This Data Processing Agreement ("DPA") supplements the Master Service Agreement (or, if none, the Terms of Service) between the customer that accepted those terms ("Controller") and MantisOps, LLC, a South Carolina limited liability company ("Processor") (the "Principal Agreement"). It governs how Processor handles Personal Data on behalf of Controller in connection with the MantisRMM, Mantis360, and/or MantisNMS services (the "Services"). In the event of conflict between this DPA and the Principal Agreement on matters of data protection, this DPA controls.
Capitalized terms not defined here have the meanings in the Principal Agreement. The following apply:
For purposes of this DPA, Controller is the "controller" (or "business" under CCPA/CPRA) and Processor is the "processor" (or "service provider" under CCPA/CPRA) of Personal Data.
The subject matter is Processor's provision of the Services. The duration is the Subscription Term plus any post-termination retention period required by Section 9.
Processor will Process Personal Data only to provide and improve the Services, perform billing, and comply with law.
Controller's documented instructions to Processor consist of: (a) this DPA, (b) the Principal Agreement, (c) Controller's use of the Services (configuration choices, scan targets, policy settings), and (d) any other written instructions Controller provides. Processor will inform Controller if, in Processor's opinion, an instruction violates Applicable Data Protection Law.
Processor will:
(a) Limit Processing to what is necessary to provide the Services and as instructed by Controller. Processor will not Sell or Share (as defined in CCPA/CPRA) Personal Data and will not Process Personal Data outside the direct business relationship with Controller.
(b) Implement appropriate technical and organizational security measures, as described in Annex II, including:
(c) Bind personnel with access to Personal Data to written confidentiality obligations no less protective than those in the Principal Agreement.
(d) Notify Controller of a Personal Data Breach without undue delay, and in any event within seventy-two (72) hours of becoming aware. The notification will include the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and the measures taken or proposed.
(e) Assist Controller with Data Subject Requests received directly from data subjects by forwarding them to Controller within five (5) business days. Where the Services include functionality allowing Controller to respond directly (e.g., data export), Processor's assistance is satisfied by maintaining that functionality.
(f) Assist Controller with data protection impact assessments and prior consultations with supervisory authorities required by Applicable Data Protection Law, to the extent Controller does not otherwise have access to the relevant information.
(g) Delete or return all Personal Data within thirty (30) days of termination of the Services, at Controller's option, except where retention is required by law (e.g., financial records retained for seven years for tax purposes). Backups containing Personal Data are purged on the normal retention rotation (90 days).
(h) Make available all information reasonably necessary to demonstrate compliance with this DPA and contribute to audits in accordance with Section 7.
Controller grants Processor a general authorization to engage Sub-Processors, subject to the conditions below.
The current Sub-Processors are listed at https://mantisops.net/legal/sub-processors. As of the date of this DPA:
| Sub-Processor | Service | Location | Privacy Policy |
|---|---|---|---|
| Cloudflare, Inc. | Workers, D1, R2, KV, Durable Objects, Workers Cron, DNS, CDN, DDoS — entire application-hosting and data-storage platform | United States + global PoPs | https://www.cloudflare.com/privacypolicy/ |
| Stripe, Inc. | Subscription billing, payment processing | United States | https://stripe.com/privacy |
| Resend | Transactional email delivery | United States | https://resend.com/legal/privacy-policy |
| Microsoft (Graph API) | Administrative email send-as | United States | https://privacy.microsoft.com/ |
| Quo (formerly OpenPhone) | Business phone / VoIP — sales and support calls, voicemail, SMS | United States | https://www.quo.com/privacy |
| Anthropic, PBC | AI-assisted support — triage + drafting of replies to support tickets (processes support-ticket content; human-reviewed before any reply is sent; not used to train models under Anthropic's commercial terms) | United States | https://www.anthropic.com/legal/privacy |
Processor will notify Controller by email at least thirty (30) days before engaging a new Sub-Processor that Processes Personal Data of Controller's data subjects. Controller may object on reasonable, documented data-protection grounds within that thirty-day period. If Controller objects, the Parties will work in good faith to resolve the objection; if no resolution is reached, Controller may terminate the affected Subscription Term as its sole remedy and receive a pro-rata refund of prepaid unused fees.
Processor will impose data-protection obligations on each Sub-Processor that are no less protective than those in this DPA. Processor remains liable to Controller for Sub-Processors' acts and omissions.
Where Personal Data is transferred from the EEA, Switzerland, or the UK to a country not subject to an adequacy decision, the Parties incorporate the Standard Contractual Clauses (Module Two: Controller-to-Processor) into this DPA by reference. The UK International Data Transfer Addendum applies for UK transfers. Annex III to this DPA completes the SCCs.
Processor's Sub-Processors located outside the EEA or UK are bound by SCCs or equivalent safeguards as part of Processor's contracts with them.
For Personal Data subject to CCPA/CPRA, Processor will not retain, use, or disclose Personal Data for any purpose other than the specific purpose of providing the Services as set forth in the Principal Agreement.
Processor will make available to Controller, upon written request, summary results of third-party security audits and certifications (e.g., SOC 2 reports once available, penetration test summaries).
On at least thirty (30) days' prior written notice, and no more than once per calendar year (except where required by a supervisory authority or following a confirmed Personal Data Breach), Controller may conduct or commission a qualified independent auditor to audit Processor's compliance with this DPA. Audits will be conducted during normal business hours, will not unreasonably interfere with Processor's operations, and will be at Controller's expense unless the audit reveals a material breach by Processor.
Audit reports are Confidential Information of Processor.
Each Party's liability under this DPA is subject to the limitations set forth in the Principal Agreement.
This DPA takes effect when Controller accepts the Terms of Service (or signs the Master Service Agreement) and remains in effect until termination of the Principal Agreement plus the post-termination period required for deletion.
On termination, Controller may export Personal Data via the Services for thirty (30) days. Thereafter, Processor will delete Personal Data within thirty (30) days, except where retention is required by law. Sections 4(h) (audit assistance), 7 (audit rights), and 11 (governing law) survive termination to the extent necessary to give effect to outstanding obligations.
If any provision of this DPA conflicts with the Principal Agreement on matters of data protection, this DPA prevails. If any provision of this DPA conflicts with the SCCs as incorporated under Section 6.1, the SCCs prevail.
This DPA is governed by the law specified in the Principal Agreement, except that the SCCs incorporated under Section 6.1 are governed by the law specified in those clauses.
For data subjects in the EEA: the supervisory authority of the EU member state where the data exporter is established, or if not established in the EU, the supervisory authority indicated in the SCC as competent (default: Ireland Data Protection Commission, as Processor is established in the United States and SCCs apply).
For data subjects in the UK: the UK Information Commissioner's Office.
Processor implements the following technical and organizational measures (TOMs):
See Section 5.2 above and the live list at https://mantisops.net/legal/sub-processors.
← All legal documents