Mindsetor
ANNEX A · DATA HANDLING SCHEDULE
Data Handling Schedule
CONTROLLER-LEVEL INFORMATION SCHEDULE
Version 2.0 · 29 April 2026 · Replaces v1.0 (February 2026, processor-framed DPA)
This Schedule is Annex A to the Mindsetor Master Service Agreement ("MSA"). It documents how Mindsetor B.V. ("Mindsetor", "we") handles personal data on its own behalf as sole data controller (Article 4(7) GDPR). It does not establish a controller-to-processor relationship under Article 28 GDPR; the customer ("Customer") is a purchaser of Mindsetor's service, not a controller of the personal data processed through the platform. This document discharges the transparency, accountability, and information-provision expectations that a procurement / DPO reviewer would otherwise look for in an Article 28 DPA, framed correctly under the controller relationship that actually applies.
1. Parties and roles
Mindsetor B.V. — Brightlands Smart Services Campus, Smedestraat 2, 6411 CR Heerlen, Netherlands. KvK 42042393 · RSIN 869442958. Email: support@mindsetor.com. Mindsetor is the sole data controller (Art. 4(7) GDPR) for personal data processed through the Platform, including users' health data, mood self-reports, derived risk and wellbeing scores, gamification data, and Care Hub session metadata.
Customer — the organisation that has entered into a Master Service Agreement with Mindsetor and whose employees are granted access to the Platform. The Customer is a purchaser of Mindsetor's service. The Customer does not determine the purposes or means of processing of individual users' personal data and is not a data controller of that data.
User — an individual employee, contractor, or family-plan member who has registered an account on the Platform. The User is the data subject for the purposes of Articles 12-23 GDPR. Users provide explicit consent (Art. 9(2)(a)) directly to Mindsetor during onboarding. For Care Hub clinical sessions, processing also rests on Art. 9(2)(h) (provision of health care/treatment) read with Art. 9(3) and Dutch WGBO Art. 7:454 BW.
Why not a processor DPA?
Mindsetor designs the burnout-prevention service end-to-end: it determines what data is collected, the lawful basis, the retention periods, the algorithms and risk scoring methods, the sub-processors engaged, and the privacy controls. The Customer does not give Mindsetor processing instructions; the Customer purchases access to a finished service. Per EDPB Guidelines 07/2020 on the concepts of controller and processor, this fact pattern is a controller relationship, not an Art. 28 processor relationship. A processor DPA would misrepresent the legal relationship and would mis-allocate Art. 33 / 34 / 13-14 / 30 / 35 obligations to the Customer that Mindsetor in fact owes directly. This Schedule supplies the same protections a procurement reviewer would look for in a DPA, structured around the actual relationship.
2. Categories of personal data and lawful bases
Mindsetor processes the following categories of personal data under the lawful bases listed:
| Category | Lawful basis (Art. 6 + Art. 9 where applicable) |
|---|---|
| Account data (first name, work email, year of birth, employer association, join code) | Contract performance — Art. 6(1)(b) |
| Health data from HealthKit / Health Connect / Garmin (steps, heart rate, resting HR, HRV (SDNN/RMSSD), sleep stages, sleep quality) | Explicit consent — Art. 9(2)(a) |
| Self-reported mood (valence, energy, affect labels, life-domain context) | Explicit consent — Art. 9(2)(a) |
| Derived risk and wellbeing scores (V4.1 Risk Engine) | Explicit consent — Art. 9(2)(a). Informational scores only; not a solely automated decision under Art. 22(1). |
| Care Hub booking metadata + clinical session notes | Booking flow: Art. 6(1)(b) + Art. 9(2)(a). Clinical interaction itself: Art. 9(2)(h) (health care/treatment) read with Art. 9(3) and Dutch WGBO Art. 7:454 BW. |
| Gamification data (points, streaks, badges, leaderboard position, nickname) | Contract performance — Art. 6(1)(b) |
| Aggregated, k=10 + sparse-cell-suppressed employer reporting (output) | Outputs are non-personal under GDPR Recital 26 once aggregation has been applied (CBS statistical-disclosure-control methodology). Inputs covered by the consent basis recorded above. |
| Push-notification tokens (FCM) | Notification consent + Contract — Art. 6(1)(b) |
3. Sub-processors
Mindsetor engages the sub-processors listed below on its own behalf to assist in delivering the service. Each is bound by a written contract imposing equivalent data-protection obligations under Art. 28(1) and 28(3) GDPR (Mindsetor's Art. 28 obligations to its own sub-processors).
