Legal
Data Processing Agreement
Draft. This page is being reviewed by our lawyer and may change before it applies. Questions: privacy@mantab.ai.
This Data Processing Agreement (“DPA”) is part of the MantaB Subscription Terms (“Terms”). It applies automatically when a customer accepts the Terms at checkout, without a separate signature. Customers who need a countersigned copy can ask privacy@mantab.ai and we sign the same text.
Terms not defined here have the meaning given in the GDPR (Regulation (EU) 2016/679). “Data protection law” means the GDPR and the national law that applies to each party, including Spain’s Organic Law 3/2018.
The parties. The customer that accepted the Terms (“Customer”) and Ana Beatriz Guimarães de Aguiar Gomes, trading as MantaB, NIF Z0942490R, Carrer Roger de Flor 298, 3-1, 08025 Barcelona, Spain, privacy@mantab.ai (“MantaB”).
Part A. When the Customer is the controller (direct plans)
1. Roles
1.1 When performing the Services, MantaB processes personal data on behalf of the Customer, as processor, under the Customer’s documented instructions. The Customer is the controller.
1.2 The details required by Article 28(3) GDPR are in Annex I.
1.3 When MantaB processes data for its own purposes (its own accounting, billing and customer relationship), it is an independent controller, and its privacy policy applies, not this DPA.
2. Data that is excluded unless agreed
2.1 The Services routinely involve business contact data, CRM records and activity data, as set out in Annex I.
2.2 The Services don’t require special category data (Article 9 GDPR), data about criminal convictions, or records about the Customer’s individual consumers or patients (including clinical records and therapy or session content). The Customer will not give MantaB access to systems containing such data, and will filter, mask or restrict access accordingly, unless both parties first agree in writing the additional safeguards that apply.
2.3 If MantaB finds it can access data outside the agreed scope, it tells the Customer immediately, stops accessing it, and deletes any copy once the Customer confirms. This is handled as an incident under clause 9.
3. Instructions
3.1 MantaB processes personal data only on the Customer’s documented instructions, including about transfers outside the EEA, unless EU or Member State law requires otherwise, in which case MantaB informs the Customer first unless the law prohibits it.
3.2 The Terms, this DPA and the requests the Customer’s approver submits on the board are the Customer’s documented instructions.
3.3 MantaB tells the Customer immediately if it thinks an instruction breaks data protection law, and may suspend that instruction until it is confirmed or withdrawn.
4. Confidentiality of people
4.1 Everyone at MantaB who can access the Customer’s personal data, including contractors, is bound by a written confidentiality obligation and has access only on a need-to-know basis.
4.2 MantaB keeps a record of who has access and removes access promptly when it is no longer needed, and in any case when the Services end.
5. Security
5.1 MantaB applies the technical and organisational measures in Annex II, in line with Article 32 GDPR. It may update them as long as security is not reduced.
6. Sub-processors
6.1 The Customer gives MantaB general authorisation to use sub-processors. The current list is in Annex III and on mantab.ai/legal/sub-processors.
6.2 MantaB tells the Customer by email at least 15 days before adding or replacing a sub-processor. The Customer can object on reasonable data protection grounds within that time. If we can’t find a solution, the Customer can end the affected Services without penalty.
6.3 Every sub-processor is bound by written data protection obligations at least as protective as this DPA. MantaB remains fully liable to the Customer for its sub-processors.
6.4 Tools the Customer licenses in its own name (its CRM, enrichment, automation and AI tools) are the Customer’s own processors, not MantaB’s sub-processors. The Customer is responsible for its agreements with those vendors.
7. International transfers
7.1 MantaB doesn’t transfer personal data outside the EEA, or let a sub-processor do so, without a valid Chapter V GDPR mechanism (an adequacy decision, including the EU-US Data Privacy Framework, or the Standard Contractual Clauses of Decision (EU) 2021/914) and any supplementary measures a transfer assessment calls for. The mechanism for each sub-processor is in Annex III.
7.2 MantaB’s people may work remotely, including while travelling outside the EEA. They access data only through the same systems, over encrypted connections, on encrypted devices. This doesn’t change where the data is stored.
