1. Who we are
Dubai, United Arab Emirates
The Platform is delivered from the domain mastgt.com; transactional mail is sent from notify.mastgt.com.
2. Privacy & security contacts
Data subject requests, sub-processor questions, objections to a change, or a counter-signed DPA.
Suspected incidents, vulnerability reports, and requests for certificates, SOC 2 reports or a completed security questionnaire under NDA.
Questions about the subscription terms, the DPA annexes, or negotiated enterprise agreements.
Demos, pricing, partnerships and anything not covered above.
Prefer a form? Use the contact page — security reports choose the Security topic so they reach the on-call team.
3. Notice periods we commit to
| Event | Our commitment | What it covers |
|---|---|---|
| Personal data breach | Within 72 hours | Notification to affected customer administrators after MAST becomes aware of a breach affecting customer personal data, with the nature of the breach, the categories and approximate volume of data and data subjects concerned, likely consequences and the measures taken. A root-cause analysis follows on closure. |
| New or replacement sub-processor | At least 30 days | Advance notice before a new sub-processor starts processing customer personal data. Customers subscribed to change notifications may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the affected service may be terminated without penalty. |
| Data subject request | Within 30 days | Response to a request to access, correct, port, restrict, erase or object. Where MAST acts as processor on your organisation's data, the request is routed to the tenant administrator rather than answered directly. |
| Data export window after termination | 30 days, then deletion | Customer data stays available for export for 30 days after termination. Production data is then deleted and encrypted backups age out within a further 35 days, unless retention is required by law. |
| Customer audit | 30 days' notice | Once per year (or after a breach), during business hours, subject to confidentiality and without disrupting other customers — where published documentation is not sufficient to demonstrate compliance. |
| Vulnerability report | Acknowledged in 2 business days | Critical issues remediated within 24 hours, high within 7 days, medium within 30 days. Researchers acting in good faith are not pursued for legal action. |
4. Where your data is stored
Workspace records, evidence files and backups are stored in the EU region (AWS eu-west-1, Ireland). This is the single data-at-rest location for the Platform today.
The user interface and server functions are rendered from a globally distributed edge runtime close to the user. Transactional email is sent through an EU/US-based provider from notify.mastgt.com.
Where personal data is transferred outside the EEA, the UK or your jurisdiction, MAST relies on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, module two or three as applicable), the UK International Data Transfer Addendum, and equivalent mechanisms, supported by a transfer impact assessment. The full list of third parties that process customer data, with their hosting locations, is published on the sub-processor page.
5. Policies, agreements & evidence
GDPR Article 28 terms, processing details, transfers, deletion and audit rights.
Every third party that touches customer data, what it processes and where.
Architecture, isolation, encryption, access control, monitoring and incident response.
The detailed technical control set, for vendor questionnaires and assessor review.
What MAST collects as controller, why, for how long, and your rights.
The subscription agreement between MAST Consulting Group and the customer.
Certificates, SOC 2 reports, penetration-test summaries and completed questionnaires are released under NDA from security@mastcgroup.com.
6. Raising a concern
If you believe the Platform is processing personal data unlawfully, exposing customer data, or behaving in a way that conflicts with what is published here, write to security@mastcgroup.com (security matters) or privacy@mastcgroup.com (data protection matters). Both mailboxes are read by named people, not shared inboxes, and every report is acknowledged within two business days.
Vulnerability reports are handled under the responsible-disclosure terms on the Security page: demonstrate the issue without exploiting it further, and do not access data that is not yours.