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google Ireland Limited (Firebase / Google Cloud Platform) | Database, authentication, Cloud Functions, hosting, analytics | EU (europe-west1, Belgium) | EU processing (no transfer) |
| Firebase Cloud Messaging (Google Ireland Limited / Google LLC) | Push-notification delivery | EU / USA | Commission Implementing Decision (EU) 2021/914 SCCs Module 2 (controller-to-processor); Google EU-US Data Privacy Framework certification |
| Agora Lab, Inc. | Video infrastructure for Care Hub specialist sessions | USA | Commission Implementing Decision (EU) 2021/914 SCCs Module 2 (controller-to-processor); transfer impact assessment on file |
| Garmin Ltd. | Health-data synchronisation via OAuth API (steps, sleep, HRV, heart rate) | USA / EU | Commission Implementing Decision (EU) 2021/914 SCCs Module 2; EU-US Data Privacy Framework where applicable |
Sub-processor change notification
Mindsetor will publish notice of any new sub-processor at mindsetor.com/data-handling-annex and notify subscribing organisations by email at least 30 days in advance. The Customer may object to a new sub-processor by written notice within the 30-day period; if Mindsetor cannot accommodate the objection (for example, by routing the Customer's data through an alternative sub-processor), the Customer may terminate the affected portion of the service without penalty for the remainder of the term and receive a pro-rata refund for unused fees.
OTP delivery and identity-provider sign-in
OTP-email delivery for organisational-membership verification is provided through Firebase Authentication (sub-processor entry 1, Google Ireland Limited / Google Cloud). Apple Sign-In and Google Sign-In are user-side identity providers; Mindsetor authenticates the resulting tokens but does not share personal data with them as Art. 28 sub-processors. There are no additional sub-processors beyond those listed above.
4. Technical and organisational measures (Art. 32 GDPR)
- Encryption at rest: AES-256, Google-managed keys (Cloud Firestore, Cloud Storage).
- Encryption in transit: TLS 1.2 or higher; HSTS enabled on web surfaces with
max-age=31536000; includeSubDomains; preload. - Authorisation: Firestore Security Rules enforce per-document role-based access at the database boundary. Role separation between employee, specialist, employer admin, and Mindsetor admin is enforced at rule level. Delete operations on points and insight collections are blocked to preserve audit history.
- Application integrity: Firebase App Check enforced globally on all Cloud Functions (Play Integrity Android, App Attest iOS, reCAPTCHA v3 web).
- Mobile transport: Android network security configuration enforces HTTPS-only with system CA validation; iOS uses App Transport Security defaults. (Cert pinning was evaluated and removed 2026-05-05 in v1.16.7+125 after a Recaptcha-SDK incident on TLS-interception networks; OWASP MASVS L2 lists pinning as MAY, not MUST.)
- Build hardening: release builds use Dart obfuscation with split debug info; Android release uses ProGuard/R8.
- Pre-push security audit: secret scanning, dependency audit, SAST, Firestore-rules audit (`scripts/security-audit.sh --quick`, `scripts/firestore-rules-audit.sh`); pre-commit test gate runs on every commit.
- Penetration testing: annual third-party cycle. Most recent: MaaSec, scoping 21 February 2026, final report 6 March 2026; closure log available on request. Next cycle: March 2027. Critical and High-severity findings remediated within 60 calendar days of report delivery.
