May 06, 2026
Data Provider Terms of Use
Last Updated: May 06, 2026
These Data Provider Terms of Use (the “Terms”) govern your access to, use of and participation in Mozilla Data Collective, the online data sharing platform and marketplace, and related services (collectively, the “Platform”) made available by Mozilla Data Collective LTD, a company registered in England and Wales with company number 17054959, whose registered address is at 167-169 Great Portland Street, London, W1W 5PF, or any of its subsidiaries and affiliates (“MDC”, “we”, “our”, or “us”).
These Terms are a legally binding agreement between MDC and the person or entity registering as a data supplier (“you” or “Data Provider”). If you are entering into these Terms on behalf of a company, organization or similar entity, you are agreeing to these Terms for that entity and representing that you have the authority to bind such entity to these Terms.
Except for Section 16 which provides for binding arbitration, we reserve the right to update or modify these Terms from time to time in our discretion, including as required for valid business, legal, regulatory, security, or compliance reasons. If we make material changes that affect your rights or obligations in a manner reasonably likely to be detrimental to you, we will provide you with advance notice of such changes by reasonable means (such as email or notification when you log in to your account). We will not make material changes that unreasonably or disproportionately disadvantage you as a Data Provider without your prior consent, except where such changes are necessary to comply with applicable law or regulation. Your continued use of the Platform following the effective date of any changes to these Terms constitutes your acceptance of those changes. If you do not agree to the new Terms, do not use the Platform.
a. Acceptance of Terms. By registering for, accessing or using the Platform, you accept and agree to be bound and abide by these Terms and our Privacy Policy, which is incorporated herein by reference. If you do not agree to be bound by these Terms or any provisions hereof, do not access or use the Platform.
b. Use and Eligibility. You may only use the Platform if you can form a binding contract with MDC (either on behalf of yourself or the entity you represent), and only in compliance with these Terms and all applicable laws and regulations. By accessing or using the Platform, including by registering a User Account (defined below), you represent and warrant that (A) you are at least 18 years of age, (B) you will use the Platform in accordance with the Agreement and all applicable local, state, national and international laws, rules and regulations, and (C) if registering on behalf of a company, organization or other entity, you are an authorized representative of the entity and have the authority to bind such entity to these Terms. The Platform is not available to any users previously removed from the Platform by MDC.
c. Data Provider Account. In order to use the Platform, you will be required to register for an account (“Account”) on behalf of yourself and/or on behalf of any entity or individual for which you are registering. You are responsible for ensuring that (A) all required registration information you submit is truthful and accurate, and (B) your contact information is current. You are solely responsible for maintaining the confidentiality and security of your Account login information. You agree not to share your login credentials or access to your Account with anybody or to create more than one Account (except to the extent you are registering on behalf of yourself as an individual Data Provider, and separately, on behalf of an entity). We are not liable for any losses incurred by you or any party as a result of unauthorized use of your Account. You agree to notify us immediately via email to support@mozilladatacollective.com of any unauthorized use of your Account.
a. Permitted Use of the Platform. We operate the Platform as an online data sharing platform and marketplace that enables data suppliers to list, describe and provide access to their datasets, which may include, without limitation, voice recordings, audio and text data, numbers, images, documents, video, geospatial data, and other computer vision and/or multimodal datasets (the “Datasets”) for lawful use by certain third-party users (“End Users”). The Platform facilitates the discovery, access, and, where applicable, the hosting and delivery of Datasets, but does not itself license your Dataset to End Users – all licensing occurs directly between you and the End User under your chosen license terms. Subject to your continued compliance with these Terms and all applicable laws, you may use the Platform to: (i) list and describe your Dataset, (ii) provide Hosted Data to use for access by End Users via the Platform or, subject to available functionality in the Platform, provide access to Externally-Hosted Data, as applicable, (iii) define the license terms applicable to your Dataset (subject to Section 2(b) below), and (iv) engage with End Users of your Dataset.
b. End User License. You are solely responsible for licensing your Dataset directly to End Users under your own license terms (“End User License”). You acknowledge and agree that your End User License with each End User is solely between you and that End User, and we are not a party to, and will have no responsibility or liability under, any such End User License.
c. End User Disputes and Release. Your sole recourse for any breach or violation by an End User of your End User License, or for any other dispute, is against the applicable End User. You agree that you are responsible for enforcing your End User License against End Users and addressing any breach of your End User License; however, you agree to provide us prompt notice of any breach, or suspected breach, of your End User License by an End User so that we may pursue any remedies available to us with respect to End User’s access to and use of the Platform. For the avoidance of doubt, we reserve the right, but have no obligation, to monitor End User compliance with your End User License, or to take any enforcement action on your behalf. To the fullest extent permitted by law, you hereby release and forever discharge MDC, our affiliates and our respective officers, directors, employees, contractors and agents from any and all claims, demands, liabilities, damages, losses, costs and expenses, whether known or unknown, arising out of or relating to any End User’s breach of the End User License or any dispute between you and an End User.
d. No Endorsement or Guarantee by the Platform. We provide the Platform as a technical and administrative infrastructure to facilitate the listing, discovery, hosting (if applicable), and/or access to your Data by End Users. We do not endorse, or guarantee the accuracy, completeness, legality, or quality of your Data; however, we reserve the right to review and/or screen Data prior to its inclusion on the Platform.
e. Data Provider Warranties. You represent and warrant that: (i) you have all rights, licenses, permissions and consents necessary to upload, make available and license the Dataset to End Users through the Platform; (ii) your Dataset does not infringe, misappropriate or violate any copyright, trademark, trade secret, moral rights or other proprietary or intellectual property rights, or rights of privacy or publicity, or any other rights of any third-party; (iii) you have obtained all legally-required consents for the use, disclosure and processing of any personal data (as such term is defined under applicable privacy and data protection laws) contained in your Dataset; (iv) your Dataset has been collected, processed and prepared in accordance with appropriate ethical standards and safeguarding protocols, and consistent with generally-accepted best practices, including without limitation: (A) ensuring participants, contributors or data subjects were treated fairly, respectfully and in a manner consistent with applicable ethical guidelines; (B) implementing measures to protect vulnerable individuals or groups, and to prevent exploitation, abuse or harm in the data collection process; and (c) complying with applicable laws, regulations, and industry best practices regarding research ethisc, human subjects and safeguarding; and (iv) your Dataset and your collection thereof, and your submission of your Dataset to the Platform, complies with all applicable laws and regulations, including privacy and data protection laws.
f. Hosted Data. If you choose to store a Dataset on our servers (“Hosted Dataset”), the Hosted Dataset includes the Dataset and any associated metadata, documentation, descriptions, tags, schemas and other information submitted or made available by you in connection with such Dataset, including via the Data Sheet (defined below). You grant us, our affiliates and service providers an exclusive (unless otherwise agreed to), worldwide, royalty-free license to collect, store, maintain, reproduce, host, transmit, index, analyze, and otherwise process your Hosted Dataset to operate, improve and support the Platform (including its search and discovery functionality) and provide access to the Hosted Dataset to your End Users in accordance with your license terms. You further grant us the right to create, generate and use derivative datasets, metadata, embeddings, indexes and other transformations or outputs derived from the Hosted Datasets (“Derivative Datasets”) solely as necessary to provide, maintain and improve the Platform and to fulfill End User requests or interactions initiated through the Platform.
