and with your security, breach-notification, and impact-assessment obligations; notify you without undue delay after becoming aware of a personal data breach; and, at your choice, delete or return personal data at the end of the Service unless retention is required by law.
You authorize us to engage the sub-processors listed in Annex B. We impose data protection obligations on sub-processors that are no less protective than this DPA and remain responsible for their performance. We will inform you of intended changes to sub-processors and give you the opportunity to object on reasonable data-protection grounds.
Where we transfer personal data internationally, including to the United States, we will use a valid transfer mechanism such as the Standard Contractual Clauses.
We process Customer Data only to provide the Service to you, including AI-assisted safety and anomaly analysis and alerts. We do not use identifiable Customer Data to train our own AI models.
We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits, subject to reasonable confidentiality and security conditions.
Provision of the MintCheck facility & asset inspection service for the duration of the Terms.
Hosting, processing, and analysis of Customer Data to provide the Service, including inspections, tasks, reporting, notifications, and AI-assisted safety and anomaly detection.
Names, contact details, account credentials, worker information, asset records and images, location data associated with inspections, usage logs, and push tokens.
The Controller's administrators, workers, and contacts.
Google Cloud Platform — cloud hosting and storage (United States and other regions).
Cloudflare — content delivery, DNS, and security (global).
Firebase Cloud Messaging (Google) — push notifications.
Twilio SendGrid — transactional email delivery, such as invitations, verification codes, and notifications (United States).
Encryption of personal data in transit and at rest.
Access controls and role-based permissions following least-privilege principles.
Network security, logging, and monitoring.
Regular backups and recovery procedures.
Personnel confidentiality commitments and security training.