Data Processing Agreement

Version 1.0 · 24 August 2026 · This page always shows the current version. Annex to the RepMind Terms of Service, entered into under Article 28(3) of Regulation (EU) 2016/679 (the "GDPR").

1. Parties

Processor: Edgars Laizāns, trading as North Light Press, a sole trader established in Latvia, European Union. Contact for data protection matters: hello@northlightpress.net.

Controller: the customer identified in the RepMind order or subscription to which this Annex attaches ("the Customer").

Each a "Party" and together the "Parties". This Annex forms part of, and is governed by, the RepMind Terms of Service. Where this Annex conflicts with the Terms of Service in respect of the processing of personal data, this Annex prevails.

2. Roles and scope

The Customer is the controller and the Processor is a processor in respect of the personal data described in Annex 1. The Processor processes that personal data solely to provide the RepMind service and solely on the Customer's documented instructions, which include this Annex, the Terms of Service, and the Customer's use of the service's features.

If the Processor is required by Union or Member State law to process personal data other than on the Customer's instructions, it shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The Processor shall inform the Customer immediately if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law.

3. Customer obligations

• The Customer warrants that it has a lawful basis for the processing it instructs, and that it has provided any notice and obtained any consent required in its jurisdiction.
• The Customer is responsible for the accuracy, quality and legality of the personal data it enters into the service and for the means by which it acquired that data.
• The RepMind service is not designed or intended for the processing of special categories of personal data under Article 9 GDPR. In particular, the Customer shall not enter data concerning the health of, or otherwise identifying, any patient or other individual receiving care. The Customer is responsible for instructing its users accordingly.
• The Customer shall manage its own user accounts and access rights within the service, including prompt removal of users who leave.

4. Confidentiality

The Processor shall ensure that any person authorised to process the personal data is subject to an appropriate obligation of confidentiality, whether contractual or statutory, and processes the data only on the Processor's instructions.

5. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons, the Processor shall implement appropriate technical and organisational measures under Article 32 GDPR. The measures in force are described in Annex 2. The Processor may update those measures from time to time, provided that the level of protection is not materially reduced.

6. Sub-processors

The Customer grants the Processor a general written authorisation to engage sub-processors. The sub-processors engaged are listed in Annex 3 below, which is kept current on this page.

The Processor shall impose on each sub-processor, by written contract, data protection obligations no less protective than those in this Annex, and remains fully liable to the Customer for the performance of each sub-processor's obligations.

The Processor shall give the Customer at least thirty (30) days' notice before adding or replacing a sub-processor. Notice is given by email to the Customer's administrative contact and by publication on this page. The Customer may object on reasonable data protection grounds within that period; if the Parties cannot resolve the objection, the Customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the unused period.

7. International transfers

Personal data is stored within the European Union where the relevant sub-processor offers EU storage. Certain processing — in particular speech-to-text transcription and AI structuring of visit notes — may take place outside the European Economic Area.

Where personal data is transferred outside the EEA, the transfer is made under the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), incorporated through the Processor's agreements with the relevant sub-processors, together with any supplementary measures required following a transfer impact assessment.

8. Assistance to the Controller

Taking into account the nature of the processing, the Processor shall assist the Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer's obligation to respond to requests to exercise data subject rights under Chapter III GDPR.

The service allows the Customer to search, export and delete the records relating to an individual data subject without assistance from the Processor. Where the Customer nonetheless requires assistance, the Processor shall provide it within a reasonable period and, in any event, in time for the Customer to meet its statutory deadline.

The Processor shall further assist the Customer in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor.

9. Personal data breach

The Processor shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting personal data processed under this Annex.

The notification shall describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information cannot be provided at once, it shall be provided in phases without undue further delay.

10. Audit and information

The Processor shall make available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

Audits shall be conducted on not less than thirty (30) days' written notice, no more than once in any twelve (12) month period except following a personal data breach, during normal business hours, and in a manner that does not unreasonably disrupt the Processor's operations. The Processor may satisfy an audit request by providing its then-current security documentation and the security documentation of its sub-processors.

11. Deletion and return

On termination or expiry of the subscription, the Customer may export its data from the service. At the Customer's choice, the Processor shall delete or return all personal data processed on the Customer's behalf and delete existing copies, within thirty (30) days of the Customer's request, unless Union or Member State law requires storage of the personal data.

Absent a request from the Customer, the Processor shall delete the Customer's workspace and its contents within ninety (90) days of termination. Routine backups are overwritten on their ordinary cycle.

12. Liability and governing law

The limitations and exclusions of liability set out in the RepMind Terms of Service apply to this Annex, save to the extent that such limitation is not permitted by applicable data protection law.

This Annex is governed by the law of Latvia, and the courts of Latvia have exclusive jurisdiction, without prejudice to any mandatory right of a data subject or supervisory authority.

13. Effect

This Annex takes effect on the date of the Customer's subscription. A countersigned copy for the Customer's records is available on request from hello@northlightpress.net.

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

Access control

• Individual named accounts with email-and-password authentication; no shared accounts are issued by the Processor.
• Data is segregated per customer organisation and enforced at the database layer by row-level security policies, so a query executed by one organisation cannot return another organisation's rows.
• Role-based permissions within the Customer's organisation (representative, manager, administrator), managed by the Customer.
• Database functions run with least privilege; execution rights are restricted to authenticated principals.

Transmission and storage

• All traffic between client and service is encrypted in transit using TLS.
• Data is stored by the hosting sub-processor named in Annex 3, within the European Union where that sub-processor offers EU storage, and is encrypted at rest by that sub-processor.
• Third-party credentials and API keys are held server-side and are never exposed to the client application.

Availability and resilience

• Managed database backups are operated by the hosting sub-processor on its standard cycle.
• The client application supports offline capture and synchronises when connectivity returns, so that a loss of connectivity does not cause loss of the Customer's records.

Organisational measures

• Access to production data is limited to the Processor personally and to the sub-processors listed in Annex 3 acting under contract.
• Access to production data is used only to operate, support and secure the service, or where the Customer requests support.
• Changes to the service are version-controlled and reviewed before deployment.

Testing and evaluation

• Access-control policies are reviewed when the data model changes, and the effectiveness of measures is re-assessed at least annually.

Annex 3 — Sub-processors