Last Updated: 11/10/2026
Middesk Data Processing Addendum United States & International
Middesk Data Processing Addendum United States & International
This Data Processing Addendum (“DPA”) forms part of the Agreement between the Parties where Customer has elected to include the DPA in an Order Form, and constitutes a Schedule for all purposes of the Agreement. This DPA applies where Customer contracts directly with Middesk under the Agreement; where an organization accesses the Services as an end user through a Middesk reseller, the Middesk End User Data Processing Addendum attached to the Middesk Business Verification End User Terms and Conditions applies instead. In the event of a conflict between this DPA and the Agreement, the terms of this DPA shall control with respect to Personal Information (as that term is defined in the DPA). Terms used but not defined herein shall have the meaning ascribed to them in the Agreement.
This DPA is supplemental to the Agreement and sets out the terms that apply when Personal Information is Processed by Middesk under the Agreement. The purpose of this DPA is to ensure such Processing is conducted in accordance with Applicable Laws (as defined below), including the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100, et seq., as may be amended from time to time (“CCPA”).
1. Definitions: For the purposes of this DPA:
1.1. “Applicable Laws” means all (i) United States federal or state privacy and data protection laws applicable to Personal Information in the commercial context, including the CCPA, and (ii) the GDPR, including in both (i) and (ii) any implementing regulations relating to the same; in each case, as amended, superseded, or replaced.
1.2. “Business Purpose” means the Services described in the Agreement or any other purpose specifically identified in the Agreement, as further described in Annex A.
1.3. “Consumer” means a natural person who is the subject of Personal Information.
1.4. “Consumer Requests” means requests from individuals seeking to exercise their rights under Applicable Law with respect to Personal Information.
1.5. “GDPR” means the Regulation (EU) 2016/679 (General Data Protection Regulation) and, where applicable, the GDPR as incorporated into United Kingdom law (the “UK GDPR”) and the Swiss Federal Act on Data Protection.
1.6. “Processing” or “Processed” means any operation or set of operations that are performed on Personal Information or on sets of Personal Information, whether or not by automated means.
1.7. “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household and that is not otherwise exempt from the category of Personal Information as defined under Applicable Law. For purposes of clarity Personal Information does not include Middesk Data.
1.8. “Sell” and “Share” have the meaning defined in Applicable Laws.
1.9. “Subcontractor” means all subcontractors, service providers, and vendors of Middesk that are involved in Processing of Personal Information in connection with the provision of the Services.
2. Middesk Status. The Parties agree that with respect to the Personal Information Middesk is a “service provider” or “processor” as those terms are defined in Applicable Laws. For clarity, with respect to Middesk Data (including any business or beneficial-owner information that Middesk has independently collected, licensed, or generated), Middesk acts as a “business” or “controller” as those terms are defined in Applicable Laws and is independently responsible for its own compliance with Applicable Laws with respect to such data. This DPA applies only to Personal Information that Middesk Processes on Customer’s behalf.
3. Middesk Obligations. Middesk agrees that:
3.1. Middesk will notify Customer promptly and without undue delay if Middesk makes a determination that it can no longer meet its obligations under Applicable Law.
3.2. With respect to Personal Information, Middesk shall (1) only Process the Personal Information for the Business Purposes in accordance with Customer’s written instructions, including the Agreement and this DPA; (2) not Sell or Share the Personal Information; (3) not retain, use, or disclose the Personal Information for any purpose other than provision of the Services or as otherwise permitted by Applicable Law; (4) not retain, use, or disclose any Personal Information outside the direct business relationship between Middesk and Customer, except as permitted by Applicable Law; (5) not combine Personal Information with personal information Middesk received from another source, including from Middesk’s own interaction with a Consumer, except as permitted by Applicable Law.
3.3. Middesk shall ensure that any person it authorizes to Process Personal Information is subject to obligations of confidentiality.
3.4. Middesk may engage Subcontractors, where Middesk shall enter into a contract with such Subcontractor(s) that is no less protective than the applicable provisions of this Schedule and Middesk shall remain responsible for Subcontractors’ performance hereunder. When required by Applicable Laws, Middesk shall provide Customer at least thirty (30) days prior written notice of any new Subcontractor, where Customer shall have a period of twenty-one (21) days to object in good faith to the use of the new Subcontractor. In the event of such objection, Customer and Middesk shall work in good faith to resolve such objection. If the Parties cannot resolve the objection within thirty (30) days, Customer may terminate the affected Service(s) on written notice, and Middesk shall refund any pre-paid, unused Fees for such Service(s) on a pro-rated basis.
