Processing data in a secure, fair, and transparent way is extremely important to us at Equals One Ventures Sdn. Bhd., the company of the creators of Mida.
To better protect individuals’ personal data, we are providing this agreement to govern Equals One Ventures Sdn. Bhd (“Equals One Ventures”) and your handling of personal data (the “Data Processing Agreement” or “DPA”).
If you are accepting this DPA on behalf of Customer, you warrant that:
(a) you have full legal authority to bind Customer to this DPA;
(b) you have read and understand this DPA; and
(c) you agree, on behalf of Customer, to this DPA.
If you do not have the legal authority to bind Customer, please do not accept this DPA.
The Parties agree that Customer is the Data Controller and that Equals One Ventures is its Data Processor in relation to Personal Data that is processed in the course of providing the Service.
“You” or “Customer” refers to the company or organization that signs up to use Equals One Ventures Service to improve the user experience of Customer's website, applications or other digital products.
“Agreement” means Mida’s Terms of Service available at https://www.mida.so/terms, together with any order form, quote or other written agreement between the Customer and Equals One Ventures for the Services, as amended from time to time.
“Personal Data” means any information relating to an identified or identifiable natural person to the extent that such information is protected as personal data under applicable Data Protection Law as defined in GDPR, or other relevant data protection legislation in respect of the Personal Data.
“User Data” means Personal Data related to the Users, more specifically as detailed in Annex A to this DPA.
“Customer Account Data” means any Personal Data other than User Data that is provided by the Customer or collected by Equals One Ventures from the Customer, during the Services and includes any Personal Data of any employee or other personnel of the Customer relating to the Customer’s relationship with Equals One Ventures, including but not limited to, Personal data collected for Customer’s account, billing or payment information of individuals that Customer has associated with its account, contact data required for managing its relationship with Customer, or as otherwise required by applicable laws and regulations.
"Controller" means an entity that determines the purposes and means of the processing of Personal Data.
"Processor" means an entity that processes Personal Data on behalf of the Controller.
“Data Protection Laws” means the relevant and applicable data protection and data privacy laws, rules, and regulations applicable to Personal Data. Data Protection Law(s) shall include but not be limited to, the GDPR.
“Data Subjects” shall have such meaning as provided under the GDPR.
"EU Data Protection Law" means (i) prior to May 25, 2018, Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of Personal Data and on the free movement of such data ("Directive") and on and after May 25, 2018, Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); and (ii) Directive 2002/58/EC concerning the processing of Personal Data and the protection of privacy in the electronic communications sector and applicable national implementations of it (in each case, as may be amended, superseded or replaced).
"Processing" has the meaning given to it in the GDPR and "process", "processes" and "processed" shall be interpreted accordingly.
"Security Incident" means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Personal Data.
"Services" means the services provided to the Customer or any other activities performed on behalf of the Customer by Equals One Ventures, pursuant to the Agreement.
"Sub-Processor" means any third-party appointed by or on behalf of Equals One Ventures to Process Personal Data on behalf of the Customer in connection with the Agreement.
2.1 User Data Collection
The Services collect User Data as specified in Annex A. User Data is pseudonymised in accordance with industry standards to minimise the identifiability of individual data subjects, as described in Annex A. Equals One Ventures shall not Process any other User Data other than those specified in Annex A.
2.2 Consents
Customer shall ensure compliance with all Data Protection Laws while collecting and providing any Personal Data to Equals One Ventures, including without limitation, ensuring that all required consents, to the extent applicable, have been taken from Users and/or other data subjects.
2.3 Customer Processing Instructions
Equals One Ventures shall comply with, and Process all User Data according to, the written and documented instructions received from the Customer and in the manner described under this DPA (including Annex A). Equals One Ventures shall endeavour to inform the Customer if it reasonably believes that any of the instructions received from the Customer violate any of the Data Protection Laws. Such notification will not constitute a general obligation on part of Equals One Ventures to monitor and interpret the laws applicable to the Customer, and such notification will not constitute legal advice to the Customer.
2.4 Use of User Data
Unless otherwise instructed to by the Customer, the User Data shall be used only for the following purposes:
(i) Processing and storage necessary to provide the Services;
(ii) to provide product support to the Customer; and/or
(iii) disclosures as required by law or otherwise as set forth in the Agreement.
2.5 Use of Customer Account Data
Customer Account Data shall be used only for the following purposes:
(i) to manage the Customer’s account and provide access to the Services;
(ii) to provide billing and product support to the Customer;
(iii) to send service-related communications, such as security notices, changes to the Services and product updates; and/or
(iv) disclosures as required by law, necessary to enforce any rights of Equals One Ventures under the Agreement, or otherwise as set forth in the Agreement.
