Data Processing Addendum

Last updated: October 27, 2026. This Addendum forms part of the Terms of Service and applies automatically, without signature, whenever MWD STD processes personal data on the Customer's behalf and the Customer is subject to the GDPR, the UK GDPR or the Swiss FADP. Where the Customer needs a countersigned copy, request one at [email protected].

1. Scope and roles

1.1 This Data Processing Addendum (the "DPA") governs the processing by MWD STD Inc., 1330 Blackthorne Dr, Houston, TX 77094, United States ("MWD STD") of personal data that the Customer includes in Customer Data and that MWD STD processes on the Customer's behalf in providing the Services ("Customer Personal Data"). Capitalised terms not defined here have the meaning given in the Terms of Service.

1.2 For Customer Personal Data the Customer is the controller (or, where the Customer acts for its own clients, a processor acting on their instructions) and MWD STD is the processor. Customer Personal Data is the personal data contained in the Customer's projects, calculation inputs and attachments, wherever MWD STD processes it, including project files or excerpts the Customer sends to support. For account, technical, billing and support data — the support conversation itself, the sender's details and the technical metadata of requests — MWD STD is an independent controller, as described in the Privacy Policy; this DPA does not apply to that data.

1.3 The Services are an engineering tool and are not designed to process personal data. Customer Personal Data is normally limited to names, job titles and contact details that appear in project metadata or reports. The Customer must not include special categories of personal data, data about criminal convictions, or data of children in the Services.

1.4 In the event of a conflict between this DPA and the Terms of Service, this DPA prevails for the processing of Customer Personal Data; the Standard Contractual Clauses incorporated in Section 8 prevail over this DPA.

2. Definitions

"Data Protection Laws" means the GDPR (Regulation (EU) 2016/679), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data-protection law that applies to the processing of Customer Personal Data. "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018. "Sub-processor" means a third party engaged by MWD STD to process Customer Personal Data. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data. "Controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the GDPR.

3. Details of the processing

3.1 Subject matter and purpose: providing the Services, that is running the well-design calculations the Customer requests and returning the Results, and handling the Customer's support requests.

3.2 Nature: transient processing of calculation inputs on MWD STD's servers; temporary holding of the inputs and results of asynchronous jobs in a job queue; handling, in the support mailbox and for that request only, of project files or excerpts the Customer sends to support; no other storage, since projects are kept in the Customer's browser and technical logs hold no request contents.

3.3 Duration: for as long as the Customer uses the Services, and thereafter only for the retention periods in Section 7.

3.4 Data subjects: the Customer's personnel and, where the Customer works for its own clients, those clients' personnel whose details the Customer includes in projects or reports.

3.5 Categories of personal data: names, job titles, employer, business contact details and similar identifiers appearing in project metadata or report titles. No special categories.

4. MWD STD's obligations as processor

4.1 Instructions. MWD STD processes Customer Personal Data only on the Customer's documented instructions, which are the Terms of Service, this DPA and the Customer's use of the Services' functions, unless required to do otherwise by the law to which MWD STD is subject; in that case MWD STD informs the Customer of the legal requirement before processing, unless the law prohibits it. MWD STD informs the Customer without delay if, in its opinion, an instruction infringes Data Protection Laws.

4.2 Confidentiality. Persons authorised by MWD STD to process Customer Personal Data are bound by confidentiality obligations and have access only to the extent needed for their role.

4.3 Security. MWD STD implements the technical and organisational measures described in Annex II and maintains them at a level appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature of the processing.

4.4 Assistance. Taking into account the nature of the processing, MWD STD assists the Customer, by appropriate technical and organisational measures and insofar as this is possible, in responding to requests from data subjects to exercise their rights, and in meeting the Customer's obligations regarding security, Personal Data Breach notification, data-protection impact assessments and prior consultation under Articles 32 to 36 of the GDPR. MWD STD forwards to the Customer, within five business days, any request it receives from a data subject that concerns Customer Personal Data, and does not respond to it except to refer the data subject to the Customer.

4.5 Personal Data Breach. MWD STD notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data, to the Customer's account email address, providing the information reasonably available to it at the time and supplementing it as further information becomes available.

