Data Processing Agreement

Keymint's Data Processing Agreement: how we process personal data on behalf of software vendors who use Keymint, including security, subprocessors, and international transfers.

Last updated: October 19, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Keymint ("Keymint", "we", "us") and the customer that uses the Keymint Services ("Customer", "you"). It applies whenever Keymint processes Customer Personal Data on your behalf. By using the Services, you agree to this DPA. If you need a countersigned copy, contact support@keymint.dev.

1. Definitions

• "Customer Personal Data" means personal data that you, or software that uses Keymint on your behalf, submit to the Services about your own customers and end users, such as names, email addresses, and license and activation records.
• "Data Protection Laws" means all data protection and privacy laws that apply to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable US state privacy laws.
• "Subprocessor" means a third party that Keymint engages to process Customer Personal Data.
• Terms such as "controller", "processor", "data subject", "personal data breach", and "processing" have the meanings given in the GDPR.

2. Roles

You are the controller (or, where applicable, a processor acting for your own controller) of Customer Personal Data, and Keymint is your processor. You are responsible for having a lawful basis for the processing and for the accuracy of the data you submit. For US state privacy laws, Keymint acts as your "service provider" or "processor".

3. Scope and Instructions

Keymint processes Customer Personal Data only to provide, secure, and support the Services, and only on your documented instructions. The Terms, this DPA, and your use and configuration of the Services are your complete instructions. We will tell you if we believe an instruction infringes Data Protection Laws.

Keymint will not sell Customer Personal Data, will not share it for cross-context behavioral advertising, will not use it for any purpose other than providing the Services, and will not use it to train AI models.

Details of processing

4. Confidentiality

Keymint ensures that everyone authorized to process Customer Personal Data is bound by an obligation of confidentiality.

5. Security

Keymint maintains appropriate technical and organizational measures to protect Customer Personal Data, including encryption in transit, encryption of sensitive data such as license keys and backups, role-based access controls, least-privilege access for our systems and personnel, logging and monitoring, regular backups, and periodic security reviews. We may update these measures as long as the overall level of protection is not reduced. See our Security page.

6. Subprocessors

You authorize Keymint to engage the Subprocessors listed on our Subprocessors page. We impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and we remain responsible for their performance.

We will update the Subprocessors page before a new Subprocessor begins processing Customer Personal Data. To be notified of changes by email, send a request to support@keymint.dev with the subject "Subprocessor updates". If you have a reasonable data protection objection to a new Subprocessor, you may notify us within 30 days of the update; we will work with you in good faith to address it, and if we cannot, you may stop using the affected part of the Services.

7. Assistance

Taking into account the nature of the processing, Keymint will provide reasonable assistance to help you:

• Respond to requests from data subjects to exercise their rights. Many requests can be handled directly in the dashboard, for example by exporting or deleting customer records. If we receive a request directly, we will refer the data subject to you.
• Meet your obligations regarding security, breach notification, and data protection impact assessments, where these relate to the Services.

8. Personal Data Breaches

Keymint will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We will provide the information reasonably available to us to help you meet your own notification obligations, and we will take reasonable steps to contain and remedy the breach.

9. Deletion and Return

You can export or delete Customer Personal Data in the Services at any time. When your account is deleted, Keymint deletes Customer Personal Data as described in our Privacy Policy, including the 7-day restoration period and the removal of residual copies from encrypted backups within 6 months, unless we must retain data to meet legal obligations.

10. International Transfers

Keymint primarily stores and processes Customer Personal Data in the United States. Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable), together with the UK International Data Transfer Addendum where relevant, are incorporated into this DPA by reference.

For the Standard Contractual Clauses: you are the data exporter and Keymint is the data importer; the optional docking clause (Clause 7) applies; under Clause 9, option 2 (general written authorization) applies, with notice of changes as set out in Section 6; the optional language in Clause 11 does not apply; under Clauses 17 and 18, the clauses are governed by the law of Ireland and disputes are resolved by the courts of Ireland; and Annexes I and II are completed by the details of processing in Section 3 and the security measures in Section 5. For transfers from Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority. For transfers from the United Kingdom, the UK International Data Transfer Addendum applies, and either party may end it as permitted by its terms. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses prevail.

11. Audits

Keymint will make available the information reasonably necessary to demonstrate compliance with this DPA, including responses to reasonable security questionnaires, no more than once per year unless required by a supervisory authority or following a personal data breach. Any further audit must be agreed in advance, conducted during normal business hours with reasonable notice, and is subject to confidentiality obligations.

12. General

This DPA remains in effect for as long as Keymint processes Customer Personal Data. If it conflicts with the Terms, this DPA prevails with respect to the processing of Customer Personal Data. Each party's liability under this DPA is subject to the limitations of liability in the Terms. We may update this DPA from time to time; material changes will be communicated as described in the Terms.