Data Processing Agreement
How M2C handles personal data it processes on your behalf.
Effective 21 May 2026
1. Roles
Where M2C processes personal data contained in materials you supply, you act as the data controller and M2C acts as a data processor. M2C processes that data only on your documented instructions and only to perform the engagement.
2. Scope of processing
Processing covers the personal data present in repositories, briefs, and supporting materials you grant M2C access to for a sprint. The subject matter is software development; the duration is the term of the engagement plus any retention period described below.
3. Confidentiality and security
M2C keeps personal data confidential and applies appropriate technical and organisational measures to protect it, including encryption of secrets, access controls scoped to the engagement, and row-level isolation of customer data. Access is limited to personnel and systems that need it to perform the engagement.
4. Sub-processors
M2C uses sub-processors to host infrastructure, run model inference, and process payments. M2C remains responsible for the acts of its sub-processors and binds them to data protection obligations no less protective than this agreement. You may request the current list of sub-processors at any time.
5. Data subject requests and incidents
M2C assists you in responding to data subject requests and notifies you without undue delay after becoming aware of a personal data breach affecting your data.
6. Retention and deletion
You may ask M2C at info@m2clead.com at any time to restrict sharing of your sprint data or to delete it. On termination of the engagement, M2C deletes or returns the personal data it processes on your behalf, except where retention is required by law.
This agreement is read alongside the Statement of Work and the Intellectual Property terms. By submitting a sprint request and confirming the engagement in writing with M2C you confirm you have read and accept all three.