Data Processing Agreement

1. Definitions

Controller means the coach or organisation that determines the purposes and means of processing personal data of their clients and team members using the Motivation Drivers platform.

Processor means Initiate Sàrl, which processes personal data on behalf of the Controller to deliver the Motivation Drivers service.

Personal Data means any information relating to an identified or identifiable natural person, including names, email addresses, job titles, and assessment responses submitted through the platform.

Data Subject means the individual respondent — the client or team member — whose personal data is processed.

2. Subject Matter and Duration

The Processor processes personal data on behalf of the Controller for the purpose of delivering assessment, report generation, and AI coaching workspace services. Processing begins when the Controller first uploads or enters personal data and continues until the subscription is terminated or the Controller requests deletion, whichever is earlier.

3. Nature and Purpose of Processing

The Processor processes personal data for the following purposes:

• Storing respondent contact details (name, email, job title, organisation) provided by the Controller
• Delivering assessment questionnaires to respondents via secure email link
• Storing completed assessment responses
• Generating AI-assisted motivation profile reports
• Providing the AI coaching workspace, including session preparation, notes analysis, and coaching question generation

4. Categories of Personal Data

• Identity data: first name, last name
• Contact data: email address
• Professional data: job title, organisation name
• Assessment data: responses to 68 motivation questionnaire items and derived scores
• Coaching notes: private notes entered by the Controller (never shared with respondents or third parties)

No special categories of personal data (sensitive data) are knowingly collected. Coaches must not enter special category data into the workspace.

5. GDPR-by-Design: AI Processing Architecture

The Processor has implemented a data minimisation design for AI report generation:

• Only a respondent’s first name and job title are transmitted to the Claude API (Anthropic PBC)
• Last names, email addresses, organisation names, and assessment scores are never sent to third-party AI services
• Full names and organisation details are assembled into reports from the Processor’s own database after the AI response is received
• This architecture ensures that Anthropic PBC cannot identify any individual from data transmitted to it

6. Controller Obligations

The Controller warrants that:

• They have a lawful basis for processing the personal data of their clients and team members
• Data subjects have been informed about the assessment and how their data will be processed, including the involvement of Motivation Drivers as a data processor
• They will not upload special category personal data (health, political opinions, religious beliefs, etc.) to the platform
• They will respond to data subject requests relating to data held on the platform, with the Processor’s assistance as described in clause 8

7. Sub-processors

The Controller authorises the Processor to engage the following sub-processors:

• Anthropic PBC (USA) — Claude API. Only first name and job title transmitted. Data Processing Agreement in place.
• Stripe Inc. (USA) — Payment processing only. No respondent data transmitted.
• Unlimited.rs (Serbia) — Web hosting and database infrastructure. Full personal data stored on servers within the EU/EEA-equivalent regulatory framework.

The Processor will notify the Controller of any intended changes to sub-processors with reasonable advance notice, giving the Controller the opportunity to object.

8. Data Subject Rights

The Processor will assist the Controller in fulfilling data subject rights requests within a reasonable timeframe (and no later than 30 days):

• Access: The Processor can provide an export of all personal data held for a named respondent
• Rectification: Coaches can update respondent names, email addresses, and job titles directly in the platform dashboard
• Erasure: Coaches can delete individual respondent records from the dashboard. Deletion removes all stored data including assessment responses and reports. The Processor will permanently delete this data from backups within 30 days.
• Portability: Report data can be exported as PDF from the platform

9. Security Measures

The Processor implements the following technical and organisational measures:

• HTTPS/TLS encryption for all data in transit
• Encrypted database connections
• Access controls ensuring coach accounts can only access their own respondent data
• Password hashing using industry-standard algorithms (no plain-text password storage)
• Regular security updates to server software
• Restricted administrative access to production infrastructure

10. Data Breach Notification

In the event of a personal data breach affecting data processed under this DPA, the Processor will notify the Controller without undue delay and in any case within 72 hours of becoming aware of the breach, providing: a description of the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach.

11. Data Retention and Deletion

Upon termination of the subscription, the Processor will retain all data for 30 days to allow for reactivation or export requests, after which it will be permanently deleted. The Controller may request immediate deletion at any time by contacting support@motivationdrivers.com.

12. International Transfers

Where personal data is transferred to sub-processors outside the EEA or Switzerland, such transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, or are covered by an adequacy decision. Details of transfer mechanisms for each sub-processor are available on request.

13. Governing Law

This DPA is governed by Swiss law. The parties submit to the exclusive jurisdiction of the courts of Geneva, Switzerland for any disputes arising from this agreement.

Questions about this document? Contact us at support@motivationdrivers.com