Skip to content

Data Processing Agreement

Last updated 10 November 2026 (staging draft)

This is a draft on our test site. It is under review and is not in force. The agreement in force is the one on mesura.ai.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Mesura, a division of SeyTravel Ltd (C94462) ("Processor", "we"), and the account holder who owns a top-level group, folder or tool on Mesura, either on behalf of an organisation or for their own purposes ("Controller", "you"), and of any other written agreement between us under which we process personal data on your behalf, such as a master services agreement (each an "Agreement"). Where you act on behalf of an organisation, you confirm that you are authorised to bind it to this DPA, and "you" includes that organisation. It sets out the terms on which we process personal data on your behalf under Article 28 of the GDPR and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta). Where this DPA conflicts with the Terms of Service or another Agreement on the subject of data protection, this DPA prevails.

A top-level item is a group, folder or tool that sits inside no other item. Its tree is the item together with every group, folder, round, tool and output inside it. Group data is the personal data processed in that tree.

Capitalised terms used in this Data Processing Agreement that are not expressly defined here have the meanings given to them in the Terms of Service. References to "Personal Data", "Processing", "Controller", "Processor", "Personal Data Breach" and related data protection concepts have the meanings given under applicable data protection law.

Acceptance and the controller contact

This DPA forms part of the Terms of Service. You accept it by accepting the Terms of Service when you create your account, and it applies to every top-level item you own from the moment you create it, before any personal data of the people it invites is collected there. You are its controller contact. We record who the controller is and which version of this DPA applied when the item was made. When we publish a new version of this DPA, it applies as part of the updated Terms of Service, and no separate acceptance is asked.

When ownership of a top-level item passes to another person, the controller contact passes with it, and the new owner is the controller under this DPA from that moment. When a top-level item is moved inside another, the controller of the item it joins becomes the controller for it.

Roles of the parties

For group data, including Readiness and tool answers, the reports and outputs made from them and Lenti's work on that data, and for personal data we process when delivering workshops, interviews, training or other services agreed with you in an Agreement, you are the controller and we are your processor. The controller is responsible for determining the purposes and means of the processing, identifying an appropriate lawful basis, complying with transparency obligations, responding to data subject rights where applicable, and ensuring that its instructions comply with applicable data protection law.

For group data, we act as an independent controller, and outside the scope of this DPA, only for account creation and authentication, billing, and security. We are also an independent controller for support, and for building anonymised national and sector benchmarks and improving our methodology, which use only data that does not identify individuals. All of these activities are governed by our Privacy Policy.

Subject-matter of the processing

The processing concerns the provision of Mesura for as long as your top-level item exists, and of any workshops, interviews, training or other services agreed in an Agreement for as long as that Agreement runs. Its nature and purpose are the collection, hosting, aggregation, storage, organisation, retrieval, analysis, scoring, export, deletion and other processing activities necessary for the provision of the service, including answering questions about group data with Lenti. The categories of data subject and personal data are set out in the Annex below.

Our obligations

  • We process personal data only on your documented instructions, including the configuration choices you and the Managers of your tree make in the platform, unless required otherwise by law.
  • We will ensure that any person authorised to process personal data, including any subcontractor, has committed themselves to confidentiality or is under an appropriate statutory duty of confidentiality.
  • We implement appropriate technical and organisational security measures (see below).
  • We do not use your personal data, or your users' answers or anything they type or say, to train artificial intelligence models, ours or any third party's.
  • We assist you, by appropriate measures, in responding to data-subject rights requests.
  • We assist you with your obligations on security, breach notification, data protection impact assessments, and prior consultation with the supervisory authority.
  • On the end of the service we delete or return personal data as set out below.
  • We make available the information needed to demonstrate compliance and allow for and contribute to audits, including inspections, on reasonable notice.
  • We will immediately inform you if, in our opinion, an instruction infringes applicable data protection law.

Data subject requests

The controller contact answers requests for access to and erasure of group data, for the whole of the tree. Where a data subject sends such a request to us, we pass it to the controller contact without undue delay and assist in fulfilling it. A person can always delete their own account and the data we hold for it as controller.

Records of processing activities

Where required by applicable data protection law, we shall maintain records of processing activities carried out on behalf of the controller in accordance with Article 30(2) of the GDPR.

Security measures

We maintain measures appropriate to the risk, taking account of the state of the art and the nature of the data.