3.5. Middesk shall implement and maintain administrative, technical, and physical safeguards reasonably designed to protect the Personal Information, including safeguards required under the Agreement and any security requirements incorporated therein. For clarity, the Security Breach provisions of the Agreement shall apply with respect to Personal Information under this DPA.
3.6. Middesk shall reasonably assist Customer with meeting its compliance obligations under Applicable Law, taking into account the nature of Middesk's Processing and the information available to Middesk, including data protection impact assessments and consultation with regulatory authorities. Customer shall reimburse Middesk for any assistance that exceeds the reasonable scope of Middesk's role as a service provider.
3.7. Upon Customer’s written request, within sixty (60) days of termination or expiration of the Agreement, Middesk will delete (or, at Customer’s written election made in such request, return) Personal Information, except to the extent retained in standard backup systems subject to Middesk's normal retention and destruction schedule, or as required by applicable law. This obligation is in addition to, and does not supersede, the Customer Data deletion obligation that may exist in the Terms and Conditions of the Agreement.
3.8. Upon Customer’s written request, no more than once per year, unless a breach of this DPA is reasonably suspected, Middesk shall make available to Customer information reasonably necessary to demonstrate Middesk’s compliance with this DPA, consistent with the Customer Audit section of the Agreement.
4. Cooperation with Consumer Requests. With respect to Consumer Requests, the Parties agree as follows:
4.1. Middesk, taking into account the nature of the Processing of Personal Information, shall provide Customer with such assistance as may be reasonably necessary and technically feasible to assist Customer in fulfilling its obligation to respond to Consumer Requests.
4.2. Further, Middesk shall: (a) promptly and without undue delay notify Customer if it receives a Consumer Request; and (b) not respond to any Consumer Request except: (i) to advise the individual to submit the request to Customer, after which Customer will be responsible for responding to any such request; (ii) on the written instructions of Customer (and in such circumstances, at Customer’s cost); or (iii) as required by Applicable Laws.
5. Transfer mechanisms
5.1. Where Customer is subject to the GDPR pursuant to Article 3(1) or Article 3(2), Middesk will make available the transfer mechanisms based on the Standard Contractual Clauses attached as Annex B. The Annex B mechanisms apply to any transfers of Customer's Personal Information under this Schedule from the European Economic Area (and member states), Switzerland, or the United Kingdom to countries that do not ensure an adequate level of data protection within the meaning of the GDPR.
5.2. For any other cross-border transfers, including forward transfers, of Customer’s Personal Information subject to the GDPR, Middesk shall take steps necessary to ensure the compliance with the GDPR.
6. Survival. This DPA shall survive termination or expiration of the Agreement for so long as Middesk Processes Personal Information.
Annex A
Personal Information Processing and Details
Subject Matter and Services of Processing
Provision of business verification services (including matching identifying information against public records, government records, and third-party data sources, and returning verification results, risk signals, and pre-filled data values to Customer), lien filing services, and/or entity management services (including registered agent services, government account creation, and formation), as provided on the Order Form.
Duration of Processing
Term of the Agreement
Consumer Type
Clients of Customer who are individuals; Employees of Customer
Business Purpose
Performing services on behalf of Customer
Personal Information Categories
Individuals associated with clients of Customer: Identifiers, such as name, address, TIN (SSN, EIN, ITIN where applicable), email, phone number, and date of birth.
Employees of Customer: Identifiers such as name, business email, and business phone number.
Special Categories
None. Middesk does not knowingly solicit or process special categories of Personal Information (e.g., health data, biometric data, genetic data, racial or ethnic origin) in connection with the Services. To the extent any such information is inadvertently provided by Customer, Middesk will treat it in accordance with the security and confidentiality protections in the Agreement and will not knowingly use it for any purpose other than the Business Purpose.
Annex B
Standard Contractual Clauses
1. The Standard Contractual Clauses take effect without further action: where Section 5.1 of this DPA applies, execution of the Order Form incorporating this DPA constitutes execution of the Standard Contractual Clauses (including Annex I) by both Parties, and the data exporter information in Annex I is deemed completed with Customer’s entity details and notice information as set out in the Order Form. At either Party’s written request, the Parties will separately execute Annex I for evidentiary purposes.
2. In connection with any transfers of Customer’s Personal Information under this DPA from the European Economic Area and/or their member states, Switzerland, and the United Kingdom to countries which do not ensure an adequate level of data protection within the meaning of the GDPR, this Annex B shall apply.
3. For purposes of Standard Contractual Clauses Module 2, Customer is the data exporter, and Middesk is the data importer. Where Customer acts as a processor on behalf of its own controller customers, Module 3 applies, with Customer as data exporter (processor) and Middesk as data importer (sub-processor), and references in this Annex B to Module 2 are read accordingly.
