Data Processing Addendum
Applies to organisation (enterprise) workspaces, where the organisation is the controller and MisterRoot the processor.
1. Scope and parties
This Addendum forms part of the agreement between the organisation ("Customer", controller) and MisterRoot ("Processor") for organisation workspaces of MisterRoot. It applies to personal data that members enter into the Customer's workspace.
2. Subject, duration, nature and purpose
| Item | Description |
|---|---|
| Subject | Running incident response exercises, team progress, action boards and reports |
| Duration | Term of the agreement plus the return/deletion period in section 3 |
| Data subjects | Members invited by the Customer |
| Data | Name, e-mail, role, exercise content, notes, uploaded files, audit trail |
3. Processor obligations
- Process only on the Customer's documented instructions, which are given through the Service's settings and this agreement.
- Keep personnel with access bound to confidentiality.
- Apply the security measures described in the Privacy Policy, section 8.
- Assist the Customer with data subject requests and breach notifications; notify a personal data breach without undue delay.
- At the end of the agreement, return or delete the workspace data at the Customer's choice within 30 days of a written request.
4. Customer obligations
- Have a lawful basis to let its members use the Service and inform them accordingly.
- Instruct members not to enter real personal data or real confidential information into exercises.
- Manage member access (invitations, roles, removal) through the Service.
5. Sub-processors and transfers
| Sub-processor | Service | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, backups, e-mail | Germany (EU) / USA |
| Cloudflare | Content delivery and protection | Global, incl. USA |
| Anthropic | AI processing of exercise content | USA |
The Processor will notify the Customer at least 30 days before adding or replacing a sub-processor; the Customer may object and terminate if the objection cannot be resolved.
6. Liability and precedence
Liability under this Addendum follows the limitation in the Terms of Service unless mandatory law provides otherwise. In case of conflict on data protection matters this Addendum prevails. Contact: [email protected]. Last updated: 14 October 2026.