This Data Processing Agreement (the DPA) forms part of any services agreement, order form, terms of service, or other written agreement (the Agreement) between (i) the entity receiving services (the Customer) and (ii) Mabyduck Ltd (Mabyduck).
This DPA applies where Mabyduck processes Personal Data in providing subjective testing, annotation, labelling, rating, or related services (the Services).
Applicable Data Protection Law means the EU General Data Protection Regulation (Regulation (EU) 2016/679) (EU GDPR), the UK GDPR (as defined in the Data Protection Act 2018) (UK GDPR), the Data Protection Act 2018, and any other applicable data protection or privacy laws, in each case as amended, updated, or replaced from time to time.
Customer Personal Data means Personal Data provided by the Customer to Mabyduck, or otherwise processed by Mabyduck on the Customer's documented instructions, for the purpose of providing the Services. Customer Personal Data does not include Participant Personal Data or Customer-Controlled Study Data.
Participant Personal Data means Personal Data relating to individuals recruited or engaged by or on behalf of Mabyduck to take part in studies (Participants), including recordings of Participant interactions with the study interface, ratings, scores, and related metadata, captured or generated by Mabyduck and made available to the Customer.
Customer-Controlled Study Data means Personal Data relating to Participants that is captured or processed directly within the Customer's own systems, and which is not received, stored, or otherwise accessible by Mabyduck. For example, audio or video captured as part of an embedded experiment.
Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach, and Supervisory Authority have the meanings given in Applicable Data Protection Law.
Services means the subjective testing, annotation, labelling, rating, and related services provided by Mabyduck to the Customer, including studies involving Participant Personal Data and Customer-Controlled Study Data.
The Customer is the Controller of Customer Personal Data.
Mabyduck is the Processor of Customer Personal Data.
Mabyduck will process Customer Personal Data only on documented instructions from the Customer and only to provide the Services, unless Mabyduck is required to do otherwise by applicable law.
Mabyduck does not determine the purposes of processing and does not sell, reuse, aggregate, analyse, or commercialise Customer Personal Data or annotations for its own purposes.
All annotations, labels, ratings, metadata and outputs generated through the Services in relation to Customer Personal Data are the exclusive property of the Customer.
Mabyduck is an independent Controller of Participant Personal Data in respect of the recruitment, engagement, and initial collection of such data from Participants.
Upon delivery of Participant Personal Data to the Customer, the Customer becomes a separate, independent Controller of the copy of Participant Personal Data it receives.
The Customer is the sole Controller of Customer-Controlled Study Data. Mabyduck's role in respect of Customer-Controlled Study Data is limited to referring or matching Participants to the relevant study, and Mabyduck does not receive, store, or otherwise process Customer-Controlled Study Data.
SUBJECT MATTER: annotation and subjective testing services, including studies involving Participant Personal Data and Customer-Controlled Study Data.
NATURE OF PROCESSING (Customer Personal Data): accessing, hosting, displaying, annotating, labelling, reviewing, storing, and transmitting data provided by the Customer for the purpose of providing the Services.
NATURE OF PROCESSING (Participant Personal Data): recruiting and engaging Participants, capturing recordings, ratings, scores, and related metadata, hosting and storing such data, and delivering it to the Customer.
NATURE OF PROCESSING (Customer-Controlled Study Data): referring or matching Participants to studies conducted on the Customer's own systems. Mabyduck does not access, host, or store Customer-Controlled Study Data.
PURPOSE: to provide the Services in accordance with the Customer's documented instructions, or, in respect of Participant Personal Data, to conduct and deliver studies to the Customer.
DURATION (Customer Personal Data): for the retention period configured by the Customer for the relevant dataset, or where no such period is configured, for the term of the Agreement. Following deletion of a dataset, a copy may persist in Mabyduck's backups for up to 7 days before being removed. Mabyduck may also retain data for any limited additional period necessary to comply with legal obligations.
DURATION (Participant Personal Data): video recordings of sessions are retained by Mabyduck for 30 days following collection, after which they are deleted from Mabyduck's systems. Participant metadata will be deleted or anonymized upon the Participant's request, in accordance with applicable law.
TYPES OF PERSONAL DATA (Customer Personal Data): may include images, video, audio, text, metadata, and other content provided by the Customer. Datasets may include personal data and may (depending on content) include identifiers in images or voice.
