Research / Education Processing Addendum

This Addendum governs a single defined Project. The Project is described by the following particulars, completed by the parties for this Project:

• Research / education purpose: [__________]
• Pilot / project identifier: [__________]
• Controller identity: [__________]
• Categories of participants: [__________]

Magif processes Project personal data only for the purpose stated above and only on the documented instructions of the Controller. Magif does not process Project personal data for any purpose outside the Project scope defined in this Section, except where required by applicable law, in which case Magif informs the Controller before processing unless the law prohibits such notice.

Where any particular in this Section is left blank, the corresponding scope, purpose or category is governed by the Standard DPA and the Controller's separate documented instructions.

Magif retains Project personal data in active systems only for the period the parties agree for this Project.

• Project-specific retention period: [__________]
• Defined end point T2 and maximum retention after T2: [__________]

On expiry of the applicable period, Magif deletes the Project personal data from active systems in accordance with Section 3. Where a retention field above is left blank, the retention periods of the Standard DPA apply and no shorter or longer Project-specific period is promised.

Magif does not extend Project retention beyond the agreed period without the Controller's documented instruction, save where retention is required by applicable law.

Project personal data held in Magif backups is encrypted. Backups expire on a rolling schedule, and Magif's backup retention does not exceed one year.

When Project personal data is deleted from active systems, residual copies may persist in encrypted backups until those backups expire on their normal rolling schedule. During that residual window, the data remains encrypted and is not restored to active use except to recover the service after an incident.

• Backup residual period for this Project: [__________]

Where the backup residual field is left blank, the residual period is the normal rolling expiry described above, which is at most one year.

Magif supports the following deletion capabilities for the Project, on the Controller's documented instruction:

• Participant-level deletion: Magif deletes the Project personal data of an individual participant on request.
• Whole-study deletion: Magif deletes all Project personal data for the Project on request.

Deletion applies to active systems on receipt of a valid instruction. Residual copies in encrypted backups are handled as described in Section 3 and are removed when those backups expire.

Magif does not train any model on, and does not otherwise reuse, Project personal data that is scheduled for or subject to a deletion instruction.

On the Controller's request, Magif provides written confirmation when Project study data has been deleted from active systems, and states the date on which active deletion was completed and the residual backup window that then applies under Section 3.

Such confirmation is provided for participant-level deletion and for whole-study deletion. Magif provides this confirmation on request rather than automatically for every deletion, unless the parties agree otherwise for the Project.

Magif does not use customer or participant content from the Project to train, fine-tune or otherwise develop any machine-learning model.

Project content is processed solely to deliver the service for the Project. It is not incorporated into training data, evaluation sets or model-improvement pipelines.

Where the parties agree in the Standard DPA or in this Addendum that Project content will not be used for general product improvement, Magif does not use Project content to improve, benchmark or develop its general products or services outside the delivery of the Project.

This commitment applies to the extent the parties have contractually agreed it. Absent such agreement, the Standard DPA governs any product-improvement processing.

Access to Project personal data by Magif support and engineering personnel is restricted to a need-to-know basis. Only personnel who require access to operate the service, resolve a support request or respond to an incident for the Project may access Project personal data, and only to the extent needed for that task.

Magif's personnel are bound by confidentiality obligations. Magif does not represent that access to conversation content is currently logged; any such logging commitment, if agreed, would be recorded separately and is not promised by this Addendum.

Core processing of Project personal data takes place in the European Union. Details of Magif's processing locations and infrastructure are published at /trust/data-residency.

Any transfer outside the European Union is handled in accordance with the Standard DPA, including appropriate safeguards.

The Controller may raise a security or data-protection incident concerning the Project through the incident contact channel set out in the Standard DPA. Magif notifies the Controller of a personal data breach affecting the Project without undue delay after becoming aware of it, in accordance with the Standard DPA.

• Project-specific breach-notification period: [__________]

Where the field above is completed, Magif notifies the Controller within that period for the Project. Where it is left blank, the breach-notification timing of the Standard DPA applies and no separate Project-specific period is promised.

Magif engages subprocessors in accordance with the Standard DPA, and gives the Controller notice of intended changes to subprocessors so that the Controller may object.

• Project-specific subprocessor-notice period: [__________]

Where the field above is completed, Magif gives the Controller that period of advance notice of subprocessor changes for the Project. Where it is left blank, the subprocessor-notice period of the Standard DPA applies and no separate Project-specific period is promised.

This Section applies only where the parties complete it for the Project. It is otherwise not in force and imposes no obligation.

• Research publication / controller-role transfer terms: [__________]

Where completed, these terms govern any agreed handling of research outputs, publication of anonymised or aggregated results, and any transfer of the controller role for the Project. Where left blank, no research-publication or controller-role-transfer terms are agreed under this Addendum, and the roles and responsibilities in the Standard DPA continue unchanged.

This Addendum supplements and is governed by the Standard DPA. Where this Addendum conflicts with the Standard DPA, the term more protective of the Project's research or education participants prevails for the defined Project.

This Addendum takes effect for the Project when signed by both parties and remains in force for the duration of the Project and until Project personal data has been deleted in accordance with Sections 2 to 5. Blank fields in this Addendum indicate that no Project-specific commitment beyond the Standard DPA has been agreed for that item.