If you wish to opt out of the exclusivity component of the foregoing licensing obligation, you must indicate your election to do so during the upload process and identify the non-exclusive Datasets, and relevant information related thereto, in the dataset details section of the form made available to you during that process (the “Data Sheet”). In the event you opt out of exclusivity with respect to your Dataset(s), the terms and conditions set forth in Appendix 1, attached hereto and incorporated by reference herein, will apply to the Non-Exclusive Datasets (as such term is defined in Appendix 1). If at any point you wish to revoke the exclusivity of your uploaded Dataset, you must provide written notice to us at support@mozilladatacollective.com and wait for a response.
g. Externally-Hosted Dataset. If you store your Dataset on third-party servers (“Externally-Hosted Dataset”), you remain solely responsible for hosting, availability, and security of the Externally-Hosted Dataset. We may provide access facilitation or linking to the Externally-Hosted Dataset, but do not take possession of the Externally-Hosted Dataset.
h. Platform Disclaimers. We are not responsible, and expressly disclaim liability, for: (i) ensuring that End Users comply with your license terms, or monitoring or enforcing any use restrictions you place on your Dataset; (ii) any damages, claims or liabilities arising from use of your Dataset; or (iii) verifying the accuracy, completeness, legality, quality or appropriateness of your Dataset.
a. Prohibited Uses of Platform. In using the Platform, you agree that you shall not, and shall not encourage, assist or enable any other third party to: (i) reproduce, duplicate, modify, copy, distribute, transmit, display, sell, transfer, publish, create derivative works from or otherwise exploit for any purpose the content, software, or data not provided to the Platform by you that is found on the Platform; (ii) engage in any activity that could cause us to violate any applicable law, statute, ordinance, or regulation; (iii) engage in any conduct that is fraudulent, inaccurate, infringing, libelous, defamatory, abusive, offensive, obscene, or otherwise violates any law or right of MDC, its End Users, or any third party, including privacy rights, copyrights, or other intellectual property rights; (iv) remove or modify any copyright, trademark, or other proprietary rights notice that appears on any portion of the Platform, or on any materials printed or copied from the Platform; (v) copy, distribute, or disclose any part of the Platform in any medium, including without limitation by any automated or non-automated “scraping”; (vi) copy, scrape, download or otherwise acquire any Dataset or portion thereof, not provided by you, from the Platform for the purpose of (A) mirroring, duplicating or reproducing the Dataset in whole or in substantial part, (B) hosting, storing or making the dataset available on any platform, server or repository other than the Platform, or (C) replicating a website or service that is similar or competitive to the Platform; (vii) use automated tools, scripts, bots, crawlers or similar technologies to systematically access, extract or index Datasets with the intent to republish or redistribute them outside of the Platform; (viii) circumvent or bypass any technical measures that control access to Datasets or limit their download, reproduction or redistribution; (ix) circumvent, bypass or manipulate Rate Limits (defined below), or any other access control, approval gate, or throttle mechanism implemented by MDC in connection with the MDC API (defined below); (x) take action that imposes, or may impose, in the discretion of MDC, an unreasonable or disproportionately large load on the MDC's infrastructure; (xi) collect or manually harvest any personal data, outside of any permitted use, as applicable, hereunder, from the Platform; (xii) resell or make any commercial use of the Platform except as authorized hereunder without our prior written consent; (xiii) interfere with the proper working of the Platform; (xiv) access any content on the Platform through any technology or means other than those provided or authorized by the Platform; or (xv) access the Platform to build a similar or competitive website, application, product, or service.
b. Prohibited Data Content. Except as expressly approved in writing by MDC under the exception approval process described in Section (c) below, you must not upload, transmit, link to, or otherwise make available on or through the Platform any Dataset that contains or consists of any of the following: (i) personally-identifiable information (“PII” or “personal data”), (ii) content or data that could reasonably be used to create biometric identifiers or biometric information, (iii) protected health information (“PHI”), (iv) any personal data relating to individuals under the age of 18 (or the age of majority in the applicable jurisdiction), (v) copyright- or IP-infringing material), (vi) toxic, hateful or harassing content, (vii) unlawful or harmful material, (viii) malware or harmful code, (ix) any Dataset that is subject to the U.S. ITAR or other defense/military-specific controls, or (ix) any Data that requires us to obtain any license or other governmental authorization.
c. Exception Approval Process. If you seek to upload a Dataset that contains data elements listed in Section 3(b) above for legitimate purposes (such as for research or training lawful AI/ML models), you must submit a written request to MDC at support@mozilladatacollective.com describing: (i) the nature of the Dataset, (ii) the lawful basis for its inclusion on the Platform, (iii) all applicable consents, licenses and/or permissions obtained, and (iv) the safeguards you have implemented to protect the rights and safety of affected individuals. MDC may, in its sole discretion, approve or deny such requests and may impose additional conditions, such as access restrictions, anonymization or specific security requirements. Any approval must be in writing and is valid only for the specific Dataset and use case described in your request.
d. Dataset Removal and Enforcement. We may remove or restrict access to Hosted Dataset, or restrict or disable access to Externally-Hosted Dataset, at any time, with or without notice, if we believe such Dataset violates this Section 3. You remain solely responsible for any claims, damages, liabilities or regulatory actions arising from your Dataset.
e. Off-Platform Engagement. You may not engage in off-Platform communications, interactions or transactions with End Users in order to circumvent these Terms, or any applicable payment requirements.
a. Dataset Submission via Platform Interface. You may submit Datasets for listing on the Platform through the web-based submission form made available to you by MDC (the “Submission Form”). By completing and submitting the Submission Form, including manually checking all required acknowledgement and consent boxes prior to submission, you confirm your agreement to all applicable submission disclosures and terms presented at the time of such submission. Each submission via the Submission Form constitutes a valid electronic signature and shall have the same legal force and effect as a written signature.