3.1 Compliance with Data Protection Laws
Equals One Ventures shall comply with all applicable Data Protection Laws in the Processing of any User Data.
3.2 Technical & Organisational Security Measures
Equals One Ventures shall maintain administrative, physical, and technical safeguards for protection of the security, confidentiality, integrity, and privacy of User Data. For a complete list of our Technical & Organizational Security Measures, please email privacy@mida.so. Equals One Ventures monitors compliance with these safeguards. Customer acknowledges that such security & privacy measures are subject to technical progress and development and that Equals One Ventures may update or modify the security & privacy measures at its sole discretion from time to time, provided that such updates and modification do not result in the degradation of the overall security & privacy of the Services used by the Customer.
3.3 Personnel
Equals One Ventures shall ensure that its personnel engaged in the Processing of User Data are informed of the confidential nature of the User Data, have received appropriate training on their responsibilities and are subject to obligations of confidentiality and such obligations survive the termination of that person’s engagement with Equals One Ventures. Equals One Ventures shall take commercially reasonable steps to ensure the reliability of any Equals One Ventures personnel engaged in the Processing of User Data. Equals One Ventures shall ensure that access to User Data and Personal Data is limited to those personnel who require such access to perform the Services.
3.4 Data Protection Officer
Equals One Ventures has appointed an EU representative and a Data Protection officer to monitor Equals One Ventures’s data privacy compliance globally. The appointed person can be reached by email via privacy@mida.so.
4.1 Authorized Sub-Processors
Customer agrees that Equals One Ventures may engage Sub-Processors to Process User Data on Customer’s behalf or provide the Services as listed in Annex B.
The engagement of additional sub-processors within the scope of contractual obligations is permissible, provided that: (a) Equals One Ventures has notified the Customer in advance in writing or in text form, specifying the intended start date of the outsourcing, and (b) Equals One Ventures has not received an objection from the Customer within 14 days of gaining knowledge of all relevant information.
4.2 Obligations of Sub-Processors
Equals One Ventures shall (i) enter into written agreement with the Sub-Processor imposing data protection terms that require the Sub-Processor to protect the User Data to the standard required by Data Protection Laws, and (ii) remain responsible for its compliance with the obligations of the DPA and for any acts or omissions of the Sub-processor that cause Equals One Ventures to breach any of its obligations under this DPA.
Equals One Ventures operates separate hosting regions in the United States and the European Union (Frankfurt, Germany). The Customer selects the hosting region when creating its account. User Data of accounts hosted in the EU region is stored and processed in the EU region.
References to Sub-processors in this DPA mean Equals One Ventures’ Sub-processors involved in processing of User Data, as listed in Annex B. Content delivery, DNS and security services are provided through Cloudflare’s global network, which may process limited data (such as IP addresses and request metadata) outside the EU to route and protect traffic.
Equals One Ventures personnel are located in Malaysia. Access to User Data is restricted to authorised personnel and granted only where necessary to provide the Services, including support requested by the Customer. All access is protected by the technical and organisational measures described in Section 3.2.
Customer Account Data may be processed in the United States, the United Kingdom and the European Union by the processors listed in Annex B.
Where Personal Data is transferred to a country without an adequacy decision, the Standard Contractual Clauses (Module 2) and the UK Addendum set out in Annex C apply and are incorporated into this DPA.
Equals One Ventures shall maintain records of its security standards. Upon Customer’s request, Equals One Ventures shall provide (on confidential basis) copies of relevant external third-parties audit report summaries, certification and/or other documentation reasonably required by Customer to verify Equals One Ventures’s compliance with this DPA. Equals One Ventures shall further provide written responses (on a confidential basis) to all reasonable requests for information made by Customer, including responses to information security and audit questionnaires, that Customer reasonably considers necessary to confirm Equals One Ventures’s compliance with this DPA, provided that the Customer shall not exercise this right more than once per year.
7.1 Notice of Non-Compliance
If Equals One Ventures cannot provide compliance or foresees that it cannot comply with its obligations as set out in this DPA, it agrees to promptly inform the Customer of the same. Upon such notice, the Customer is entitled to suspend the transfer and processing of any User Data or Customer Account Data.
7.2 Notice of Personal Data Breach
Equals One Ventures will notify Customer promptly and without undue delay of an actual or potential Personal Data Breach or any security exposure of Customer system or data relating to the Personal Data Breach as it becomes known or as is reasonably requested by Customer. Equals One Ventures’s notification of a Personal Data Breach will describe, to the extent possible, the nature of the Personal Data Breach, the measures taken to mitigate the potential risks and the measures that Equals One Ventures recommends Customer take to address the Personal Data Breach.
