Data Processing Addendum
Last updated November 12, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between Mendly LLC ("Processor") and the Customer ("Controller") and applies to personal information in Customer Data.
1. Instructions
Processor processes Customer Data only to provide the Service, on Customer's documented instructions (including these Terms and Customer's use of the Service settings), unless law requires otherwise. Processor will not sell or share Customer Data, retain or use it for any other purpose, or combine it with other customers' data, except as permitted for service providers under applicable law.
2. Confidentiality and personnel
People authorized to process Customer Data are bound by confidentiality and access it only as needed.
3. Security
Processor maintains the safeguards described on the Security page, including separation of each Customer's data, encryption in transit and at rest, and access controls.
4. Subprocessors
Customer authorizes the subprocessors listed on the Subprocessors page. Processor will give at least 15 days' notice of new subprocessors on that page; Customer may object on reasonable data-protection grounds, and if no solution is found, may terminate the affected service.
5. Assistance
Processor will help Customer respond to requests from individuals (such as tenants), and with security and assessment obligations, taking into account the nature of processing.
6. Incidents
Processor will notify Customer without undue delay, and in any event within 72 hours, after confirming a breach of security affecting Customer Data, and provide information Customer reasonably needs to meet its obligations.
7. Return and deletion
On termination, Processor will make Customer Data available for export for 30 days and then delete it within 90 days, except where law requires retention.
8. Audits
On reasonable request no more than once per year, Processor will provide information needed to demonstrate compliance with this DPA.