b. API-Based Submission and Electronic Assent. In addition to the Submission Form, MDC may make available an application programming interface (API) for Data Providers to submit Datasets programmatically (the "MDC API”). Access to the MDC API is subject to prior approval by MDC and is conditioned on your continued compliance with these Terms. Submission of a Dataset via the MDC API, including the transmission of the required consent and attestation fields within the API payload, constitutes a valid electronic signature and shall have the same legal force and effect as manually completing and submitting the Submission Form, including your acknowledgement of and agreement to all applicable submission disclosures and terms presented at the time of submission. Each Dataset submission via the MDC API must include either (i) the then-current terms version identifier as specified in MDC’s API documentation, or (ii) a timestamp reflecting the time at which you agreed to the then-current terms, in each case as specified in MDC’s API documentation (collectively, “Submission Attestation Fields”). Submissions that do not include valid Submission Attestation Fields will be rejected as invalid. You acknowledge and agree that MDC’s records of the applicable terms in effect at the time reflected by such timestamp (including for submissions via the MDC API or through web-based forms or interfaces) will be used to determine the governing terms for the applicable Dataset submission. You represent and warrant that each Dataset submission via MDC’s API made using your credentials is authorized by you and reflects your agreement to the disclosures and terms applicable to that submission.
c. API Credentials; Security; Non-Repudiation. MDC will issue API credentials, including API keys or tokens, to you for use in connection with the MDC API (“API Credentials”). You are solely responsible for maintaining the confidentiality and security of your API Credentials and for all activity conducted through the MDC API using your API Credentials, regardless of whether you authorized such activity. You agree not to share, transfer, disclose or sublicense your API Credentials to any third party, and to promptly notify us upon becoming aware of any unauthorized access to or use of your API Credentials. MDC shall have no liability arising from unauthorized use of your API Credentials. All submissions and actions performed using your API Credentials are attributable to you and shall be binding upon to the same extent as actions taken directly through the Submission Form.
d. Logging and Monitoring. MDC reserves the right to log, monitor and retain records of API requests and responses, including metadata associated with each submission, for purposes of security, abuse prevention, quality assurance and compliance. Such logs may include, without limitation, timestamps, submission identifiers, Submission Attestation Fields, and associated account information. You acknowledge and consent to such logging as a condition of access to the MDC API, and agree that such records may be used by MDC in connection with any dispute, audit or enforcement action arising from your use of the MDC API.
e. Rate Limits. MDC reserves the right to implement and enforce limits on MDC API upload calls (the “Rate Limit”), and may update such Rate Limit from time to time. Any attempt to exceed the Rate Limit or bypass approval or authentication requirements is a material breach of these Terms. We reserve the right to suspend or revoke your API Credentials, restrict your access to the MDC API, or suspend or terminate your Account in the event of any actual or suspected misuse of the MDC API, unauthorized access attempts, Rate Limit violations or other conduct inconsistent with these Terms. For the avoidance of doubt, suspension for any of the foregoing reasons does not affect your obligations under these Terms with respect to prior Dataset submissions or any outstanding obligations to End Users.
a. Platform License Grant. Subject to the terms and conditions herein, we grant you a limited, revocable, non-sublicensable, non-exclusive, non-transferable, non-assignable license to access and use the Platform solely for the permitted uses described herein.
b. Rights in the Platform. As between you and MDC, the Platform, including without limitation any technology, interface, content (excluding Datasets), graphics, sound, artwork, software, computer code, logos, patents, trademarks, service marks, copyrights, and all the intellectual property rights therein or relating thereto, and any derivative works, modifications or improvements of any of the foregoing are and shall remain the exclusive property of MDC. MDC reserves all rights in the Platform not expressly granted herein.
c. Rights in the Dataset. As between Data Provider and MDC, Data Provider (or its licensors, as applicable) owns the Dataset. MDC does not obtain any ownership rights in the Dataset. For the avoidance of doubt, this Section does not apply to Datasets that MDC owns and makes available directly through the Platform, in which case MDC retains all applicable ownership rights in such Datasets.
d. Feedback. From time to time, you may provide us with comments, suggestions, or ideas for enhancements, improvements, changes, or additions to the Platform or our business in general, including ideas for new features, materials, and other content (“Feedback”). By providing us Feedback, you grant to us a worldwide, perpetual, irrevocable, royalty-free, sublicensable license to use, copy, modify, distribute and incorporate the Feedback into the Platform and our products, services and documentation, in any form and for any purpose (including commercial purposes). MDC has no obligation to do anything with Feedback, but if we do, we may do so without notice, acknowledgement or compensation to you. For clarity, the foregoing license does not affect your (or your licensors’) ownership of any pre-existing intellectual property in your own products, services or Datasets that may be included in the Feedback.
EXCEPT AS EXPRESSLY SET OUT IN THESE TERMS, AND SUBJECT TO APPLICABLE LAW, THE PLATFORM IS PROVIDED ON AN “AS AVAILABLE” BASIS. MDC DOES NOT WARRANT THAT THE PLATFORM WILL BE UNINTERRUPTED, ERROR-FREE OR AVAILABLE AT ALL TIMES. NOTHING IN THESE TERMS LIMITS OR EXCLUDES LIABILITY THAT CANNOT BE LAWFULLY LIMITED OR EXCLUDED, INCLUDING LIABILITY FOR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE, FRAUD OR FRAUDULENT MISREPRESENTATION. SUBJECT TO THE FOREGOING, ALL IMPLIED TERMS ARE EXCLUDED TO THE FULLEST EXTENT PERMITTED BY LAW.
a. Security Measures. MDC will implement and maintain administrative, physical, and technical safeguards that: (i) meet or exceed industry standards for the type, sensitivity, and volume of the Dataset you provide; (ii) protect against unauthorized access to, or use, destruction, loss, alteration, or disclosure of, the Dataset; and (iii) comply with all applicable privacy, data protection, and information security laws and regulations. These safeguards include:
Access controls such as authenticated downloader accounts and individual access gates
Encryption of the Dataset at rest and in transit
Regular vulnerability scanning and patching
Secure software development and deployment practices
Logging and monitoring of access and system activity
Comprehensive business continuity and disaster recovery plans
b. Hosting Responsibility. For Hosted Datasets, you remain responsible for ensuring your Dataset is encrypted in accordance with generally accepted industry standards and free from malicious code before uploading or transmitting to the Platform, and for configuring access controls consistent with your End User license terms. For Externally-Hosted Datasets, you are solely responsible for the security, availability and access controls for such Dataset and the hosting environment, and must ensure the hosting environment meets the security requirements set out in 7(a) above.
