Art. 28 GDPR · Last updated: 2026-07-05
This Data Processing Agreement ("DPA") is entered into between MemPalace Cloud (JC Software GmbH) as Processor and the Customer as Controller, and governs the processing of personal data under Art. 28 GDPR. By using MemPalace Cloud, the Customer accepts this DPA as part of the main Terms of Service. Customers requiring a counter-signed copy should email [email protected].
Controller ("you" or "Customer"): The entity that subscribes to MemPalace Cloud and submits personal data to the service.
Processor ("we", "us", or "MemPalace Cloud"):
JC Software GmbH
Registered seat: Hannover, Germany
Business address: Oskar-Winter-Straße 9, 30161 Hannover, Germany
Registered with Amtsgericht Hannover, HRB 227317
Represented by: Christian Schnatz and Jonathan Sauppe, Managing Directors
This Agreement defines the responsibilities of the Parties when MemPalace Cloud processes personal data on behalf of the Customer in connection with the services described in the Terms of Service. It is effective as of the date of the Customer's subscription and remains in force for as long as MemPalace Cloud processes personal data on the Customer's behalf.
MemPalace Cloud stores, indexes, and serves back memory content submitted by the Customer's AI tools via the Model Context Protocol, on the Customer's instructions, for the purpose of providing persistent memory across AI tool sessions.
Data subjects:
Categories of personal data:
Customer responsibility for third-party data (Art. 14 GDPR): Where memory content mentions third parties, the Customer remains solely responsible for discharging the information obligations under Art. 14 GDPR toward those third parties and for establishing an appropriate lawful basis. MemPalace Cloud acts only as a Processor for this content.
Special categories (Art. 9 GDPR): The Service is not designed for or intended to process special categories of personal data (health, political opinions, religious beliefs, etc.). The Customer is responsible for ensuring that special categories are not submitted to the Service.
MemPalace Cloud processes personal data only on the documented instructions of the Customer, including the Terms of Service, the API operations the Customer's AI tools perform, this DPA, and any additional written instructions. If we believe that an instruction violates applicable data protection law, we will inform the Customer immediately and may refuse to execute the instruction.
MemPalace Cloud ensures that all personnel authorized to process personal data under this Agreement have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
5.1 Confidentiality:
Disclosure on application-level encryption: Memory content is protected by disk-level encryption and strict tenant isolation, but NOT by application-layer encryption. This is a deliberate trade-off that enables server-side semantic search. Session credentials and API keys are additionally protected at the application layer (AES-256-GCM and HMAC-SHA-256). Customers processing highly sensitive data should assess whether their use case requires a Data Protection Impact Assessment (DPIA) under Art. 35 GDPR and may contact us to discuss supplementary safeguards.
5.2 Integrity: Checksummed backups, write-ahead logging, WAL-consistent backups for per-tenant SQLite files.
5.3 Availability: Daily backups with plan-based retention (7/30/365 days), defined RTO/RPO, monitoring with alerts.
5.4 Resilience: Automated failover for non-critical services, documented incident response procedures, post-mortems shared with affected Customers.
5.5 Restoration: Restore drills conducted periodically; full disaster recovery runbook documented.
5.6 Evaluation: Regular review of technical and organizational measures.
The Customer grants general authorization for MemPalace Cloud to engage the sub-processors listed below:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting, storage, DNS | Germany |
| Zitadel GmbH (self-hosted) | Authentication (runs on our infrastructure) | Germany |
| Brevo (Sendinblue SA) | Transactional email | France |
| Sentry.io (Functional Software Inc.) | Error monitoring (anonymized) | USA (DPF + SCCs) |
| Cloudflare Inc. | DNS, DDoS protection | USA / EU edge (DPF + SCCs) |
We notify the Customer at least 30 days in advance of adding or replacing sub-processors. The Customer may object within 14 days; if no mutually acceptable solution is reached, the Customer may terminate the affected services. Each sub-processor is bound by a written agreement with data protection obligations no less protective than those in this DPA.
Payments are not handled by a sub-processor. Paid plans are sold through Polar Software Inc. (Delaware, USA) as merchant of record. Polar is an independent controller for the payment and billing data it collects under its own terms and privacy policy, not a processor or sub-processor acting on MemPalace Cloud's behalf. For transfers of that payment data outside the EU, Polar relies on EU Standard Contractual Clauses (SCCs) under its own privacy policy. MemPalace Cloud does not transmit Customer card data to any sub-processor.
Primary data processing occurs in the European Union (Germany). Transfers to sub-processors outside the EU (Sentry, Cloudflare) rely on the EU-US Data Privacy Framework adequacy decision and Standard Contractual Clauses (Module 2: Controller-to-Processor).
MemPalace Cloud assists the Customer with responding to data subject requests (access, rectification, erasure, portability, restriction, objection) to the extent technically feasible. For requests directed at MemPalace Cloud directly by data subjects whose controller is the Customer, we forward the request to the Customer and do not act on it without the Customer's instruction.
MemPalace Cloud notifies the Customer without undue delay — and in any event within 72 hours — after becoming aware of a personal data breach. The notification includes: nature of the breach, approximate categories and numbers of data subjects and records affected, likely consequences, measures taken or proposed, and contact information for further inquiries. MemPalace Cloud will provide the Customer with all information reasonably necessary to enable the Customer to discharge its notification obligations toward supervisory authorities (Art. 33 GDPR) and affected data subjects (Art. 34 GDPR).
MemPalace Cloud provides reasonable assistance, upon request and to the extent technically feasible, to conduct Data Protection Impact Assessments and to consult with supervisory authorities.
On termination of the main agreement, and upon the Customer's choice, MemPalace Cloud will either delete all personal data processed on behalf of the Customer within 30 days, OR return all personal data to the Customer in a commonly used, machine-readable format (JSON export) within 30 days. Exception: data required to be retained under German tax law (billing records) for 10 years per AO § 147.
The Customer may request documentation of MemPalace Cloud's compliance with this DPA once per calendar year at no cost. Additional audits or on-site inspections require at least 30 days advance notice, and the Customer bears the costs.
Liability for violations of this DPA is governed by the main Terms of Service, subject to the limitations and exclusions therein. GDPR Art. 82 (right to compensation) remains unaffected.
In case of conflict between this DPA and the Terms of Service, this DPA prevails for matters of personal data processing. This DPA is governed by German law; jurisdiction is Hannover, Germany. If any provision is held invalid, the remaining provisions remain in full force.
For a counter-signed copy of this DPA, email [email protected] with your company details. We respond within 5 business days.