This DPA forms part of the Terms between Golden Poppy, operated by Ana Francisco, Lisbon, Portugal ("MIMO", processor) and the Customer (controller) when MIMO processes personal data on the Customer's behalf. It is governed by Portuguese and EU law.

1. Subject matter

Processing of meeting recordings, transcripts, participant identifiers and derived outputs strictly to provide MIMO.

2. Sub-processors

Listed and kept current at /sub-processors. We give 30 days' notice of new sub-processors; you may object on reasonable grounds.

3. Security measures

Encryption in transit and at rest, RLS-scoped access, least-privilege roles, audit logging, vulnerability scanning, incident response.

4. International transfers

EU Standard Contractual Clauses (Modules 2 and 3) and UK IDTA where applicable.

5. Data subject requests

We assist within 5 business days. Bulk export and deletion are self-serve via Settings → Privacy & Data.

6. Breach notification

Notice within 72 hours of awareness.

7. Audits

Customers may request our latest security report annually under NDA.

To execute the DPA, email legal@mimo.app.

Data Processing Addendum