c. Data Privacy. For more information on MDC’s privacy practices, please refer to our Privacy Policy. To the extent MDC processes Personal Data (as such term is defined in the DPA) in connection with Datasets you upload, such processing shall be in accordance with MDC’s Data Processing Agreement (the “DPA”), which is incorporated by reference herein.
a. Modification. MDC reserves the right at any time to modify or discontinue, temporarily or permanently, the Platform (or any part thereof), with or without notice. Except as otherwise expressly stated in these Terms, you agree that MDC shall not be liable to you or to any third-party for any modification, suspension, or discontinuation of the Platform.
b. *Account Suspension or Termination. We may limit, suspend or terminate your Account or access to the Platform: (i) if you breach these Terms; (ii) to comply with applicable laws or legal obligations; or (iii) if necessary to protect the integrity of the Platform.
c. Account Cancellation. You may cancel your use of the Platform and/or terminate your Account at any time by emailing us at support@mozilladatacollective.com. Please see our Privacy Policy for information regarding data deletion requests following Account cancellation or termination.
a. Dataset Fees. As a Data Provider, you may, in your sole discretion, establish and charge fees for access to and use of each of your Dataset(s) made available through the Platform (“Dataset Fee”). You are solely responsible for setting, updating and communicating the Dataset Fees applicable to each Dataset you list on the Platform, and any modifications to Dataset Fees will apply to transactions completed on or after the effective date of such modification. Dataset Fees will be collected from End Users at the time of purchase and remitted to you by our payment processor, Stripe, Inc. (the “Payment Processor”) in accordance with the payout terms set forth herein, net of the applicable Platform Fee (defined below). You acknowledge that MDC has no responsibility for the collection, enforcement or dispute resolution of Dataset Fees beyond facilitating payment processing through the Payment Processor.
b. Platform Fees. MDC will charge a platform service fee to End Users for use of the Platform in connection with such End User’s purchase of your Dataset (“Platform Fee”) in the amount of five percent (5%) of the Dataset Fee you establish for such Dataset, prior to any deduction for taxes, refunds or payment processing fees. The Platform Fee is bundled with the applicable Dataset Fee into a single total Price presented to the End User at checkout (collectively, the “Fees”), and is automatically deducted and distributed to MDC by Payment Processor at the time of settlement via split payment, without any separate invoicing or remittance obligation on your part. MDC reserves the right to modify the Platform Fee percentage at any time in its sole discretion. Any modification to the Platform Fee will be communicated to you via notice posted to the Platform and will be effective thirty (30) days following such notice, and will apply to all transactions completed on or after the effective date of such modification. Continued use of the Platform following the effective date of any modification constitutes acceptance of the updated Platform Fee.
c. Payout Terms and Remittance. Dataset Fees owed to you are remitted net of the applicable Platform Fee, which is automatically deducted by Payment Processor at the time of settlement via split payment prior to disbursement to you. You will receive the Dataset Fees less any applicable payment processing fees charged by the Payment Processor for which you are responsible, with no separate remittance obligation to MDC. The cadence and timing of payouts are governed by the payout schedule configured in your Stripe account, as set forth in Payment Processor’s applicable terms of service, and may be managed by you through your Stripe dashboard in accordance with available payout options. MDC makes no representations regarding the timing of any specific payout, and any delays or modifications to payout schedules attributable to Payment Processor are governed by Payment Processor’s terms and policies. MDC shall have no liability for any payout delays or failures attributable to Payment Processor or to incomplete, inaccurate or non-compliant account information provided by you.
d. MDC’s Role. MDC operates solely as the Platform and payment facilitation intermediary, connecting End User and Data Providers through the Platform. MDC is not a party to any transaction between you and any End User, and is not responsible for acts or omissions of the Payment Processor. Without limiting the foregoing, MDC shall have no liability for any payment processing errors, failed or misdirected transfers, unauthorized charges, delays, outages or service failures attributable to Payment Processor, whether arising from Payment Processor’s systems, terms or policies. Any issues arising from the processing or distribution of payments should be directed to the Payment Processor in accordance with its applicable terms.
e. Taxes. Each of us is solely responsible for all taxes, levies and other governmental charges applicable to our respective organizations, income and activities in connection with the Platform. You are responsible for reporting and remitting all taxes arising from Dataset Fees earned through the Platform. MDC is responsible for reporting and remitting all taxes applicable to the Platform Fees it retains. With respect to taxes applicable to the transaction between you and an End User, including sales tax, use tax, value-added tax (VAT), goods and services tax (GST) or similar taxes that may be imposed on the sale or license of Datasets (collectively, “Transaction Taxes”), you are solely responsible for determining, collecting, and remitting all such Transaction Taxes applicable to transactions involving your Dataset(s). MDC assumes no responsibility for the calculation, collection or remittance of any Transaction Taxes on your behalf, and you agree to indemnify and hold harmless MDC from any claims, penalties, liabilities or losses arising from your failure to satisfy your Transaction Tax obligations.
f. Refunds. Refunds for transactions conducted through the Platform are handled off-Platform directly between you and the applicable End User. MDC does not adjudicate, mediate or process refund requests on behalf of either the End User or you, and assumes no liability for the outcome of any refund dispute.
You agree at your own expense, to indemnify, defend, and hold harmless MDC and its affiliates, agents, licensors, managers, and other affiliated companies, and their employees, contractors, agents, officers and directors, from and against any and all claims, damages, obligations, losses, liabilities, costs or debt, and expenses (including but not limited to attorney’s fees) incurred in, arising out of or in any way related to: (i) your breach of these Terms; (ii) your (or any other user’s use of your User Account) use of or access to the Platform; (iii) any dispute between you and any End User; (iv) your violation of any applicable law, rule or regulation; (v) a Security Incident caused by your systems, personnel, API Credentials, Dataset(s) or acts or omissions; and (vi) your negligence or willful misconduct.
a. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL MOZILLA, ITS AFFILIATES, AGENTS AND/OR EMPLOYEES BE RESPONSIBLE OR LIABLE FOR ANY DIRECT, INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL LOSS, CLAIM, INJURY AND/OR DAMAGE ARISING OUT OF, OR IN ANY WAY CONNECTED WITH, THE AGREEMENT, YOUR USE OF THE PLATFORM, OR FOR ANY DATASET, INFORMATION, AND SOFTWARE OBTAINED THROUGH THE PLATFORM, OR ANY FAILURE OR DELAY, OR THE PERFORMANCE OR NON-PERFORMANCE BY MOZILLA, WHETHER BASED ON CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE, EVEN IF MDC HAS BEEN ADVISED OF THE POSSIBILITY OF ANY LOSS, CLAIM, INJURY AND/OR DAMAGE.
b. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL MOZILLA, ITS AFFILIATES, AGENTS AND/OR EMPLOYEES BE LIABLE TO YOU FOR ANY CLAIMS, LIABILITIES OR DAMAGES HEREUNDER IN AN AMOUNT EXCEEDING THE AMOUNT PAID BY YOU TO MDC DURING THE TWELVE (12) MONTH PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR THE DURATION OF YOUR USE OF THE PLATFORM, OR, IF GREATER, ONE HUNDRED GBP (£100).
c. NOTWITHSTANDING (a) AND (b) ABOVE, NOTHING IN THESE TERMS LIMITS OR EXCLUDES LIABILITY FOR DEATH OR PERSONAL INJURY CAUSED BY NEGLIGENCE, FRAUD OR FRAUDULENT MISREPRESENTATION, OR ANY OTHER LIABILITY THAT CANNOT BE LAWFULLY LIMITED OR EXCLUDED.