- Disaster recovery: Cloud Firestore Point-in-Time Recovery (7-day window) enabled; recovery point objective (RPO) target ≤ 24 hours; recovery time objective (RTO) target ≤ 8 hours. Full plan documented internally and available on request.
- Audit logging: Google Cloud Audit Logs for administrative access; retained as compliance evidence.
- Certifications: Mindsetor itself is not yet certified to SOC 2 Type II or ISO 27001:2022; controls are aligned to those frameworks and a CSA CAIQ self-assessment is available on request. Underlying infrastructure (Google Cloud Platform) holds SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018.
5. Employer Firewall and aggregation thresholds
The Customer never has access to individual users' health data, mood scores, risk scores, or session content. Aggregated data is delivered only above the thresholds below.
- Employer-visible aggregates (HR dashboard, departmental reports): require k=10 minimum-cell-size with complementary sparse-cell suppression (CBS statistical-disclosure-control methodology). Below this threshold, no aggregate is rendered.
- Team Wellbeing aggregates (visible to teammates only, never to the employer): require 30% proportional opt-in with a floor of 3 participants per group. The floor is binding — a team of 7 with 30% participation (≈ 2 participants) does not surface an aggregate.
- Database-level enforcement: the Employer Firewall is enforced in Firestore Security Rules, not only in dashboard UI. The same rule set blocks employer-side queries that would attempt to retrieve individual records.
- Daily-snapshot retention: Team Wellbeing daily snapshots are retained 90 days with automated TTL cleanup.
6. Retention
| Data category | Retention period |
|---|---|
| Account data | Until account deletion or end of Service Agreement, plus 2 years for legal-claim defence |
| Activity, sleep, and mood data | 3 years after last activity (automated enforcement scheduled for Q3 2026; until then, deletion on request via support@mindsetor.com) |
| Risk scores and insights | Duration of account |
| Care Hub clinical session notes | 20 years from last entry — Art. 6(1)(c) + Art. 9(2)(h) GDPR; Dutch WGBO Art. 7:454 BW (as amended effective 1 January 2020) |
| Care Hub booking metadata | Duration of account |
| Gamification data | Duration of account |
| Aggregated employer reporting | Duration of Service Agreement |
| Audit logs (compliance) | Indefinite — Art. 6(1)(f) read with Art. 5(2) accountability |
The Mindsetor Pseudonymisation and Anonymisation Procedure (`docs/gdpr/anonymisation_procedure.md`) describes the technical and organisational steps that enforce these retention periods once Workstream C1 ships in Q3 2026. Until then, retention is enforced via per-request deletion handled within GDPR Art. 12(3) timelines.
7. Data-subject rights (GDPR Articles 15-22, 77)
Users can exercise the following rights directly with Mindsetor at support@mindsetor.com:
- Right of access (Art. 15): request a copy of personal data processed by Mindsetor. In-app account settings provide a primary view; full export by email.
- Right to rectification (Art. 16): correct inaccurate or incomplete data. In-app profile editing handles most cases.
- Right to erasure (Art. 17): request deletion. The in-app "Delete Account" function executes the erasure path; the Care Hub clinical-notes 20-year WGBO retention obligation is the only exception, and is honoured under Art. 17(3)(b).
- Right to restriction (Art. 18): request that processing be paused pending review.
- Right to data portability (Art. 20): receive a machine-readable JSON export of personal data by emailing support@mindsetor.com.
- Right to object (Art. 21): object to processing on legitimate-interest grounds (the audit-trail processing under Art. 6(1)(f) is the relevant basis).
- Right not to be subject to a solely automated decision (Art. 22): Mindsetor's risk engine is informational; outputs are not used to make employment-related decisions. Users may request human review by booking a Care Hub session.
- Right to withdraw consent (Art. 7(3)): consent can be withdrawn at any time; withdrawal stops processing under that consent prospectively.
- Right to lodge a complaint (Art. 77): with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl.
Mindsetor responds within one month per GDPR Art. 12(3); complex requests may extend by up to two further months with reasoned notice within the first month.
