Parties and scope
This addendum forms part of the terms of service between the customer and [[COMPANY LEGAL NAME]], [[REGISTERED ADDRESS]] ("Mortar"). It applies when Mortar processes personal data on the customer's behalf. The customer is the controller of that data and Mortar is its processor.
Details of the processing
- Subject matter and purpose
- Providing the inference API, the console and the accounts behind them.
- Duration
- For as long as the customer uses Mortar, then until deletion as set out below.
- Data subjects
- The customer's members, and any people whose personal data the customer includes in prompts.
- Personal data
- Members' account data as listed in the privacy notice, and whatever personal data the customer chooses to include in prompts and receives in completions.
- Bring Your Own Cloud
- Prompts and completions are handled by the data plane in the customer's environment. Mortar's control plane receives only the credentials it is asked to verify, as the security page describes.
Mortar's obligations
- Instructions
- Mortar processes the personal data only on the customer's documented instructions, which include these terms and the customer's use of the service.
- Confidentiality
- People authorised to process the personal data are bound to keep it confidential.
- Security
- Mortar maintains the technical and organisational measures described on the security page.
- Assistance
- Mortar helps the customer answer requests from data subjects and meet its own obligations where Mortar's part of the processing is involved.
- Breaches
- Mortar tells the customer about a personal data breach affecting the customer's data without undue delay, and within [[BREACH NOTIFICATION DEADLINE]].
- Deletion
- When the customer stops using Mortar, Mortar deletes the personal data within [[RETENTION AFTER ACCOUNT CLOSURE]], unless law requires it to be kept.
- Demonstrating compliance
- Mortar makes available the information needed to show it meets this addendum. Certifications and independent audits: [[CERTIFICATIONS AND AUDITS]].
Sub-processors
The customer authorises the sub-processors listed here. Mortar gives [[SUB-PROCESSOR CHANGE NOTICE PERIOD]] notice before adding or replacing one, and the customer may object in that time.
International transfers
Transfers of personal data outside the country where it was collected rely on [[INTERNATIONAL TRANSFER MECHANISM]].
Governing law
[[GOVERNING LAW AND COURTS]]