  • Default-deny database access rules, with all writes mediated by a server-side API that validates input before any data is stored.
  • Pseudonymisation of assessment responses against a one-way token, with the token-to-account mapping held only within Mesura's systems, never shown to the controller and not readable from the platform except through the access controls in this list.
  • Aggregation before any result is shown to a group, published in batches of at least five new people, with suppression of any group smaller than five, so that no single person's answers can be read from a change in the figures.
  • Emailed survey links stop working fourteen days after their round closes and are deleted thirty days later; report links can additionally require a password, a one-time code sent to a listed email address, or both.
  • Records of the emails we send are kept for ninety days and hold no survey links or message content.
  • Every read of personal data by Mesura staff, and every session in which they view the platform as a client, is recorded in an audit trail kept for two years.
  • Encryption in transit and at rest, access controls, and role-based authorisation enforced server-side.
  • Regular encrypted backups kept for 90 days, after which backed-up data is permanently overwritten.
  • A password policy for every account (at least ten characters, mixed case and a number, common passwords refused), with passwords held only as salted one-way hashes by the authentication provider.
  • Protection against automated abuse: Firebase App Check with reCAPTCHA Enterprise, rate limits on password reset, invitations, survey emails, survey links and protected reports shared across all servers (sign-in attempts are limited by the authentication provider), and a ceiling on how far the backend can scale.
  • Irreversible administrative actions, such as restoring or deleting backups and permanently erasing data, run only after a second Mesura operator approves them by email, and every request and decision is logged.
  • Mesura staff accounts with administrative access can only be used from devices approved by email, with each approval expiring after thirty days and every approval logged.
  • Security headers on every site, including HTTPS enforcement and protection against being embedded by other websites.
  • Continuous monitoring of software dependencies and of the code repository for known vulnerabilities and exposed credentials, with security updates applied promptly.

We review and update our technical and organisational measures on a periodic basis to ensure they remain appropriate having regard to technological developments and evolving security risks.

Audiences and young people

Accounts are for people aged 16 or over, as the Terms of Service require. People under 16 answer tools only by a group link or a participant code, without an account. Readiness rounds are for adults, and you invite only people aged 18 or over to a round you run.

Every group, round and tool that collects answers declares its audience: adults, mixed, or under 18. Readiness rounds are always for adults. Where the audience is mixed or under 18, answers come only by a group link or a participant code, the tool asks for no identifying details in free text, no product analytics run, Lenti does not read the data, results open only with a password, and no output is ever per person.

Lenti

Lenti is Mesura's AI assistant. When it works on group data, we process that data as your processor under this DPA.

  • Lenti reads only the data the person asking may already see, prepared for that person and the audience of the data.
  • For a group's Readiness results, Lenti reads the same published figures as the report, which never cover fewer than five people besides the person asking. Comparisons between questions need at least twenty people besides the person asking.
  • For a tool's results, Lenti reads grouped figures only, and, for adult audiences, written answers after names, email addresses and phone numbers have been removed on our servers.
  • Lenti never reads data from a mixed or under-18 audience, and accepts no files about it. Other files pass the same removal before they reach the AI model.
  • Anything Lenti produces from group data is shared under the same rules as its source.
  • Lenti conversations are kept with the group they belong to, and are deleted with it.

Sub-processors

You authorise us to engage the sub-processors listed below, each bound by written confidentiality, data-protection, security, and intellectual-property obligations no less protective than this DPA. This is a general written authorisation under Article 28(2) of the GDPR. Before we add or replace a sub-processor we will give you at least thirty (30) days' prior notice, together with the information reasonably required to assess it, and we will not appoint it before that period ends. You may object on reasonable data-protection grounds within that period. If you do not object, the updated list of sub-processors is treated as accepted. If we cannot address your objection, we will not use that sub-processor for your data or you may terminate the affected part of the service. We remain responsible for our sub-processors' acts and omissions.

  • Google (Firebase). Authentication, database, file storage, and backend hosting, with the database and file storage in Google Cloud's European Union locations (Belgium and the Netherlands) and the backend in Belgium, and reCAPTCHA Enterprise (through Firebase App Check) to protect the service from automated abuse.
  • Google Cloud Speech-to-Text and Text-to-Speech, at Google Cloud's European Union endpoints. Turning speech to Lenti into text, and reading Lenti's replies aloud.
  • Anthropic. The AI model behind Lenti's replies, receiving only what Lenti may read under the rules above.
  • Stripe. Subscription billing and payment processing.
  • MailerSend. Transactional email delivery.
  • PostHog (hosted in the European Union). Product analytics without cookies, never the content of answers or anything typed.
  • Sentry (hosted in the European Union). Error and performance monitoring, without personal details.