8. Personal data breach notification (Art. 33-34)
Mindsetor as sole controller notifies the Autoriteit Persoonsgegevens under Art. 33(1) without undue delay and in any event within 72 hours of becoming aware of a personal data breach likely to result in a risk to the rights and freedoms of natural persons. Affected data subjects are notified directly under Art. 34 where the breach is likely to result in a high risk to their rights and freedoms.
Mindsetor will additionally inform the Customer in good faith for transparency where (a) the breach materially affects the Customer's workforce or service continuity, or (b) the Customer has a separate Arbowet duty triggered by the incident. This is not an Art. 33(2) processor-to-controller notification (no such relationship exists) — it is operational courtesy.
The full procedure is documented in the Mindsetor Breach Response Procedure (`docs/gdpr/breach_response_procedure.md`), aligned to Art. 33(1) "likely to result in a risk" trigger and Art. 33(5) breach register; a procurement copy is available on request.
9. International transfers
Personal-data primary processing occurs in the EU (`europe-west1`, Belgium). Transfers to USA-located sub-processors (Agora, Firebase Cloud Messaging where US infrastructure is involved, Garmin) are made under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Standard Contractual Clauses Module 2 (controller-to-processor), supplemented where applicable by the recipient's certification under the EU-US Data Privacy Framework. Transfer impact assessments are documented internally and available on request.
10. Audit and assurance
Mindsetor will respond to reasonable customer information requests in support of the Customer's own accountability obligations, including:
- This Schedule (current version always available at the canonical URL).
- Sub-processor register (current version published).
- Mindsetor Information Security Policy (`docs/compliance/information-security-policy.md`).
- Mindsetor Data Protection Impact Assessment (DPIA, `web/dpia.html`).
- Mindsetor Article 30 Record of Processing Activities (ROPA) — extracts on request under NDA.
- CSA CAIQ self-assessment.
- Annual penetration-test executive summary, on request under NDA.
- NIS2 / Dutch Cbw scope assessment (`docs/compliance/nis2_scope_assessment.md`).
- Disaster recovery and business continuity plan.
For procurement teams whose internal playbook requires a bilateral on-site audit, Mindsetor accepts reasonable on-site or remote audits with at least 30 days' written notice, at the Customer's cost, no more than once per twelve-month period (or as needed in response to a documented incident), conducted in a way that does not unreasonably interfere with Mindsetor's operations or compromise the confidentiality of other customers' data. SOC 2 Type II / ISO 27001 third-party audits are planned for 2027 once enterprise demand and revenue support an external programme; until then, the documents above (and a CSA CAIQ self-assessment) substitute for third-party certification.
11. NIS2 / Cbw posture
Mindsetor is not directly in scope of NIS2 / the Dutch Cybersecurity Act (Cbw). It supports its Customers' supply-chain compliance with their own NIS2 obligations through: incident notification (per §8 above; NIS2 24-hour early warning + 72-hour full notification timelines documented in `docs/compliance/incident_response_nis2.md`), the technical and organisational measures in §4, the audit and assurance access in §10, and the sub-processor change-notification mechanism in §3. A formal NIS2 scope assessment is documented internally and shared on request.
12. Term and changes to this Schedule
This Schedule applies for the term of the Master Service Agreement to which it is attached. Mindsetor may update this Schedule from time to time to reflect changes in law, sub-processors, or technical and organisational measures. Material changes are communicated by email to the Customer's designated contact at least 30 days in advance, with a right of objection on the same terms as for sub-processor changes (§3). The current version is always available at mindsetor.com/data-handling-annex; the version attached to the signed MSA is the version that applies if the Customer does not accept a subsequent update.
13. Contact
All data-protection inquiries: support@mindsetor.com.
Mindsetor has not designated a Data Protection Officer under GDPR Art. 37(1). The formal assessment, applying the EDPB Guidelines 4/2017 four-factor "large-scale" test, is documented internally and available on request; David Chakrian (Founder & Director) is the documented data-protection escalation point.