The Platform may contain links to third-party materials or websites that are not owned or controlled by MDC. MDC does not endorse or assume any responsibility for any such third-party sites, information, materials, products, or Platform. If you access a third-party website or service from the Platform or share your information or data on or through any third-party website or service, you do so at your own risk, and you understand that this Agreement and MDC's Privacy Policy do not apply to your use of such sites. You expressly relieve MDC from any and all liability arising from your use of any third-party website, service, or content, including without limitation content, data, information and/or materials submitted by other users.
MDC respects the intellectual property rights of others, is committed to complying with all applicable copyright and related laws, and expects its data providers to do the same. By using the Platform, you agree not to upload, provide or otherwise make available any Data that infringes the copyrights or other intellectual property rights of any third party.
If you believe that material on our Platform infringes your copyright or other intellectual property rights under UK law, you may submit a written notice to our designated MDC Copyright Agent. To be valid, your notice must include:
a description of the copyrighted work that you claim has been infringed;
a description of where the material that you claim is infringing is located on the site or other Platform;
your address, telephone number and email address;
a statement by you that you have a good faith belief that the disputed use is not authorized by the copyright owner, its agent or the law;
an electronic or physical signature of the person authorized to act on behalf of the owner of the copyright or other intellectual property interest, as applicable; and
a statement by you, made under penalty of perjury, that the above information in your notice is accurate and that you are the copyright owner or authorized to act on such owner’s behalf.
MDC’s Designated DMCA Agent (Copyright Agent):
167-169 Great Portland Street, London, W1W 5PF
phone: +44 020 8323 3876
email:copyright@mozilladatacollective.com
Upon receipt of a valid notice, we will review it and, where we determine it is appropriate to do so, act expeditiously to remove or disable access to the material in question. If we remove or disable access in response to such a notice, or plan to, we may forward your notice and related communications to the user responsible for the content so that they can object to your request.
We reserve the right to restore the material if we determine that a notice was submitted in error or in bad faith, or following a successful counter-notice (see below).
If you believe that material you posted was removed in error, you may submit a written counter-notice to our designated MDC Copyright Agent. Your counter-notice must include:
your address, telephone number and email address;
identification of the material that was removed and the located where it appeared before removal;
a statement made in good faith that you believe the material was removed as a result of a mistake or misidentification; and
your physical or electronic signature.
Upon receipt of a valid counter-notice, we may, at our discretion, restore the material after providing notice to the original complainant.
Submitting a notice or counter-notice that contains false information may give rise to civil liability under UK law, including for damages, costs and losses suffered as a result.
You remain responsible for ensuring that any Data you provide to the Platform is properly licensed and does not infringe or misappropriate any third-party rights.
You agree that you are solely responsible for your interactions, communications and transactions with any End User, other data supplier or other third party in connection with the Platform, and any disputes arising therefrom. MDC will have no liability or responsibility with respect thereto. MDC reserves the right, but has no obligation, to monitor and/or become involved in any way with such disputes.
You represent and warrant that you will at all times comply with all applicable export control, re-export, and sanctions laws and regulations of the United States, the European Union, the United Kingdom, the United Nations, and any other relevant governmental authority (“Export Control Laws”), including without limitation the U.S. Export Administration Regulations (EAR), the U.S. International Traffic in Arms Regulations (ITAR), and regulations administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC). By using the Platform, you represent and warrant that (i) you are not located in, and you are not a national or resident of, a country that is subject to a U.S. Government embargo, or that has been designated by the U.S. Government as a "terrorist supporting" country and (ii) you are not listed on any U.S. Government list of prohibited or restricted parties. You acknowledge and agree that we may block, suspend, or terminate your access to the Platform in our discretion to ensure compliance with applicable laws.
Informal Resolution. If a dispute arises out of or in connection with these Terms, the Platform, or any transaction or relationship contemplated herein, the parties shall first attempt to resolve the matter informally. Either party may initiate informal resolution by providing written notice to the other party identifying the nature of the dispute and the resolution sought. The parties agree to negotiate in good faith for a period of not less than thirty (30) days from the date of such notice (or such longer period as the parties may agree in writing) before pursuing any other form of dispute resolution ("Informal Resolution Period"). For operational or lower-value disputes, the parties may agree to conduct informal resolution discussions by telephone, video conference, or other convenient means, and, except for the initial written notice, no formal written correspondence shall be required throughout the Informal Resolution Period for such disputes.
Mandatory Mediation. If a dispute is not resolved by the end of the Informal Resolution Period, the parties shall first attempt in good faith to resolve it by non-binding mediation before commencing court proceedings, except where urgent interim relief is required, including to protect confidentiality, intellectual property, data, security, preserve evidence, or avoid prejudice arising from a limitation period or other mandatory deadline. The mediation shall be conducted in London, England, in English, before a mediator agreed by the parties or, failing agreement within 10 business days, appointed by CEDR at either party’s request. The mediation shall take place within 30 business days after a written request for mediation, unless otherwise agreed. Costs shall be shared equally unless otherwise agreed. The mediation shall be without prejudice and confidential, except where disclosure is required by law or to enforce a settlement. If the mediation does not take place within that period other than due to a party’s default, or the dispute is not resolved within 10 business days after the mediation, either party may commence court proceedings..
Court Access Preserved. Subject to the foregoing, each party retains the right to commence proceedings before a court of competent jurisdiction in respect of any dispute arising out of or in connection with these Terms. MDC and Data Provider each irrevocably submit to the exclusive jurisdiction of the courts of England and Wales for the resolution of any such dispute, subject to the right of either party to seek urgent or interim relief from any court of competent jurisdiction without prior notice or compliance with the informal resolution or mediation steps set out above.