We may also engage a subcontracted ethics adviser, bound by confidentiality, who reviews our survey instruments and does not receive identifiable individual data.

International transfers

Personal data is stored and processed in the European Union: the database and file storage in Google Cloud's EU locations and the backend in Belgium. Account sign-in details are held by Firebase Authentication, a global Google service. Where Firebase Authentication, or any other sub-processor, processes data outside the European Economic Area, that transfer is covered by an adequacy decision or by Standard Contractual Clauses with appropriate supplementary measures together with any additional safeguards required under applicable data protection law.

Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA, by email to every Manager in the affected tree, including the controller contact, and will provide all information reasonably available to us regarding:

  • The nature of the breach;
  • The likely consequences;
  • Measures taken or proposed; and
  • Contact details for further information.

Data ownership and export

Without prejudice to the Terms of Service, all personal data you provide and the platform-generated outputs derived from it, such as survey responses, analytics, and readiness data, remain your property or under your control. Upon termination or expiry of the service, and subject to the export period specified in the Terms of Service, we will provide an export of your data and outputs in a commonly used format, in addition to the deletion or return below.

Controller instructions

You may provide additional documented instructions during the term of this DPA, provided that such instructions are consistent with the Terms of Service and the nature of the service. Where additional instructions require material additional effort or expense, the parties may agree an appropriate adjustment to the applicable fees.

When the owner leaves

When a group's owner leaves or erases their account, ownership passes to a Manager given access to that group directly, the longest-standing first. If there is none, the group is frozen: it takes no new answers and its sharing cannot change. Its Managers and Viewers are told by email and have 30 days to claim it, after which its group data is deleted as set out below. Before that, each respondent's own take is kept in their own account.

Deletion and return

Upon termination or expiry of the service, or on your written request, we delete or return personal data processed on your behalf and delete existing copies, unless continued retention is required by law. Erased data is removed from live systems immediately and ages out of encrypted backups within 90 days, after which it is permanently overwritten. An answer that already counts towards your published results is separated from the person immediately, its written answers are removed at once, and the rest leaves those results at their next update, so that no single person's answers can be read from the change; in a closed round only its scored numbers remain, as an anonymous part of the totals. Anonymised aggregate data that no longer identifies any individual is not subject to this requirement.

The anonymisation boundary

Data leaves our processing on your behalf and enters our own controller activity only once it has been aggregated to the point where it no longer identifies any individual or small group. Individual records that remain attributable to a person, even via the response token, are processed only as your processor under this DPA.

Liability

Liability under this DPA is governed by the Terms of Service, except that breaches of data-protection obligations are not subject to the liability cap in those terms.

Government access requests

Unless prohibited by law or a legally binding order, we will promptly notify the controller of any legally binding request from a public authority for disclosure of personal data processed under this DPA before complying with such request.

Assistance

Assistance provided under this DPA shall be provided without additional charge where it forms part of the ordinary operation of the service. Where the controller requests assistance requiring material additional work or expense, the parties may agree reasonable additional fees.

Governing law

This DPA is governed by the laws of Malta, and the Maltese courts have exclusive jurisdiction over any dispute arising from it.

Annex. Description of processing activities

Categories of data subject. Members of your groups and people invited to your Readiness rounds; people who answer your tools by a link or a participant code, who may be under 18 where the tool's declared audience allows it; participants in workshops, interviews and training we deliver for you; and the Managers and Viewers given access to your tree.

Categories of personal data. Identification and contact data (name, email, role, organisation, profile photo); assessment and tool responses, including attitudes, self-assessed knowledge, and free-text answers; participant codes; optional non-scored survey items such as age range; questions asked of Lenti about group data, files attached to them, Lenti's replies and recordings of replies read aloud; attendance records and notes or answers from workshops, interviews and training; and technical and log data. We do not require special-category data, and ask data subjects not to include sensitive information in free-text answers or in messages to Lenti.

Duration. For as long as your top-level item exists or an Agreement runs, whichever is later, and the deletion period described above.

Contact

For data-protection matters, email support@mesura.ai. SeyTravel Ltd (C94462), 6 Triq il-Papa Piju XII, Birkirkara, Malta.