1. Parties & scope
This DPA is entered into between the customer organisation subscribing to the MAST GRC Platform (the Controller) and MAST Consulting Group (the Processor). It applies to all personal data processed by MAST in the course of providing the Platform and related advisory services ordered through the Platform.
Where the customer's own agreement or a signed DPA between the parties conflicts with this page, the signed agreement prevails.
2. Roles of the parties
The customer determines the purposes and means of processing personal data it uploads or generates in the Platform (user accounts, evidence, audit records, risk owners, training records, DSAR content). MAST processes that data only as a processor on the customer's documented instructions. For MAST's own website visitors, marketing contacts and billing records, MAST acts as an independent controller under the Privacy Policy.
3. Details of processing
| Subject matter | Provision of the MAST GRC Platform (compliance, risk, audit, policy, training, incident and DSAR management). |
| Duration | For the term of the subscription plus the deletion window in section 11. |
| Nature & purpose | Hosting, storage, structuring, retrieval, transmission and deletion of customer records; sending transactional notifications; generating AI-assisted drafts where the customer enables that feature. |
| Categories of data subjects | Customer employees, contractors, administrators, auditors, training participants, third-party contacts, and data subjects named in DSAR or incident records. |
| Categories of personal data | Identity and contact data, job role and department, authentication metadata, activity and audit logs, task ownership, training completion, and any personal data contained in evidence or free-text fields the customer chooses to upload. |
| Special categories | Not required by the Platform. Customers should not upload special-category data unless they have a lawful basis and have configured appropriate access restrictions. |
4. Customer instructions
MAST processes personal data only on the customer's documented instructions, which comprise this DPA, the subscription terms, the Platform's configuration options, and any further written instruction the customer gives. MAST will inform the customer if, in its opinion, an instruction infringes applicable data protection law.
5. Confidentiality
6. Security measures
MAST implements the technical and organisational measures described in the Security Whitepaper, including encryption in transit and at rest, tenant isolation enforced at the database layer, role-based access control, multi-factor authentication, logging and monitoring, backup and restore testing, and secure development practices. These measures are reviewed at least annually and may be updated provided the level of protection is not reduced.
7. Sub-processors
The customer grants general authorisation for MAST to engage sub-processors. The current list is published at mastgt.com/legal/subprocessors. MAST imposes data protection obligations on each sub-processor no less protective than this DPA and remains fully liable for their performance.
MAST will give at least 30 days' notice before adding or replacing a sub-processor. Customers subscribed to change notifications may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the customer may terminate the affected service without penalty.
8. Data subject rights & assistance
The Platform provides self-service tools for access, export, correction and deletion of records, including a DSAR register. Where the customer cannot fulfil a request through those tools, MAST will provide reasonable assistance taking into account the nature of the processing. MAST will promptly forward any request it receives directly from a data subject to the relevant customer without responding to it itself, unless legally required to respond.
MAST will also assist the customer with data protection impact assessments and prior consultations to the extent the information is within MAST's control.
9. Personal data breach
MAST will notify affected customer administrators without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting customer personal data. The notification will describe the nature of the breach, categories and approximate volume of data and data subjects concerned, likely consequences, and the measures taken or proposed. A root-cause analysis follows on closure.
10. International transfers
Customer data is stored in the European Union (AWS eu-west-1, Ireland) — the Platform's current data-at-rest region, as published on the Trust Centre. Where personal data is transferred outside the EEA, the UK or the customer's jurisdiction, MAST relies on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, module two or three as applicable), the UK International Data Transfer Addendum, and equivalent mechanisms, supported by a transfer impact assessment. The SCCs are incorporated into this DPA by reference and are completed with the processing details in section 3.
11. Return & deletion
12. Audits & information
MAST makes available the information necessary to demonstrate compliance with Article 28, including certifications, audit reports and completed security questionnaires, on request under NDA. Where that documentation is insufficient, the customer may conduct an audit no more than once per year (or after a breach) with 30 days' notice, during business hours, subject to confidentiality and without disrupting other customers.
13. How to execute this DPA
To receive a counter-signed copy of this DPA, including the Standard Contractual Clauses and the completed annexes, contact privacy@mastcgroup.com or use the contact form and choose Data protection.