Governing Law. These Terms and any dispute or claim arising out of or in connection with them or their subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales.
a. Entire Agreement. These Terms, the Privacy Policy and any other policies or guidelines referenced within these Terms constitute the entire agreement between you and MDC, and supersede any prior and contemporaneous agreements between you and MDC on the subject matter.
b. Relationship of the Parties. Nothing in these Terms creates any agency, partnership, joint venture, or employment relationship between you and MDC. We act solely as a service provider facilitating interactions between you and End Users.
c. Force Majeure. Under no circumstances will MDC be liable for any delay or failure in performance resulting directly or indirectly from an event beyond its reasonable control.
d. No Waiver. No waiver of any term of the Agreement shall be deemed a further or continuing waiver of such term or any other term, and MDC’s failure to assert any right or provision under the Agreement shall not constitute a waiver of such right or provision.
e. Severability. Each of the provisions of the Agreement operates separately. If any court or relevant authority decides that any of them are unlawful or unenforceable, the remaining provisions will remain in full force and effect. In the event that any provision is deemed unlawful or unenforceable, the parties agree that such provision shall be modified or amended by the court or relevant authority to the extent necessary to render it enforceable, in accordance with the intent of the original provision. The modified provision shall be interpreted so as to reflect the original intent of the parties as closely as possible, while remaining compliant with applicable law.
f. Assignment. These Terms, and any rights and licenses granted hereunder, may not be transferred or assigned by you without the prior written consent of MDC. These Terms may be assigned by MDC without restriction. Any attempted transfer or assignment in violation hereof shall be null and void.
If you wish to contact us or have any questions or concerns related to these Terms or your use of the Platform, please (1) email us atsupport@mozilladatacollective.com, or (2) contact us by Mail at Mozilla Data Collective, 167-169 Great Portland Street, London, W1W 5PF.
The purpose of this Appendix is to provide an exception to the Terms requirement of exclusive hosting for Datasets submitted by Data Provider to MDC Data Collective, as described in Section 2(f) of the Terms. All capitalized terms used but not defined herein shall have the meanings set forth in the Terms. In the event of any inconsistency between the Terms and this Appendix, the provisions of this Appendix shall govern solely with respect to the subject matter addressed herein.
The Parties agree that the following terms, obligations, and requirements set forth in this Appendix shall govern the subject matter described herein and are incorporated by reference into the Terms. Each Party acknowledges and agrees that these provisions are binding and enforceable as part of the overall agreement between the Parties.
The Parties hereby agree as follows:
License Grant. Notwithstanding anything to the contrary in Section 2(f) of the Terms, with respect to the Dataset(s) identified in the Data Sheet (the “Non-Exclusive Datasets”), Data Provider grants to MDC, and its affiliates and service providers, a non-exclusive, worldwide, royalty-free license to collect, store, maintain, reproduce, host, and transmit your Hosted Dataset(s) solely as necessary to operate the Platform and provide access to your Hosted Dataset(s) to End Users under your End User License.
Scope of Non-Exclusive License. For the avoidance of doubt, the non-exclusive license granted hereunder remains subject to all other terms and conditions of the Terms.
Data Provider Representations and Warranties. Data Provider represents and warrants that it (i) has not granted, and will not grant, any license to the Non-Exclusive Dataset(s) that conflicts with the rights granted to MDC under the Terms or this Appendix, and (ii) will promptly notify MDC of any other third-party license to the Non-Exclusive Dataset(s) that could reasonably affect the operations of the Platform, use by any End User, or MDC’s compliance obligations. For the avoidance of doubt, the foregoing warranties are in addition to, not in lieu of, the warranties set forth in the Terms. For the avoidance of doubt, and notwithstanding anything to the contrary herein, the foregoing representations and warranties are in addition to, and not in lieu of, Data Provider’s representations and warranties set forth in the Terms.
Commercial Terms. MDC reserves the right, in its sole discretion, to apply differentiated commercial and/or monetization terms to the Non-Exclusive Datasets.
Indemnification. Data Provider agrees, at its own expense, to indemnify, defend, and hold harmless MDC and its affiliates, agents, licensors, managers, and other affiliated companies, and their employees, contractors, agents, officers and directors, from and against any and all claims, damages, losses, or liabilities arising from or relating to: (i) any rights in the Non-Exclusive Datasets granted by Data Provider to third parties that are conflicting or inconsistent with the rights granted by Data Provider to MDC under the Terms or this Appendix, or (ii) any allegation that MDC’s use of the Non-Exclusive Datasets pursuant to this Appendix and the Terms violates the rights of a third party. For the avoidance of doubt, the foregoing indemnification and defense obligations are in addition to, not in lieu of, the indemnification and defense obligations set forth in the Terms. For the avoidance of doubt, and notwithstanding anything to the contrary herein, the foregoing indemnity and defense obligations are in addition to, and not in lieu of, Data Provider’s indemnity obligations set forth in the Terms.
Applicable Dataset(s). Only the Non-Exclusive Datasets shall be excluded from the exclusivity requirement set forth in the Terms. With respect to all other Datasets provided by Data Provider, the license terms set forth in the Terms shall remain unchanged, including the grant to MDC of an exclusive license to the Datasets by default.
This Data Processing Agreement (“DPA”) is incorporated into and forms part of (and if applicable, amends the current version of) the Agreement between Data Provider and/or its affiliates identified in the Agreement (“Data Provider”) and MDC Data Collective LTD (“MDC”), each a “Party” and collectively the “Parties”. This DPA applies to and takes precedence over the agreement between the Parties and any associated contractual document between the Parties, such as an order form, statement of work, or data processing agreement thereunder (collectively, the “Agreement”), to the extent of any conflict. Capitalized terms not defined herein are defined as in applicable Data Protection Laws.
Data Provider and MDC agree as follows:
Definitions. For purposes of this DPA:
a. “Data Protection Laws” means all applicable laws, regulations, and other legal or self-regulatory requirements in any jurisdiction relating to privacy, data protection, data security, breach notification, or the Processing of personal data, including without limitation, to the extent applicable, the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”); the United Kingdom Data Protection Act of 2018; and the Swiss Federal Act on Data Protection (“FADP”). For the avoidance of doubt, if the Parties’ Processing activities involving Personal Data are not within the scope of a given Data Protection Law, such law is not applicable for purposes of this DPA.
b. “Datasets” shall be defined as provided in the Agreement.
c. “Data Subject,” "Processor," and "Controller" shall be defined as provided in applicable Data Protection Laws.
d. “EU SCCs” means the Standard Contractual Clauses issued pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, located http://data.europa.eu/eli/dec_impl/2021/914/oj, and completed as set forth in Section 7 below.
e. “Personal Data” refers to any information contained in the Datasets relating to an identified or identifiable natural person that MDC Processes on behalf of Data Provider under the Agreement. For purposes of this DPA, the term “Personal Data” includes “personal information,” “personally identifiable information,” and similar terms defined under Data Protection Laws.
f. “Process” and “Processing” mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
g. “Security Breach” means any accidental or unlawful acquisition, destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data occurring on MDC's systems or otherwise under MDC's control.
h. "UK SCCs" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (available as of the Effective Date at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf).