4. The relevant provisions contained in the Standard Contractual Clauses (available as of June 2021 at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) are hereby incorporated by reference. In the event of a conflict between the terms of this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall control.
5. The information required for the purposes of the Standard Contractual Clauses are identified in the Schedule, or as follows:
a. Docking Clause. The option under Clause 7 shall not apply.
b. Sub-processors. Option 2 under Clause 9(a) shall apply. Middesk shall provide Customer notice of sub-processors in accordance with Section 3.4 of the DPA.
c. Redress. The option under Clause 11 shall not apply. Middesk provides a contact point to handle complaints via its Privacy Policy posted on the Middesk website.
d. Governing Law. Option 2 of Clause 17 shall apply and shall provide as follows: These Clauses shall be governed by the law of the EU Member State in which the data exporter is established. Where such law does not allow for third-party beneficiary rights, they shall be governed by the law of another EU Member State that does allow for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland.
e. Choice of Forum and Jurisdiction. The Parties agree that 18(b) shall provide: The Parties agree that those shall be the courts of Ireland.
f. Annexes. In addition to Annex I, the Annexes shall be completed as follows:
i. Annex II. The contents of Annex II are those set forth in Section 4.3 (Security) of the Agreement.
ii. Annex III. The contents of Annex III are not applicable as Customer provides general authorization under Section 3.4 of the DPA, and Middesk shall provide a list of Subcontractors upon Customer’s request.
6. Data Exports from the United Kingdom under the Standard Contractual Clauses. For data transfers governed by UK Data Protection Laws and Regulations, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (the “UK Addendum”), available at the UK ICO's website, shall apply, including as revised under Section 18 of the UK Addendum. The information required for Tables 1 to 3 of Part One of the UK Addendum is set out in this Annex B and Annex I of this DPA (as applicable). For the purposes of Table 4 of Part One of the UK Addendum, neither Party may end the Schedule when it changes.
7. Data Exports from Switzerland under the Standard Contractual Clauses. For data transfers subject to Swiss Data Protection Laws, the Standard Contractual Clauses also apply to the transfer of information relating to an identified or identifiable legal entity where such information is protected similarly as Personal Information under Swiss Data Protection Laws until such laws are amended to no longer apply to a legal entity. In such circumstances, general and specific references in the Standard Contractual Clauses to GDPR or EU or Member State Law shall have the same meaning as the equivalent reference in Swiss Data Protection Laws.
Annex I
DETAILS OF PROCESSING OF Personal Information
This Annex I includes certain details of the processing of Personal Information, and when applicable provides the information necessary in connection with the Standard Contractual Clauses:
1. List of Parties
1.1. Controller and Data Exporter:
■ Name and Address: Customer, with the entity name and address set out in the Order Form.
■ Contact person: As set out in the Order Form (or, if none is listed, Customer’s notice contact).
■ Activities relevant to the data transferred under the Standard Contractual Clauses: Performance of the Services pursuant to the Agreement and further described in this Annex I.
■ Signature: Deemed executed by Customer upon execution of the Order Form incorporating this DPA (see Annex B, Section 1).
1.2. Processor and Data Importer (when applicable): Middesk, Inc.
■ Address: 85 2nd St., Suite 710, San Francisco, CA, 94105, USA
■ Contact person: Attn: Legal Department
■ Activities relevant to the data transferred under the Standard Contractual Clauses: Performance of the Services pursuant to the Agreement and further described in this Annex I.
■ Signature: Deemed executed by Middesk upon execution of the Order Form incorporating this DPA (see Annex B, Section 1).
2. Description of Processing and Transfer
2.1. Categories of Data Subjects Whose Personal Information is Processed and Transferred:
■ Customer’s customers, whose Personal Information is supplied by the Customer to Middesk
2.2. Categories of Personal Information Processed and Transferred
■ Identifiers
2.3. Sensitive Data Processed and Transferred
■ N/A
2.4. Frequency of Transfer
■ Continuous as determined by Customer’s use of the Services
2.5. Nature of the Processing
■ To perform the entity or identity verification Services as set forth in the Order Form
2.6. Purpose of the Processing, the Data Transfer and Further Processing
■ To perform the Services and to fulfill Customer’s Instructions
2.7. Duration of the Processing
■ Duration of the Agreement
2.8. Sub-processor Processing
■ The Sub-processors will Process Personal Information as necessary to fulfill the Services and for the duration of the Agreement, and may include onward transfers to third parties located outside of the EEA for the purpose of performing the Services.