7.3 Consequences of a Personal Data Breach Notification
Equals One Ventures shall promptly take reasonable steps to minimize harm and secure User Data in the event of a Personal Data Breach. Equals One Ventures’s notification of or response to a Personal Data Breach will not be construed as an acknowledgment by Equals One Ventures of any fault or liability with respect to the Personal Data Breach.
7.4 Data Subject Requests
Any request from a data subject directly to Equals One Ventures shall be directed to the Customer. Upon instruction by the Customer, Equals One Ventures shall correct, rectify, or block any Customer Account Data to the extent they can be done by Equals One Ventures. Equals One Ventures shall cooperate to the necessary extent and provide the Customer with appropriate support wherever possible in the fulfilment by the Customer of the rights of the Data Subjects pursuant to Articles 12 to 22 GDPR, in the preparation of records of processing activities, and in the case of necessary data protection impact assessments by the Customer. Except as specified above, Equals One Ventures has no obligation to assess any Personal Data in order to identify information subject to any specific legal requirements.
7.5 Confidentiality
Information that may be disclosed in any form between Parties with respect to, or as a result of this DPA, shall be deemed to be Confidential Information. Information relating to Equals One Ventures’s database, procedures, and processes shall be considered Confidential Information.
8.1 Disposal of User Data
Equals One Ventures shall promptly, and in any event within 30 days of the date of termination/expiry of the Agreement or of a verified request, delete all User Data from its production systems. Backups are retained for a limited period and overwritten on a rolling basis, so deleted User Data is removed from backups within a further 30 days. If a backup is restored, deletions made after that backup was created are re-applied before the restored data is returned to service.
8.2 Retention of User Data
Equals One Ventures may retain User Data to the extent required by applicable laws and only to the extent and for such period as required by applicable laws, provided that the provisions of this DPA will continue to apply in respect of any User Data retained during the duration of such retention.
9.1 Limitation of Liability
Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to the Agreement or this DPA, whether in contract, tort, or under any other theory of liability, is subject to the “Limitation of Liability,” as mentioned in the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party under the entire Agreement, including this DPA.
At Equals One Ventures, we prioritize the privacy and security of your User Data. The data is processed in accordance with applicable data protection laws and the principles of privacy by design and default.
“User Data” means Personal Data related to the end-user of Customer’s Properties or platform, more specifically as detailed in Annex A to the DPA.
“Customer Account Data” has the meaning given in Section 1 of this DPA.
Customer Account Data is limited to information about the Customer’s own personnel who use or administer the Services, such as the names and business email addresses of the Customer’s Mida users, billing contacts, and the content of support conversations. It does not include User Data. Equals One Ventures uses Customer Account Data only for the purposes set out in Section 2.5.
This Annex forms part of the Data Processing Agreement (“DPA”) between the Customer (“Data Exporter”) and Equals One Ventures (Mida) (“Data Importer”).
It governs international transfers of personal data from the EU/EEA and the UK to countries that do not have an adequacy decision under GDPR or UK GDPR.
The parties agree that the European Commission’s Standard Contractual Clauses (June 4, 2021), Module 2 (Controller → Processor), are hereby incorporated by reference in full and apply to all international transfers of EU/EEA Personal Data under this DPA.
The SCCs are available at:
https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj
A. List of Parties
B. Description of Transfer
C. Competent Supervisory Authority
Where the Customer is established in the EU, the competent authority is:
If the Customer is not established in the EU but falls under GDPR, the competent authority is:
The technical and organisational measures described in Section 3.2 of the DPA apply and are incorporated here by reference.
As set out in Annex B of the DPA.
(ICO Addendum, March 21, 2022 version)
The International Data Transfer Addendum to the EU Commission SCCs (“UK Addendum”) is hereby incorporated by reference for all transfers of UK Personal Data to the Data Importer.
Official text:
https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf
Completed as in Annex I(A) above.
The SCCs listed in Part A of this Annex are adopted for UK data, including all options and modules selected.
Matches Annex I, II, and III of the SCCs above.
The mandatory clauses of the UK Addendum (Section 1–12) apply in full and are incorporated by reference.
By entering into the DPA, the parties are deemed to have executed this Annex as of the DPA Effective Date.
Customer (Data Exporter)
Agrees by accepting the DPA.
Equals One Ventures (Data Importer)
Agrees by providing the Services.
Mida is 10X faster than anything you have ever considered. Try it yourself.
Mida.so is a super lightweight A/B testing tool to help you experiment, analyze and implement conversion strategies in minutes.
Still deciding?
A quick screen share on your actual site — no slides, no generic tour. Just your questions answered.
30 min · no commitment · no sales pressure