4.6 Deletion and return. The Services keep no projects, apart from files the Customer has sent to support, so at the end of the Services the Customer already holds its own data. On termination, or earlier on the Customer's written request, MWD STD, at the Customer's choice, returns to the Customer or deletes any Customer Personal Data it still holds — the contents of the job queue and any project files or excerpts in the support mailbox — and deletes existing copies, unless the law to which MWD STD is subject requires storage, in which case MWD STD keeps the data only as long and to the extent required and continues to protect it under this DPA. Data already deleted under Section 7 need not be recovered. MWD STD confirms deletion in writing on request. If the Customer makes no choice within 30 days of termination, MWD STD deletes.

4.7 Information and audits. MWD STD makes available to the Customer the information necessary to demonstrate compliance with Article 28 of the GDPR, including this DPA, the Privacy Policy, Annex II and answers to reasonable written questions. The Customer, or an independent auditor bound by confidentiality and mandated by the Customer, may audit MWD STD's compliance with this DPA at reasonable intervals — normally once in any twelve-month period, on at least 30 days' written notice — and, on such shorter notice as is reasonable in the circumstances, where there are indications of non-compliance with this DPA, after a Personal Data Breach, or where a supervisory authority requires it. Audits take place during business hours and without unnecessary disruption of MWD STD's operations, at the Customer's cost unless they reveal a material breach of this DPA by MWD STD. In deciding the scope of an audit the Customer takes into account relevant certifications and audit reports MWD STD provides, but they do not replace an audit the Customer reasonably needs.

4.8 Records. MWD STD keeps the records of processing activities that Article 30(2) of the GDPR requires of a processor.

5. Sub-processors

5.1 The Customer gives MWD STD general authorisation to engage the Sub-processors listed in Annex III and to replace or add Sub-processors. MWD STD gives the Customer at least 30 days' notice of any intended addition or replacement, by updating the Privacy Policy and by email to the Customer's account address, so that the Customer can object.

5.2 The Customer may object, on reasonable grounds relating to data protection, within 14 days of the notice. MWD STD then discusses the objection with the Customer in good faith and answers within 14 days of receiving it. If the objection is not resolved, the Customer may close its account within 30 days of MWD STD's answer, and Section 13.6 of the Terms of Service applies to any prepaid fee. For an objecting Customer the change does not take effect before the end of that closing window: MWD STD does not process that Customer's Customer Personal Data with the new Sub-processor until the objection is resolved or the account is closed, extending the change date for that Customer as needed.

5.3 MWD STD imposes on each Sub-processor, by written contract, data-protection obligations that are no less protective than those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures, and remains fully liable to the Customer for the performance of the Sub-processor's obligations.

6. The Customer's obligations

6.1 The Customer is responsible for the lawfulness of the Customer Personal Data it includes in the Services and of its instructions, for informing data subjects as Data Protection Laws require, and for having a lawful basis for the processing and, where it acts for its own clients, the authorisations those clients must give.

6.2 The Customer must not include in the Services personal data that is not needed for the well-design work, and must not include the data described in Section 1.3.

7. Retention

Customer Personal Data is held in two places only. The inputs and results of an asynchronous job are held in the job queue and deleted within 24 hours of the job completing, failing or being cancelled, and in any case within 72 hours of submission. Project files or excerpts the Customer sends to support are held in the support mailbox, used only to handle that request, not copied into any other system, and deleted when the request is closed and at the latest 90 days after receipt, or earlier at the Customer's request. Technical logs do not contain the contents of requests and are deleted within 180 days; backups of MWD STD's account database do not contain Customer Personal Data. The retention periods in the Privacy Policy apply to the data for which MWD STD is a controller.

8. International transfers

8.1 MWD STD is established in the United States and processes Customer Personal Data on its servers in the United States, and through the Sub-processors in Annex III in the locations stated there.

8.2 Transfers from the EEA. Where the transfer of Customer Personal Data from the Customer to MWD STD is subject to the GDPR, the parties enter into the Standard Contractual Clauses, which are incorporated into this DPA by reference, as follows: Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor; Clause 7 (docking clause) does not apply; in Clause 9, Option 2 (general written authorisation) applies with the notice period in Section 5.1; the optional language in Clause 11 does not apply; in Clause 13, the supervisory authority of the EEA member state in which the Customer (or its EEA representative) is established is competent; in Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; in Clause 18, disputes are resolved by the courts of Ireland; Annex I of the SCCs is completed by Sections 1 and 3 and Annex I of this DPA, Annex II by Annex II of this DPA, and Annex III by Annex III of this DPA. The Customer is the data exporter and MWD STD the data importer. The SCCs apply to the extent Chapter V of the GDPR requires a transfer tool for the transfer. Where MWD STD is directly subject to the GDPR for the processing in question under Article 3(2), so that the SCCs in their current form are not designed for the transfer, the parties nevertheless apply the SCCs' obligations between them as contractual commitments, and will replace them with the clauses the European Commission adopts for that situation once they are available.