Scope and Purposes of Processing.
a. The scope, nature, purposes, and duration of the processing, the types of Personal Data Processed, and the Data Subjects concerned are set forth in this DPA, including its Schedule A. The details provided in Schedule A are deemed to satisfy any requirement to provide such details under any Data Protection Law.
b. MDC will Process Personal Data solely: (1) to fulfill its obligations to Data Provider under the Agreement, including this DPA; (2) on Data Provider’s behalf; and (3) in compliance with Data Protection Laws.
Personal Data Processing Requirements. MDC will:
a. Ensure that the persons it authorizes to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
b. Assist Data Provider in the fulfilment of Data Provider’s obligations to respond to verifiable requests by Data Subjects (or their lawful representatives) for exercising their rights under Data Protection Laws with respect to their Personal Data.
c. Assist Data Provider with Data Provider’s consultation with supervisory authorities in relation to the Processing or proposed Processing of Personal Data, and notify Data Provider of (i) any third-party complaints regarding the Processing of Personal Data; or (ii) any government requests for access to or information about MDC’s Processing of Personal Data on Data Provider’s behalf, unless prohibited by Data Protection Laws. If MDC is prohibited by applicable Data Protection Laws from disclosing the details of a government request to Data Provider, MDC shall inform Data Provider that it can no longer comply with Data Provider’s instructions under this DPA without providing more details.
d. Assist Data Provider with Data Provider’s performance of a data protection impact assessment of Processing or proposed Processing of Personal Data, when required by applicable Data Protection Laws, and at Data Provider’s reasonable expense.
e. Notify Data Provider if it determines that (i) it can no longer meet its obligations under this DPA or applicable Data Protection Laws; or (ii) in its opinion, an instruction from Data Provider infringes applicable Data Protection Laws.
Data Security. MDC will implement appropriate administrative, technical, physical, and organizational measures to protect Personal Data, as set forth in Schedule A, Annex II.
Security Breach. MDC will notify Data Provider without undue delay of any known Security Breach resulting from MDC’s Processing of Personal Data on behalf of Data Provider. MDC will comply with the Security Breach-related obligations directly applicable to it under Data Protection Laws and will assist Data Provider in Data Provider’s compliance with its Security Breach-related obligations, including without limitation by:
a. Taking commercially reasonable steps to mitigate the effects of the Security Breach and reduce the risk to Data Subjects whose Personal Data was involved; and
b. Providing Data Provider with the following information, to the extent known:
i. The nature of the Security Breach, including, where possible, how the Security Breach occurred, the categories and approximate number of Data Subjects concerned, and the categories and approximate number of Personal Data records concerned.
ii. The likely consequences of the Security Breach; and
iii. Measures taken or proposed to be taken by MDC to address the Security Breach, including, where appropriate, measures to mitigate its possible adverse effects.
Subprocessors.
a. Data Provider acknowledges and agrees that MDC may use MDC affiliates and other Subprocessors to Process Personal Data in accordance with the provisions within this DPA and Data Protection Laws. Where MDC sub-contracts any of its rights or obligations concerning Personal Data, including to any affiliate, MDC will take steps to select and retain Subprocessors that are capable of maintaining appropriate privacy and security measures to protect Personal Data consistent with applicable Data Protection Laws and require that each Subprocessor complies with obligations that are no less restrictive than those imposed on MDC under this DPA.
b. To the extent required by applicable Data Protection Laws, MDC’s current list of Subprocessors are provided in Schedule B hereto, and Data Provider hereby consents to MDC’s use of such Subprocessors. MDC will maintain an up-to-date list of its Subprocessors, and it will provide Data Provider with reasonable prior notice of any new Subprocessor added to the list. In the event Data Provider has a commercially reasonable objection to a new Subprocessor, MDC will use reasonable efforts to make available to Data Provider a change in the services or recommend a commercially reasonable change to Data Provider’s use of the services to avoid Processing of Personal Data by the objected-to Subprocessor. Data Provider may, in its sole discretion, terminate the Agreement at any time and by providing written notice to MDC in the event that it objects to a Subprocessor and MDC is unable to offer reasonable changes the services to satisfy Data Provider.
Data Transfers.
a. MDC will not engage in any cross-border Processing of Personal Data, or transmit, directly or indirectly, any Personal Data to any country outside of the country from which such Personal Data was collected, without complying with applicable Data Protection Laws. Where MDC engages in an onward transfer of Personal Data, MDC shall ensure that a lawful data transfer mechanism is in place prior to transferring Personal Data from one country to another.
b. To the extent legally required, by signing this DPA, Data Provider and MDC are deemed to have signed the EU SCCs, which form part of this DPA and (except as described in Section 7(c) and (d) below) will be deemed completed as follows:
i. Module 2 of the EU SCCs applies to transfers of Personal Data from Data Provider (as a controller) to MDC (as a processor);
ii. Clause 7 (the optional docking clause) is included;
iii. Under Clause 9 (Use of subprocessors), the Parties select Option 2 (General written authorization). The initial list of subprocessors is set forth in Schedule B of this DPA and MDC shall update that list and provide a notice to Data Provider in advance of any intended additions or replacements of subprocessors as provided in Section 6.
iv. Under Clause 11 (Redress), the optional language requiring that Data Subjects be permitted to lodge a complaint with an independent dispute resolution body shall not be deemed to be included;
v. Under Clause 17 (Governing law), the Parties choose Option 1 (the law of an EU Member State that allows for third-Party beneficiary rights). The Parties select the laws of Ireland;
vi. Under Clause 18 (Choice of forum and jurisdiction), the Parties select the courts of Ireland;
vii. Annex I(A) and I(B) (List of Parties) is completed as set forth in Schedule A of this DPA;
viii. Under Annex I(C) (Competent supervisory authority), the Parties shall follow the rules for identifying such authority under Clause 13 and, to the extent legally permissible, select the Irish Data Protection Commission.
ix. Annex II (Technical and organizational measures) is completed with Schedule A of this DPA; and
x. Annex III (List of subprocessors) is not applicable as the Parties have chosen General Authorization under Clause 9. However, a list of MDC’s subprocessors is available in Schedule B.
