Last updated: October 30, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Mimosa Solutions LLC ("Processor", "we") and the customer using Jayform ("Controller", "you"). It applies when we process personal data on your behalf under the GDPR, the UK GDPR, the Swiss FADP or similar laws ("Data Protection Law").
1. Subject matter and duration
We process personal data contained in Customer Data to provide Jayform for as long as you use the Service, and until deletion under section 9.
2. Nature and purpose
Hosting, storing, displaying, routing, analysing and transmitting Customer Data to provide the features you use: AI agent and chatbots, live chat and inbox, forms, booking, campaigns, search, analytics and integrations.
3. Data subjects and categories of data
- Data subjects: your website visitors, leads, customers, candidates and other contacts; your team members.
- Personal data: contact details (name, email, phone), conversation content, form answers, booking details, files, page views and technical data (IP address, browser, pages visited), consent records, and any other data you or your contacts submit.
- Special categories: only if you choose to collect them; you are responsible for having a legal basis and appropriate safeguards.
4. Your instructions
We process personal data only on your documented instructions, which are these Terms, this DPA and your use and configuration of the Service, unless the law requires otherwise; in that case we will tell you unless the law forbids it. We will tell you if we believe an instruction breaks Data Protection Law.
5. Confidentiality
Everyone we authorize to process personal data is bound by confidentiality.
6. Security
We implement appropriate technical and organizational measures, including:
- encryption in transit (HTTPS/TLS) and encryption at rest of third-party credentials (AES-GCM);
- password hashing (PBKDF2);
- role-based access in workspaces and an audit log;
- signed links and webhooks, and rate limiting of public endpoints;
- logical separation of each customer's workspace;
- infrastructure on Cloudflare, with its physical, network and operational security;
- backups with point-in-time recovery (Cloudflare D1 Time Travel);
- least-privilege access for our staff.
7. Subprocessors
You authorize us to use the subprocessors listed on the Subprocessors page. We impose data protection obligations on them that are no less protective than this DPA, and we remain responsible for their performance.
We will announce new subprocessors on that page and by email to account owners at least 30 days before they start processing. You may object on reasonable data protection grounds; if we can't resolve the objection, you may terminate the affected service without penalty.
Integrations you connect yourself (for example Meta, Twilio, Google, Microsoft or your CRM) are not our subprocessors: data sent to them is sent on your instruction, under your agreement with them.
8. Assistance
Taking into account the nature of the processing, we will:
- help you respond to data subjects' requests, for example by exporting or erasing contacts in the app;
- help you with security, data protection impact assessments and consultations with authorities;
- notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
9. Deletion and return
You can export your data and delete contacts or your whole workspace at any time. After deletion or the end of the Service, we delete Customer Data from active systems promptly and from backups within 30 days, unless the law requires us to keep it.
10. Audits
We will make available the information needed to demonstrate compliance with this DPA, including our subprocessors' certifications and reports. Where that is not sufficient, you may audit us once a year, with 30 days' notice, at your expense, under confidentiality and without disrupting our operations.
11. International transfers
Mimosa Solutions LLC is established in the United States. To the extent we process personal data from the EU or EEA outside it, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference:
- Module 2 (controller to processor) applies where you are a controller.
- Module 3 (processor to processor) applies where you are a processor.
- Clause 7 (docking clause) applies, and Clause 9 option 2 (general authorization, with the notice period in section 7 of this DPA).
- Clause 11's optional language does not apply.
- For Clauses 17 and 18, the governing law and courts are those of Ireland.
- Annexes I and II are completed by sections 1–3 and 6 of this DPA.
For transfers from the UK, the UK International Data Transfer Addendum applies. For transfers from Switzerland, the SCCs apply with the references adapted to the Swiss FADP.
Our subprocessors that receive EU personal data in third countries rely on the EU–U.S. Data Privacy Framework or on Standard Contractual Clauses.
12. Precedence
If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.
Contact
Mimosa Solutions LLC — privacy@jayform.com