8.3 Transfers from the United Kingdom. Where the transfer is subject to the UK GDPR, the SCCs as completed above apply as amended by the UK Addendum, whose Tables 1 to 3 are completed with the information in this DPA and in which, for Table 4, neither party may end the UK Addendum under its Section 19.

8.4 Transfers from Switzerland. Where the transfer is subject to the Swiss FADP, the SCCs apply with the adaptations the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR are read as references to the FADP, the Commissioner is the competent supervisory authority, and data subjects in Switzerland may enforce their rights before the Swiss courts.

8.5 Onward transfers by MWD STD. The Sub-processors in Annex III are all established in the United States, so the mechanism is the same for each: for transfers of Customer Personal Data from MWD STD to a Sub-processor, MWD STD relies on the Sub-processor's certification under the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework, as the transfer requires, where it is certified for that data, and otherwise on the SCCs, with the UK Addendum where applicable, in MWD STD's contract with the Sub-processor. Annex III states each Sub-processor's contracting entity and location; the mechanism relied on for each is available from MWD STD on request.

8.6 If a transfer mechanism relied on above is invalidated or becomes unavailable, the parties cooperate in good faith to put an alternative lawful mechanism in place, and MWD STD may suspend the affected processing until then.

9. Liability, term and general

9.1 Each party's liability under this DPA is subject to the exclusions and limitations in Section 9 of the Terms of Service, except that nothing limits a party's liability to data subjects under Article 82 of the GDPR or the liability of a party under the SCCs to the extent the SCCs do not permit it to be limited.

9.2 This DPA takes effect when the Customer accepts the Terms of Service and continues for as long as MWD STD processes Customer Personal Data. Sections 4.6, 7 and 9 survive its termination.

9.3 Except as stated in Section 8, this DPA is governed by the law that governs the Terms of Service. MWD STD may update this DPA as described in Section 14 of the Terms of Service; a change that reduces the protection of Customer Personal Data takes effect only after the notice period in that Section.

Annex I — List of parties

Data exporter: the Customer, identified by the organisation, country and contact email address registered in its account, acting as controller (Module Two) or, where it acts for its own clients, as processor (Module Three). The Customer supplies its registered address, its role and, where applicable, the details of its EEA or UK representative by email to [email protected], and MWD STD keeps them with this DPA.

Competent supervisory authority: the authority of the EEA member state in which the Customer (or its representative) is established, as in Clause 13.

Acceptance: the Customer accepts this DPA and the SCCs by accepting the Terms of Service; the parties agree that this electronic acceptance satisfies the SCCs' signature requirement, and that the version accepted is the one published at the date of acceptance.

Data importer: MWD STD Inc., 1330 Blackthorne Dr, Houston, TX 77094, United States, acting as processor; contact: [email protected].

Description of the transfer: as in Section 3; frequency: continuous, on each calculation the Customer runs; retention: as in Section 7.

Annex II — Technical and organisational measures

• Encrypted connections (TLS) between the Customer's browser and MWD STD's servers, and between MWD STD's servers and its Sub-processors.
• Authentication by bearer tokens held only in the browser tab's session storage; only password hashes stored, never the passwords themselves; authorisation scopes enforced on the server on every request; the administration console limited to authorised MWD STD staff.
• No storage of projects on MWD STD's servers; calculation inputs processed transiently; the job queue and the technical logs deleted within the periods in Section 7; logs without request contents.
• Network security, denial-of-service protection and traffic filtering in front of the servers; servers patched and monitored; access to servers restricted to authorised staff with individual credentials.
• Backups of the account database (not of Customer Personal Data) kept for up to 30 days in the same region.
• Security testing of the authentication layer for token forgery, mass assignment and scope bypass; review of security-relevant changes before deployment.
• Staff bound by confidentiality; access on a need-to-know basis; a process for notifying Personal Data Breaches under Section 4.5.

Annex III — Sub-processors

Stripe processes billing data for which MWD STD is a controller (Privacy Policy, Section 5) and is not a Sub-processor of Customer Personal Data.