Data Processing Addendum
Effective date: August 12, 2026
Last updated: August 12, 2026
1. Scope and roles
Section titled “1. Scope and roles”This DPA forms part of the agreement between Customer (controller/business) and CALLED IT INC. (“MemStrata,” processor/service provider). It applies to Customer Personal Data processed by MemStrata on Customer’s documented instructions to provide the Services. Each party independently controls account, billing, security, and business-contact information it processes for its own legitimate purposes.
2. Instructions and purpose limitation
Section titled “2. Instructions and purpose limitation”Customer instructs MemStrata to process Customer Personal Data only to provide, secure, support, and delete/export the contracted Services, and as further documented in an order or support request. MemStrata will notify Customer if an instruction appears unlawful unless prohibited by law. MemStrata will not sell, share for cross-context behavioral advertising, retain/use/disclose outside the business purpose, or combine Customer Personal Data except as law permits.
3. Personnel and confidentiality
Section titled “3. Personnel and confidentiality”MemStrata limits access to authorized personnel with a need to know and binding confidentiality obligations, provides appropriate security/privacy training, and removes access promptly when no longer required.
4. Security
Section titled “4. Security”MemStrata will maintain measures proportionate to risk, including access control and MFA for production administration; encryption in transit and where appropriate at rest; managed secrets; logging and monitoring; secure software development, dependency and vulnerability management; backups and recovery; tenant isolation; incident response; and periodic testing. Additional Technical and Organizational Measures may be attached to an Order Form or executed copy of this DPA.
5. Subprocessors
Section titled “5. Subprocessors”Customer grants general authorization for subprocessors listed in the public Subprocessor Notice. MemStrata will give 30 days’ notice of a new subprocessor, allow reasonable data-protection objections, impose substantially equivalent obligations, and remain responsible for subprocessor performance as required by law. If the parties cannot resolve an objection, Customer may terminate the affected hosted feature without penalty.
6. Rights assistance
Section titled “6. Rights assistance”Taking account of the nature of processing, MemStrata will reasonably assist Customer with access, correction, deletion, portability, restriction, objection, opt-out, and appeal requests. MemStrata will not independently respond about Customer-controlled data except on Customer’s instruction or as legally required.
7. Security incidents
Section titled “7. Security incidents”MemStrata will notify Customer without undue delay after confirming a breach of Customer Personal Data and provide available information about nature, scope, likely consequences, containment, remediation, and affected records. Notice is not an admission of fault. The parties will cooperate on legally required notifications. An Order Form may specify an additional contractual notification target.
8. Assessments, audits, and regulators
Section titled “8. Assessments, audits, and regulators”MemStrata will provide information reasonably necessary to demonstrate compliance and assist with DPIAs and regulator consultations. Once annually, Customer may review current independent reports and questionnaires. On-site or expanded audits require reasonable notice, confidentiality, scope controls, and cost allocation unless a material incident or regulator requires otherwise.
9. Return and deletion
Section titled “9. Return and deletion”During the term, Customer may export Customer Personal Data using documented tools. At termination or written instruction, MemStrata will delete or return Customer Personal Data according to the applicable Order Form and retention schedule, except copies required by law, legal hold, security, financial-record, or backup-expiry obligations. Safeguards and use restrictions continue for any retained copies.
10. International transfers
Section titled “10. International transfers”Where an EEA restricted transfer occurs, the 2021 EU SCCs are incorporated with the module appropriate to the parties’ roles, the competent authority and law selected by the exporter’s location, and the DPA schedules serving as annexes. For UK restricted transfers, the UK Addendum or IDTA applies. The parties will complete transfer assessments and supplementary measures where required. The official clauses prevail and must not be substantively altered.
11. CCPA/US state terms
Section titled “11. CCPA/US state terms”MemStrata is a service provider/processor for covered Customer Personal Data. It processes only for specified business purposes, follows Customer instructions, provides the same level of protection required by applicable law, notifies Customer if it can no longer comply, and permits reasonable steps to stop and remediate unauthorized use. It does not sell or share covered data.
Schedule A — processing details
Section titled “Schedule A — processing details”- Subject matter: hosted licensing, account/authentication, billing integration, customer-directed hosted retrieval/connectors, governance evidence, and support, but only to the extent identified in the applicable order.
- Duration: agreement term plus the applicable return/deletion period.
- Nature/purpose: identity-scoped ingestion, retrieval, governance, licensing, support, security, and customer-directed operations.
- Data subjects: Customer users, personnel, end users, and persons represented in Customer-selected sources.
- Data: identifiers, communications, code/documents, structured records, retrieval evidence, device/license metadata, usage and audit data, depending on configuration.
- Sensitive data: not intentionally required; Customer must configure controls and obtain authorization before submitting regulated/special-category data.
- Frequency: continuous or customer-directed during the term.
- Retention: the category schedule attached to the applicable Order Form or executed DPA, subject to deployed deletion and backup-expiry controls. Financial, fraud, incident and legal-hold records may require longer disclosed periods.
Schedule B — parties and signatures
Section titled “Schedule B — parties and signatures”Processor/importer: CALLED IT INC., Canada corporation no. 1785099-9, Ontario OCN/BIN 1001571777. Privacy contact: Neeraj Yadav, privacy@memstrata.dev. Legal notices: legal@memstrata.dev.
Processor address: 6035 Bidwell Trail, 128, Mississauga, Ontario, L5V 3E1, Canada. The Customer address is completed in the executed DPA or SCC annex.
Customer/exporter: complete per Order Form, including legal name, address, contact, role, competent supervisory authority, transfer module and signatures.
Schedule C — training and optional processing
Section titled “Schedule C — training and optional processing”Customer Data is excluded from model training and fine-tuning by default. No training or research use is authorized by this DPA. A future program requires a separate written opt-in identifying scope, data categories, model/provider, purpose, retention, withdrawal effect, subprocessors, and transfer safeguards. Optional product analytics, diagnostics and marketing are likewise outside the processing instructions unless separately enabled by an authorized user.