8. Helping the Customer
8.1 MantaB helps the Customer, as far as the nature of the processing allows, to answer data subject requests and to comply with Articles 32 to 36 GDPR (security, breach notification, impact assessments, prior consultation).
8.2 MantaB doesn’t answer data subject requests about the Customer’s data itself. It forwards them to the Customer within 3 business days.
8.3 Routine help is free. Help that needs substantial effort is quoted in advance as a separate project.
9. Personal data breaches
9.1 MantaB notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting the Customer’s personal data.
9.2 The notice describes, as far as known: what happened, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a contact. Information not available at once follows as soon as it is.
9.3 MantaB doesn’t notify a supervisory authority or the people affected about the Customer’s data unless the Customer instructs it or the law requires it. MantaB documents every breach and shares that record on request.
10. Return and deletion
10.1 When the Services end, MantaB deletes or returns the Customer’s personal data, as the Customer chooses, and deletes copies, unless the law requires keeping them. The Customer tells MantaB its choice within 30 days. Without a choice, MantaB deletes and confirms in writing.
10.2 What MantaB built inside the Customer’s own tools stays in the Customer’s control and isn’t affected.
11. Audits
11.1 MantaB gives the Customer the information needed to show compliance with Article 28 GDPR and allows audits by the Customer or an auditor it appoints.
11.2 Audits need 30 days’ written notice, happen in business hours, at most once a year (unless a breach or a supervisory authority requires more), and remotely where that is enough. The auditor must not be a competitor of MantaB and must be bound by confidentiality. Each party bears its own costs; time for an on-site audit can be charged at a price agreed in advance.
12. Records
12.1 MantaB keeps a record of processing under Article 30(2) GDPR and shares it with the Customer or a supervisory authority on request.
13. Liability
13.1 Liability for damage caused by processing is governed by Article 82 GDPR. The liability cap in the Terms applies to claims under this DPA as far as the law allows, but never limits liability towards data subjects or supervisory authorities.
14. Duration, priority and law
14.1 This DPA applies as long as MantaB processes personal data for the Customer. Clauses 4, 9, 10, 11 and 13 survive.
14.2 If this DPA and the Terms conflict about personal data, this DPA prevails.
14.3 Spanish law governs this DPA, without prejudice to the GDPR and any mandatory rule of the Customer’s national law. Disputes follow clause 20 of the Terms.
Part B. When the Customer is an agency (white-label plans)
B1. When an agency adds an end client, the agency is usually that end client’s processor. In that case MantaB is the agency’s sub-processor, and Part A applies between the agency and MantaB with these changes:
(a) “Customer” means the agency, and the end client is the controller; (b) the agency confirms that its end client has authorised the use of sub-processors and that the agency’s own agreement with the end client is at least as protective as this DPA; (c) the agency passes on the end client’s instructions to MantaB, and MantaB passes on anything the end client needs to know (breaches, data subject requests, sub-processor changes) through the agency; (d) audits by the end client are arranged through the agency.
B2. If an end client is not represented by the agency for data protection purposes, the agency arranges for that end client to accept this DPA directly before MantaB starts work.
Annex I. Details of the processing
Subject matter: designing, building, running and supporting the Customer’s revenue operations systems under the plan.
Duration: from the day MantaB receives access until the plan ends, plus the return and deletion period in clause 10.
Nature and purpose: configuring and maintaining the CRM and connected tools; data quality work (deduplication, standardisation, enrichment upkeep); building and monitoring integrations and automations; reporting and dashboards; lifecycle, routing, scoring and handover rules; configuring AI features inside the Customer’s tools; recording and summarising working sessions with the Customer’s team where the Customer agrees; support and fixes.
Types of personal data: business contact data (name, role, employer, business email and phone, professional profiles, enrichment attributes); CRM activity data (notes, emails, calls, meetings, deal history, sequence engagement); the Customer’s own staff data in its tools (users, roles, permissions, activity); customer account data (usage, subscription, support and health data linked to named business contacts); working session notes. Excluded: see clause 2.2.
