GDPR Commitment

Stackmint is committed to supporting customers in meeting their obligations under the EU and UK General Data Protection Regulation (GDPR). This page summarizes how Stackmint approaches data protection as a processor.

This summary is for informational purposes only and does not replace the terms of any Data Processing Agreement (DPA) between Stackmint and a customer.

1. Role Under GDPR

For customer-controlled data processed via the Stackmint platform, Stackmint typically acts as a processor, and the customer acts as the controller.

As a processor, Stackmint processes personal data only on documented instructions from the customer, primarily through:

• Configuration of Branches and Buds;
• Activation of integrations and model providers;
• API calls and runtime execution requests;
• Settings applied in the admin console.

2. Data Processing Agreement

Stackmint offers a Data Processing Agreement (DPA) that incorporates the obligations required by GDPR Article 28, including:

• Processing limited to customer instructions;
• Confidentiality obligations for authorized personnel;
• Appropriate technical and organizational security measures;
• Conditions for engaging subprocessors;
• Assistance with data subject requests and incident response;
• Deletion or return of personal data at the end of the engagement.

The current DPA is available at /dpa.

3. International Transfers

When Stackmint processes personal data subject to EU, UK, or Swiss data protection laws and such data is transferred to a country that does not benefit from an adequacy decision, Stackmint will implement appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms.

4. Data Subject Rights

Customers remain responsible for managing data subject requests related to their own users and data. Where a request relates to personal data processed by Stackmint on behalf of a customer, Stackmint will provide reasonable assistance to help the customer respond, in line with the DPA and applicable law.