This Data Processing Addendum (“DPA”) forms a part of the master agreement between Mesmer Labs, Inc. (“Mesmer”) and the customer entity (“Customer”) that has executed an agreement for the use of Mesmer’s Services (the “Agreement”).
This DPA applies to the extent Mesmer processes Customer Personal Data on behalf of the Customer in the course of providing the Services.
“Applicable Data Protection Law” means all laws and regulations applicable to the processing of Personal Data under the Agreement, including but not limited to the GDPR and the CCPA.
“CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and any binding regulations promulgated thereunder.
“Controller” means the entity that determines the purposes and means of the processing of Personal Data. For the purposes of this DPA, Customer is the Controller.
“Customer Personal Data” means any Personal Data that Mesmer processes on behalf of the Customer as a Processor in connection with providing the Services.
“Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
“GDPR” means the General Data Protection Regulation (EU) 2016/679.
“Personal Data” means any information relating to a Data Subject that is subject to protection under Applicable Data Protection Law.
“Processor” means the entity that processes Personal Data on behalf of the Controller. For the purposes of this DPA, Mesmer is the Processor.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed.
“Services” means the services provided by Mesmer to the Customer under the Agreement.
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as adopted by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
“Sub-processor” means any third-party processor engaged by Mesmer to process Customer Personal Data.
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner’s Office.
2.1. Roles of the Parties. The parties acknowledge and agree that with regard to the processing of Customer Personal Data, Customer is the Controller and Mesmer is the Processor.
2.2. Customer’s Obligations. Customer represents and warrants that it has a valid legal basis for the processing of Customer Personal Data and for Mesmer’s processing of the same on its behalf as contemplated by the Agreement.
2.3. Mesmer’s Processing. Mesmer will process Customer Personal Data only in accordance with the Customer’s documented instructions. The Agreement (including this DPA) constitutes the Customer’s complete and final instructions to Mesmer for the processing of Customer Personal Data. Any additional instructions require a written agreement between the parties.
2.4. Details of Processing. The details of the data processing are described in Appendix 1 to this DPA.
3.1. Authorization. Customer provides a general authorization for Mesmer to engage Sub-processors to process Customer Personal Data. Mesmer will maintain an up-to-date list of its Sub-processors, which is available in Appendix 3.
3.2. New Sub-processors. Mesmer will provide Customer with at least thirty (30) days’ prior written notice of any intended new Sub-processor. Notice may be provided via email or through the Services.
3.3. Objection Rights. Customer may object to the appointment of a new Sub-processor within fourteen (14) days of receiving notice by providing a written explanation of the reasonable grounds for the objection. If the parties cannot resolve the objection, either party may terminate the applicable Order Form with respect to the Services that cannot be provided without the new Sub-processor.
3.4. Sub-processor Obligations. Mesmer will enter into a written agreement with each Sub-processor containing data protection obligations no less protective than those in this DPA. Mesmer shall remain fully liable to the Customer for the performance of the Sub-processor’s obligations.
4.1. Technical and Organizational Measures. Mesmer will implement and maintain appropriate technical and organizational measures designed to protect the security, confidentiality, and integrity of Customer Personal Data. These measures are described in Appendix 2.
4.2. Confidentiality. Mesmer will ensure that its personnel authorized to process Customer Personal Data are subject to a duty of confidentiality.
5.1. Transfer Mechanisms. To the extent that the processing of Customer Personal Data involves a transfer of data subject to transfer restrictions under the GDPR or UK GDPR, the parties agree that the Standard Contractual Clauses (SCCs) and/or the UK Addendum will apply as follows:
a. For GDPR: The SCCs will be deemed incorporated by reference. Module Two (Controller to Processor) will apply. The parties’ details will be those of the signatories to the Agreement, and the details of the processing will be as set forth in Appendix 1.
b. For UK GDPR: The UK Addendum will be deemed incorporated by reference and will be completed with the information set forth in the Appendices.
6.1. Assistance with Data Subject Rights. Mesmer will, to the extent legally permitted, provide reasonable assistance to the Customer to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Law.
6.2. Audits. Upon reasonable request, Mesmer will make available to the Customer information necessary to demonstrate compliance with this DPA. Customer may conduct an audit, no more than once annually, upon thirty (30) days’ prior written notice, to verify Mesmer’s compliance. Such audits shall be limited to reviewing Mesmer’s existing third-party audit reports (e.g., SOC 2) and/or responding to a written security questionnaire. Any on-site audit shall be subject to a separate written agreement and will be at the Customer’s expense.
