Data Processing Addendum
This Data Processing Addendum (“DPA”) supplements the MintSaaS Terms of Service and applies where MintSaaS processes Personal Data on behalf of enterprise or business customers.
MintSaaS (Operated by MintSaaS Solutions)
Vaishali Tech District, Jaipur 302021, India
08BZPPV2587L1Z8
1. Purpose and Scope
This DPA governs the processing of Personal Data by MintSaaS Solutions (“Processor” or “MintSaaS”) on behalf of the customer (“Controller”) in connection with the delivery of digital software products, license management, and associated technical services.
This agreement complies with Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Digital Personal Data Protection Act, 2023 of India (“DPDP Act”), and the California Consumer Privacy Act (“CCPA/CPRA”).
2. Controller Instructions & Prohibited Training
MintSaaS will process Personal Data only on documented, lawful instructions from Controller, including with respect to transfers of Personal Data to a third country or an international organization, unless required to do so by applicable statutory law.
MintSaaS expressly covenants that Customer Personal Data, uploaded files, software build configurations, and telemetry are never used to train, fine-tune, or calibrate public or third-party artificial intelligence or machine learning models without explicit, unbundled written consent.
3. Technical & Organizational Security Measures (TOMs)
MintSaaS implements and maintains state-of-the-art technical and organizational measures to ensure a level of security appropriate to the risk, including:
- Encryption in Transit: Mandatory TLS 1.3 and HTTPS for all API and web interactions.
- Encryption at Rest: Industry-standard AES-256 encryption across managed databases (Supabase / AWS) and backup archives.
- Access Control: Granular Row Level Security (RLS) policies enforcing cryptographic isolation between customer accounts.
- Least Privilege: Multi-factor authentication (MFA) and zero-standing privileged access for administrative infrastructure.
- Ephemeral Processing: Web-based file transformation tools (PDF Toolkit, Image Compressor) process files entirely in client-side WebAssembly or ephemeral server RAM with zero persistent disk caching.
4. Sub-processors
Controller grants MintSaaS general written authorization to engage third-party sub-processors to deliver core cloud hosting and payment services. An up-to-date registry of authorized sub-processors is publicly accessible at /sub-processors.
MintSaaS remains fully liable to Controller for the performance of each sub-processor's data protection obligations.
5. Data Subject Rights & Erasure
Taking into account the nature of processing, MintSaaS assists Controller by appropriate technical and organizational measures in fulfilling its obligation to respond to requests from Data Subjects exercising their statutory rights under GDPR Chapter III and DPDP Act Chapter III (Access, Correction, Erasure, and Data Portability).
Upon termination of service or verified erasure request, MintSaaS will delete or return all Personal Data to Controller within 30 calendar days, preserving only mandatory statutory tax records required by Section 44AA of the Indian Income Tax Act.
6. Security Incident & Breach Notification
MintSaaS will notify Controller without undue delay (and in any event within 48 hours) after becoming aware of a confirmed Personal Data breach affecting Controller Personal Data. Notification will include details of the nature of the breach, affected data categories, and mitigation steps taken.
7. Grievance & Compliance Inquiries
For DPA counter-signatures, compliance audit requests, or data privacy inquiries, contact: