Data Processing Addendum

Last updated: 18 October 2026

The Data Processing Addendum is offered to business customers. This outline is the basis for the full text, which is drafted by a lawyer. To sign it, email support@metacaliper.com.

• Parties and roles. The customer is controller; Crystal Lotus Solutions LLP is processor for personal data in Customer Data.
• Subject matter and duration. Providing the Service for the subscription term, plus the export and deletion period in the Terms.
• Nature and purpose. Hosting, retrieving, comparing, storing, deploying and pushing Salesforce metadata and repository content on the customer’s instructions.
• Categories of data. Names, usernames and email addresses that appear in metadata, commit history and audit records; Members’ account data.
• Data subjects. The customer’s Members, the customer’s Salesforce users named in metadata, repository contributors.
• Processor duties. Process only on documented instructions; staff confidentiality; the security measures in Annex 2; assist with data-subject requests and impact assessments.
• Subprocessors. General authorization for those listed on the Subprocessors page; 30 days’ notice of a new one, with a right to object.
• Personal data breach. Notify the customer without undue delay and within 72 hours of becoming aware, with the information available.
• Audits. Provide the SOC 2 report once certified; until then, answer a reasonable security questionnaire once a year.
• International transfers. Standard Contractual Clauses (processor to processor where applicable) and the UK Addendum.
• Return and deletion. Export available for 30 days after the end of the subscription; deletion within 90 days, including backups on their normal cycle.
• Annex 1: processing details (items 2 to 5). Annex 2: technical and organizational measures (encryption in transit and at rest, encrypted credentials, row-level tenant isolation, access control with audited operator access, logging, backups, incident response).