Data subjects: people at the Customer’s prospects, leads and customers; the Customer’s own staff and contractors in sales, marketing, revenue operations and customer success.
Supervisory authority: the Customer’s lead supervisory authority in its country of establishment. MantaB is established in Spain (AEPD).
Frequency: continuous while the plan runs, as needed for the Services.
Annex II. Security measures
Access: credentials only in a password manager, in per-customer vaults, never in documents or chat; multi-factor authentication on every account that supports it; least-privilege access, reviewed quarterly; named logins per person, never shared; all access removed within 5 business days of the plan ending. The Customer can revoke access at any time.
Devices: full-disk encryption, automatic screen lock, strong passcodes, up-to-date systems and security patches; no shared or public devices.
Minimisation: work happens inside the Customer’s own tools wherever possible. Exports are limited to the fields a task needs, kept in a folder owned by the Customer (for example a Google Drive folder the Customer shares with MantaB), and deleted when the task is done. MantaB keeps no central copy of Customer data.
Transmission: TLS in transit; encryption at rest by the storage providers; no personal data over unencrypted email or consumer messaging apps.
AI: only AI providers whose business terms exclude training on customer data, with zero data retention where offered; personal data is minimised and pseudonymised (names, emails, phones and company names replaced by tokens) before it reaches an AI provider wherever the task allows, and restored only inside MantaB’s own workflow; personal data shared with AI only where a task needs it, and never special category data; a named person reviews every AI-assisted change before it goes live; participants are told when a session is recorded or transcribed, and recording stops on request.
Automation platform: MantaB’s workflows run on n8n with two-step login and one named user per person; data from successful runs is not kept, and error data is deleted within 7 days; client credentials are stored encrypted in n8n or 1Password, never in workflow code.
Organisation: written confidentiality for everyone with access; a record of processing; a documented incident procedure supporting the 48-hour notice; due diligence on every sub-processor before use.
Backups before changes: before any bulk change (deduplication, imports, deleting or changing properties), MantaB takes a backup with the platform’s own backup feature (for HubSpot, Backup & Restore). Where that isn’t available or isn’t enough, it uses a backup or merge-safety app installed in the Customer’s own account, or an export to the Customer-owned folder. The backup stays in the Customer’s control.
Resilience: the system map and documentation are kept current, so the Customer can run or rebuild its system without MantaB. Backups of the Customer’s platforms are provided by those vendors under the Customer’s own agreements.
Annex III. Sub-processors
The live list is at /legal/sub-processors. At [launch date]:
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Independent contractor (name available to customers on request) | Delivery and support | EEA (Spain, Italy) | None needed |
| Google Ireland Ltd (Google Workspace, including Gemini in Workspace) | Email, documents, file storage, AI assistance inside Workspace | EEA (Ireland), US access possible | EU-US DPF and SCCs |
| Google Cloud (Gemini API), only if used outside Workspace | AI assistance for analysis and documentation | EEA or US, by configuration | EU-US DPF and SCCs. Paid tier only (the free tier may train on data) |
| Anthropic PBC (Claude, business plan or API) | AI assistance for analysis, documentation and configuration | United States | SCCs (and EU-US DPF if certified) |
| Granola, Inc. | Notetaking for working sessions, where the Customer agrees | United States | SCCs |
| Notion Labs, Inc. | Delivery workspace: board, requests, documentation | United States | EU-US DPF and SCCs |
| Slack Technologies (Salesforce) | Communication with the Customer’s team | United States | EU-US DPF and SCCs |
| Loom (Atlassian) | Videos explaining each request (may show the Customer’s screens) | United States | EU-US DPF and SCCs |
| n8n GmbH (n8n Cloud) | Automations that run MantaB’s monitoring, alerts and delivery workflows | EEA (Germany) | None needed |
| AgileBits (1Password) | Storing access credentials | Canada / EEA | Adequacy (Canada) |
Not sub-processors: tools the Customer licenses itself (clause 6.4), and MantaB’s own HubSpot, Stripe and Quipu, which hold only MantaB’s own customer and billing data, covered by the privacy policy.
All AI providers above are used on paid business plans or the API, with no training on customer data (confirmed 2026-10-13).