TYPES OF PERSONAL DATA (Participant Personal Data): may include recordings of Participant interactions with the study interface, ratings, scores, and related metadata.
CATEGORIES OF DATA SUBJECTS (Customer Personal Data): as determined by the Customer and may include end users, employees, contractors, customers, or individuals appearing in the Customer’s datasets.
CATEGORIES OF DATA SUBJECTS (Participant Personal Data and Customer-Controlled Study Data): Participants recruited or engaged by Mabyduck to take part in studies.
Mabyduck does not independently verify dataset content and processes Customer Personal Data solely as instructed by the Customer.
Mabyduck will implement appropriate technical and organisational measures to protect Customer Personal Data and Participant Personal Data in its possession, taking into account the nature of the data and risks of processing.
These measures include, as appropriate: access controls; confidentiality obligations for authorised personnel; encryption in transit (and at rest where appropriate); secure infrastructure and hosting; and logical separation of Customer data environments.
Mabyduck will ensure that persons authorised to process Customer Personal Data are subject to confidentiality obligations.
The Customer provides general authorisation for Mabyduck to use sub-processors to deliver the Services (for example, cloud hosting providers, security providers, and rater sourcing providers).
Mabyduck will ensure that sub-processors are engaged under written agreements that provide data protection safeguards consistent with this DPA.
Mabyduck remains responsible for the acts and omissions of its sub-processors.
Where Customer Personal Data is transferred outside the UK or EEA, Mabyduck will ensure that appropriate safeguards are in place in accordance with Applicable Data Protection Law (for example, Standard Contractual Clauses and/or the UK Addendum where required).
Where the Customer downloads or obtains Participant Personal Data at a location outside the UK or EEA, the Customer is responsible for ensuring that appropriate safeguards are in place for that transfer in accordance with Applicable Data Protection Law.
If Mabyduck receives a request from a Data Subject relating to Customer Personal Data, Mabyduck will promptly notify the Customer.
Mabyduck will not respond directly to a Data Subject request relating to Customer Personal Data unless required by law or authorised by the Customer.
Mabyduck will provide reasonable assistance to enable the Customer to respond to Data Subject requests, taking into account the nature of the processing and information available to Mabyduck.
Where the Customer downloads or otherwise obtains a copy of Participant Personal Data (including session recordings), the Customer acts as an independent Controller of that copy and is solely responsible for it from the point of download onward.
Upon notice from Mabyduck that a Participant has exercised a right of erasure, the Customer shall delete or anonymise the identifying metadata linking that Participant to their ratings, save where retention is required or permitted by Applicable Data Protection Law. The Customer is not required to delete the ratings or other study outputs once they can no longer be attributed to an identifiable individual.
The Customer shall delete each copy of a video session recording within 30 days of downloading it.
The Customer shall indemnify Mabyduck against any claims, losses, or liabilities arising from its processing of Participant Personal Data after download.
Where the Customer is located outside the UK or EEA, the Customer is responsible for ensuring an appropriate transfer mechanism is in place for Participant Personal Data it obtains.
If Mabyduck becomes aware of a Personal Data Breach affecting Customer Personal Data, Mabyduck will notify the Customer without undue delay.
Mabyduck will provide available information about the breach (including what happened, what data may be affected, and mitigation steps taken or planned) and will take reasonable steps to contain and remediate the breach.
Upon termination or expiration of the Services, Mabyduck will, at the Customer’s choice, delete Customer Personal Data or return it to the Customer, unless retention is required by law.
Backup copies will be deleted in accordance with standard retention cycles and will not be used for any purpose other than backup restoration and disaster recovery.
Upon reasonable request, Mabyduck will provide information reasonably necessary to demonstrate compliance with this DPA.
Formal audits will only be required where legally necessary or in the event of a confirmed Personal Data Breach affecting Customer Personal Data.
Liability under this DPA is subject to the liability limitations in the Agreement, unless prohibited by Applicable Data Protection Law.
This DPA is governed by the law governing the Agreement.
If there is any conflict between this DPA and the Agreement regarding data protection matters, this DPA will prevail to the extent of the conflict.
This DPA becomes effective on the effective date of the Agreement and applies automatically to all processing of Personal Data by Mabyduck in connection with the Services.