c. With respect to Personal Data transferred from the United Kingdom for which United Kingdom law (and not the law in any European Economic Area jurisdiction or Switzerland) governs the international nature of the transfer, the UK SCCs form part of this DPA and takes precedence over the rest of this DPA as set forth in the UK SCCs. Undefined capitalized terms used in this provision shall mean the definitions in the UK SCCs. For purposes of the UK SCCs, they shall be deemed completed as follows: (i) the Parties’ details shall be the Parties and their affiliates to the extent any of them is involved in such transfer; (ii) the Key Contacts shall be the contacts set forth in Schedule A; (iii) the Approved EU SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties; (iv) Annex 1A, 1B, II, and III shall be set forth in Schedules A and B below; (v) either Party may end this DPA as set out in Section 19 of the UK SCCs; and (vi) by entering into this DPA, the Parties are deemed to be signing the UK SCCs.
d. For transfers of Personal Data that are subject to the FADP, the EU SCCs form part of this DPA as set forth in Section 7(b) of this DPA, but with the following differences to the extent required by the FADP: (i) references to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the data transfers are subject exclusively to the FADP and not to the GDPR; (ii) references to personal data in the EU SCCs also refer to data about identifiable legal entities until the entry into force of revisions to the FADP that eliminate this broader scope; (iii) the term “member state” in EU SCCs shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; and (iv) the relevant supervisory authority is the Swiss Federal Data Protection and Information Commissioner (for transfers subject to the FADP and not the GDPR), or both such Commissioner and the supervisory authority identified in the EU SCCs (where the FADP and GDPR apply, respectively).
Audits. To the extent required by applicable Data Protection Law, MDC shall make available all information necessary for Data Provider to confirm MDC’s compliance with this DPA. If Data Provider has a reasonable basis to conclude that such information provided by MDC is not satisfactory to confirm such compliance, Data Provider may, at Data Provider’s sole expense, upon reasonable prior notice, conduct an audit during normal business hours and in a manner that does not disrupt MDC's business of those MDC systems and records relevant to MDC’s Processing of Personal Data on Data Provider’s behalf. Data Provider shall limit its exercise of audit rights to not more than once in any twelve (12) calendar month period, unless (i) required by instruction of a Supervisory Authority; or (ii) following a Security Breach.
Return or Destruction of Personal Data. Except to the extent required otherwise by Data Protection Laws, upon termination or expiry of the Agreement, MDC will (at Data Provider’s election and written request) delete or return all Personal Data in its possession or control as soon as reasonably practicable. Except to the extent prohibited by Data Protection Laws, MDC will inform Data Provider if it is not able to return or delete the Personal Data.
General Terms.
a. The provisions of this DPA survive the termination or expiration of the Agreement for so long as MDC or its Subprocessors Process the Personal Data.
b. If there is a conflict between the Agreement and this DPA, the terms of this DPA will prevail. In the event of a conflict between this DPA and the EU SCCs or UK SCCs, the terms of the EU SCCs or UK SCCs, as relevant, will control.
c. Any claims brought under this DPA shall be subject to the terms and conditions, including but not limited to, the exclusions and limitations, set forth in the Agreement.
ANNEX I
A. LIST OF PARTIES
Data exporter(s): The exporter (Controller) is Data Provider and Data Provider’s contact details and signature are as provided in the Agreement.
Data importer(s): The importer (Processor) is MDC and MDC’s contact details and signature are as provided in the Agreement.
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred: The Personal Data transferred concerns data subjects whose information Data Provider makes available through the Datasets.
Categories of personal data transferred: Any personal data contained in Datasets provided by Data Provider to MDC for MDC to perform services under the Agreement.
Sensitive data transferred (if applicable): N/A
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): On a continuous basis as needed to provide the services to Data Provider.
Nature of the processing: The nature of the Processing is set out in the Agreement between the Parties.
Purpose(s) of the data transfer and further processing: The purposes of the data transfer is to provide the Dataset-hosting services chosen by Data Provider in connection with the Agreement including indexing and search functionality related to the Datasets.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: The data will be retained for the time period needed to accomplish the purposes of Processing, unless otherwise required by applicable law.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: Same as above to the extent that Personal Data is provided to Subprocessors for purposes of providing the services under the Agreement to Data Provider.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13: The data exporter’s competent supervisory authority will be determined in accordance with the GDPR, and where possible, will be the Irish Data Protection Commissioner.
ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
MDC will implement and maintain the following administrative, technical, physical, and organizational security measures for the Processing of Personal Data:
Access Controls & Authentication
All user access requires authenticated sessions. Passwords are hashed before storage and never persisted in plaintext. API access uses a separate credential system scoped to each organization. Email verification is required before users can perform sensitive operations such as submitting datasets or creating API credentials. Account deactivation is enforced in real time, active sessions for deactivated accounts are blocked at the request layer.
Authorization & Data Segregation
All data is logically segregated by organization. Dataset uploads are further controlled via an Admin approval workflow.
Rate Limiting & Abuse Resistance
Rate limiting is applied at the middleware layer to all routes. Authentication endpoints are strictly limited to prevent brute-force attacks. Download, upload, and API endpoints each have their own limits, with requests over the threshold being blocked.
Data in Transit & at Rest
All communication occurs over HTTPS. Database connections enforce SSL. Files are stored in cloud object storage and accessed via short-lived presigned URLs rather than persistent public links.
Infrastructure
The application is hosted on AWS within a private VPC. The database is not publicly accessible. Administrative access is restricted to authorized engineers via AWS Systems Manager and does not require open network ports. The production application runs in containers using a hardened, multi-stage build with a non-root user. Access to the AWS environment is governed by IAM roles with least-privilege principles.
Logging & Monitoring
Server-side errors are captured via an error monitoring service. Download and API access events are recorded in an audit log with timestamps, IP address, user agent, and status. No credentials or unnecessary personal data are written to logs.
MDC SUBPROCESSORS
The Parties agree that the following list of Subprocessors are approved:
| Name of Subprocessor | Processing Activities | Location of Processing |
|---|---|---|
| Amazon Web Services | Cloud hosting for application servers, data processing, email services, account data storage | Ireland |
| Cloudflare R2 | Dataset storage of uploaded files | EU |
| Digital Ocean | Compute infrastructure for datasheet processing and metadata analysis | New York City, United States & EU |
| Sentry | Application monitoring and error logging | EU |
| Stripe | Payments processing for paid datasets and license purchases | United States, Ireland |
| Together.ai | Inference and embedding activities supporting search and discovery features | United States |