7.1. Notification. If Mesmer becomes aware of a Security Incident, Mesmer will notify the Customer without undue delay, and in any event within forty-eight (48) hours.
7.2. Details. The notification will, to the extent known, describe the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, and the likely consequences.
7.3. Cooperation. Mesmer will take reasonable steps to mitigate the effects of the Security Incident and will provide reasonable cooperation to the Customer in its investigation and remediation of the incident.
Upon termination or expiration of the Agreement, Mesmer will, at the Customer’s choice, either delete or return all Customer Personal Data, and delete existing copies unless applicable law requires storage of the data. This process is further described in the Agreement’s termination clause.
9.1. GDPR. Mesmer will provide reasonable assistance to the Customer with any data protection impact assessments and prior consultations with supervisory authorities, as required under GDPR Articles 35 and 36.
9.2. CCPA. For the purposes of the CCPA, Mesmer is a “Service Provider.” Mesmer will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than for the specific business purposes specified in the Agreement; or (c) combine Customer Personal Data with personal information it receives from other sources, except as permitted under the CCPA.
10.1. Precedence. In the event of a conflict between this DPA and the Agreement, the terms of this DPA shall prevail with respect to the subject matter of data processing.
10.2. Term. This DPA will remain in effect as long as Mesmer processes Customer Personal Data on behalf of the Customer.
Data Exporter / Controller: Customer, as defined in the Agreement.
Data Importer / Processor: Mesmer Labs, Inc., a Delaware corporation providing an AI-powered platform that acts as a “chief of staff” for technical leadership by tracking and analyzing work across the organization.
Categories of Data Subjects:
Categories of Personal Data: Depending on the integrations Customer enables, Mesmer may process the following categories of Personal Data:
Sensitive Data Processed / Special Categories of Data (GDPR Art. 9): Mesmer’s Services are not designed to intentionally process Special Categories of Data. However, Customer acknowledges that by integrating systems containing free-form text (such as Slack messages, meeting transcripts, and pull request comments), Customer Personal Data within that content may be processed by the Services, which could inadvertently include Special Categories of Data. Customer, as the Controller, is responsible for implementing its own policies and controls to prevent the disclosure of unnecessary or sensitive Personal Data to the Services.
Frequency of Transfer: Continuous and in real-time, synchronized with Customer’s integrated systems throughout Customer’s use of the Services.
Nature and Purpose of Processing: The purpose of the processing is the provision of the Services as set out in the Agreement. This includes:
Retention of Data: Customer Personal Data is retained for the duration of the Agreement. Upon termination, Mesmer will delete or return such data in accordance with Section 8 of this DPA.
Location of Processing and Storage: Customer Personal Data is stored and processed in data centers located in the United States. Mesmer personnel who access Customer Personal Data to provide the Services are located in the United States and the European Union (Germany). The processing locations of each Sub-processor are listed in Appendix 3.
For Customers established in the EU: the supervisory authority of the Member State where the Customer is established.
If Customer is not established in the EU: the Irish Data Protection Commission, in line with the SCCs.
Mesmer implements and maintains the following categories of security measures:
Further details on our security practices may be available in our third-party audit reports (e.g., SOC 2 Type II) upon reasonable request.
Mesmer uses the following Sub-processors to provide the Services.
| Sub-processor Name | Purpose | Location of Processing |
|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, database, object storage, backups; LLM processing (Amazon Bedrock) | USA (us-east-1) |
| Anthropic, PBC | AI/LLM processing | USA |
| OpenAI | AI/LLM processing | USA |
| Microsoft Corporation (Microsoft Azure) | Hosting for Mesmer Agent; AI/LLM processing (Azure OpenAI Service) | USA (us-east-2) |
| Google LLC (Google Cloud Platform) | Cloud hosting and infrastructure | USA |
| LangChain, Inc. (LangSmith) | AI/LLM observability and tracing | USA |
| ClickHouse, Inc. | Database for Mesmer Agent | USA |
| Vercel Inc. | Frontend hosting and content delivery | USA |
| WorkOS, Inc. | Authentication and single sign-on | USA |
| Dash0 Inc. | Observability (logs, metrics, traces) | USA |
| PostHog, Inc. | Product analytics | USA |
| Plus Five Five, Inc. (Resend) | Transactional and product email | USA |
| Stripe, Inc. | Payment processing and billing | USA |
