M
Mortar/Legal
Back to site

Data Processing Addendum

Last updated: 25 July 2026

This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Controller", "you") and Mortar, provided under the name MortarSec by an individual operating as a sole proprietorship established in Poland ("Processor", "MortarSec", "Mortar", "we"), for the use of the Mortar service (the "Agreement"). It governs our processing of personal data on your behalf under the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and other applicable data-protection law.

Where this DPA conflicts with the rest of the Agreement on the subject of data protection, this DPA prevails. If you require a countersigned copy for your records, email privacy@mortarsec.com.

1. Roles

You are the controller of the personal data contained in the Databricks estate you connect to Mortar. We are your processor for that data. Each party will comply with its obligations under applicable data-protection law. Where you are yourself a processor for your own customer, we are a sub-processor and the same terms apply down the chain.

For the limited personal data we determine the purposes of - website enquiries, and the identity/billing data of your Mortar account users - we act as an independent controller under our Privacy Policy, and that processing is outside this DPA.

2. Subject matter, duration, nature, and purpose

  • Subject matter: provision of the Mortar access-governance service.
  • Duration: the term of the Agreement, plus any wind-down / deletion period.
  • Nature and purpose: reading access metadata from your Databricks estate to resolve effective access, detect drift, surface risk, run access reviews and certifications, and execute access changes you initiate.
  • We process personal data only on your documented instructions, which are given through the Agreement, your configuration of the service, and your use of it. If we are required by law to process otherwise, we will inform you first unless the law prohibits it.

3. Categories of data and data subjects

Categories of personal data (as they appear in access metadata): names, usernames, and email addresses of principals in your Databricks directory; service-principal identifiers; group memberships; and the access grants, roles, and ACLs associated with those principals. Mortar does not process the contents of your data tables.

Categories of data subjects: your workforce and any other individuals who hold identities in your Databricks account (e.g. employees, contractors, and - where present - guest/B2B identities).

Special categories (Art. 9): not intentionally processed. Do not configure Mortar to ingest special-category data through free-text fields.

4. Our obligations

We will:

  1. Process personal data only on your documented instructions (Section 2).
  2. Ensure personnel authorised to process the data are under confidentiality obligations.
  3. Implement appropriate technical and organisational measures (Annex II) under Art. 32.
  4. Respect the conditions for engaging sub-processors (Section 5).
  5. Assist you, taking into account the nature of processing, in responding to data-subject requests (Art. 12-23) - including by providing the tools to locate, export, and delete a data subject's access footprint.
  6. Assist you with security, breach notification, data-protection impact assessments, and prior consultation (Art. 32-36).
  7. On your choice, delete or return personal data at the end of the service, and delete existing copies unless retention is required by law (Section 7).
  8. Make available the information necessary to demonstrate compliance and allow for and contribute to audits (Section 8).
  9. Inform you if, in our opinion, an instruction infringes data-protection law.

5. Sub-processors

You give general authorisation for us to engage sub-processors to provide the service. The current list is published at /legal/subprocessors. Each sub-processor is bound by written terms imposing data-protection obligations no less protective than this DPA, and we remain responsible for their performance.

We will give at least 30 days' notice of adding or replacing a sub-processor (by updating the list and, on request, notifying you by email so you can subscribe to changes). If you reasonably object on data-protection grounds, we will work with you in good faith to address the concern; if we cannot, you may terminate the affected part of the service.

6. International transfers

Our primary processing is in the European Union (Frankfurt). Where a sub-processor processes personal data outside the EEA/UK, the transfer is made under the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), together with appropriate supplementary measures. The sub-processor list identifies each provider's location.

7. Deletion and return

On termination or expiry of the Agreement, or on your written request, we will delete the personal data we process on your behalf within 30 days, unless applicable law requires retention. Deletion is performed with our documented tenant-deletion process, which removes all of a tenant's records across the database and leaves no orphaned data; backup copies age out on our provider's retention window. On request, we will confirm deletion in writing.

8. Audits

We will make available the information necessary to demonstrate compliance with this DPA, including our security documentation, sub-processor list, and (where available) third-party assessments. Where you reasonably require a further audit, we will cooperate, at your cost, subject to reasonable notice, confidentiality, no more than once per year absent a specific concern or a security incident, and in a manner that does not compromise other customers' security or data.

9. Personal data breach

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, and provide the information you reasonably need to meet your own notification obligations. Our public security-reporting path is security@mortarsec.com and /.well-known/security.txt.

10. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Agreement.

Annex I - Processing details

  • Controller: the customer identified in the Agreement.
  • Processor: MortarSec (Mortar), a sole proprietorship established in Poland.
  • Data subjects: individuals holding identities in the customer's Databricks account (Section 3).
  • Categories of data: access-metadata personal data (Section 3).
  • Special categories: none intended.
  • Frequency: continuous / on-schedule, per the customer's scan configuration.
  • Nature and purpose: access-governance analysis and customer-initiated access change (Section 2).
  • Retention: for the term; scan snapshots default to a rolling 90 days; deletion per Section 7.

Annex II - Technical and organisational measures (Art. 32)

  • Tenant isolation. Every customer's data is isolated by PostgreSQL row-level security under a restricted database role that cannot bypass it, in addition to application-layer scoping. Isolation is verified by an automated cross-tenant test in our CI.
  • Encryption. Connection credentials and secrets are encrypted at rest (Fernet / AES) with a key held outside the database; all traffic is encrypted in transit (TLS). API tokens are stored only as salted hashes.
  • Least-privilege / read-only scanner. The scanner authenticates read-only; writes to your estate execute under a human's own identity, never a shared privileged service principal.
  • Audit. A tamper-evident, per-tenant hash-chained audit log records governance actions.
  • Access control. Administrative access to production is limited, authenticated, and protected by multi-factor authentication.
  • Monitoring. Error and integrity monitoring with secret-scrubbing before any event leaves our infrastructure.
  • Secure development. Parameterised database access, input escaping for generated documents/exports, signature-verified webhooks, dependency vulnerability monitoring, and a published responsible-disclosure policy.

A fuller description is available in our Security & Trust Pack on request (security@mortarsec.com) and summarised at /security.

Annex III - Sub-processors

See the live list at /legal/subprocessors.