Data Processing Addendum

This addendum is between you (the customer, as controller) and Mithos Limited (as processor). It forms part of our Terms of Service and applies whenever we process personal data on your behalf. It meets the requirements of Article 28 of the UK GDPR. If it conflicts with the Terms on data protection, this addendum wins.

• Subject matter: providing Mithos The Village to you.
• Duration: for as long as you have an account, plus the time needed to delete data afterwards.
• Nature and purpose: fetching, displaying, storing and analysing data you connect or enter, so the service works as described.
• Types of personal data: details of people in your connected calendars (for example, meeting titles, times and locations that may identify people, and attendee information held by the calendar provider); details of staff or others you enter, such as roles and salaries in a hiring plan; team-level HR totals entered in the People building (team names, headcount, average pay, pension %, joiners, leavers, absence days and open roles), your workplace pension duties start date, and key dates such as right-to-work, probation and contract dates described by role. The People building is designed not to hold records about named individuals, and you should not enter names; in small teams these totals or role-based dates may still relate to an identifiable person. Plus any other personal data you choose to enter.
• Data subjects: your staff, contractors, customers, suppliers, meeting attendees and other contacts.

• We process personal data only on your documented instructions, which are the Terms and how you use the service, unless the law requires otherwise (in which case we will tell you, if allowed).
• Everyone we authorise to process the data is bound by confidentiality.
• We take appropriate technical and organisational security measures, as described on our Security page.
• We help you, where reasonable, to respond to requests from people exercising their data protection rights, and with security, breach notification, impact assessments and consultations with the ICO.
• At the end of the service, we delete the personal data (you can download it first from your account page), unless the law requires us to keep it. The one exception is the record that you accepted our Terms and Privacy Policy (document, version, date, and IP address if recorded), which we keep for 6 years without your name or email so we can show what was agreed if there is a dispute.
• We make available the information needed to show we meet these obligations, and allow audits on reasonable request and notice, at your cost, no more than once a year unless there has been a breach.

You give general authorisation for us to use the subprocessors listed on our Subprocessors page. We will give notice of any new or replacement subprocessor by updating that page and, where practical, by email, so you can object. We put data protection terms in place with each subprocessor that are at least as protective as this addendum, and remain responsible for them.

We will tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information you reasonably need to meet your own obligations, and we will take reasonable steps to contain it.

We only transfer personal data outside the UK where it is protected, where applicable by UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.

You are responsible for having a lawful basis for the personal data you connect or enter, and for giving people any information the law requires.

Questions about this addendum: info@mithos.co.uk.