Legal
Data Processing Addendum
The terms on which Morphcloud processes personal data for its customers.
Version 1.0. Published on 13 November 2026.
Between: Morphcloud Limited, a company registered in England and Wales with company number 13971988, of 25 Fentiman Road, Oval, London, SW8 1LD (“Morphcloud“), and the customer that accepts the Morphcloud Service Terms, of which this Addendum forms part (“the Customer“).
1. Application
1.1 This Addendum applies when Morphcloud processes Customer Personal Data to provide its services to the Customer (“the Services“).
1.2 This Addendum forms part of the Morphcloud Service Terms (“the Agreement“). If this Addendum and the Agreement conflict on the processing of personal data, this Addendum applies.
2. Definitions
2.1 “Data Protection Law“ means the UK GDPR and the Data Protection Act 2018, as amended from time to time.
2.2 “Customer Personal Data“ means the personal data that the Customer and its users put into the Services, or that the Services collect on the Customer’s instructions.
2.3 “Sub-processor“ means a third party that Morphcloud engages to process Customer Personal Data.
2.4 Other terms, such as “controller”, “processor” and “personal data breach”, have the meanings in Data Protection Law.
3. Roles
3.1 For Customer Personal Data, the Customer is the controller and Morphcloud is the processor. Schedule 1 gives the details of the processing.
3.2 Morphcloud is a controller for the account and billing data of the Customer’s users. The Morphcloud Privacy Policy governs that data.
3.3 The Customer is responsible for the lawful basis of the processing and for the notices to data subjects. Unless both parties agree otherwise in writing, the Customer must not put special category data, criminal offence data or children’s data into the Services.
4. Morphcloud’s obligations
4.1 Morphcloud processes Customer Personal Data only on the Customer’s documented instructions, unless the law requires otherwise. The Agreement, this Addendum and the Customer’s configuration and use of the Services are the Customer’s instructions. If Morphcloud thinks that an instruction breaks Data Protection Law, Morphcloud tells the Customer.
4.2 Morphcloud makes sure that each person whom it authorises to process Customer Personal Data has a duty of confidentiality.
4.3 Morphcloud applies appropriate technical and organisational measures to protect Customer Personal Data, as UK GDPR Article 32 requires. Schedule 2 lists the main measures.
4.4 Morphcloud helps the Customer, as far as the Services make this possible, to answer requests from data subjects and to meet its obligations under UK GDPR Articles 32 to 36. If Morphcloud receives a request from a data subject about Customer Personal Data, it sends the request to the Customer.
4.5 Morphcloud gives the Customer the information that it reasonably needs to show compliance with UK GDPR Article 28. If that information is not sufficient, the Customer can audit Morphcloud, one time in each 12 months, with 30 days’ written notice and at its own cost.
5. Sub-processors
5.1 The Customer authorises Morphcloud to engage Sub-processors. The current list is published at https://morphcloud.com/legal/sub-processors.
5.2 Morphcloud gives at least 14 days’ notice before it adds or replaces a Sub-processor, by email or by an update to the published list. The Customer can object on reasonable grounds of data protection within that period. If the parties cannot resolve the objection, the Customer can end the affected Services and receive a refund of any fees paid in advance for them.
5.3 Morphcloud imposes data protection obligations on each Sub-processor by written contract, and stays liable to the Customer for its performance.
5.4 If Customer Personal Data is transferred outside the United Kingdom, Morphcloud uses a safeguard that Data Protection Law permits.
6. Personal data breaches
Morphcloud notifies the Customer without undue delay, and not later than 48 hours, after it becomes aware of a personal data breach that affects Customer Personal Data. Morphcloud gives the information that the Customer needs to meet its own obligations, as far as Morphcloud has it.
7. Deletion
7.1 The Customer can export and delete its data in the Services at any time.
7.2 After the Customer deletes data, or after the Services end and the Customer asks, Morphcloud removes the Customer Personal Data from the Services within 30 days, unless the law requires Morphcloud to keep it. Copies in backups are deleted when the backups expire, and not later than 60 days after the deletion.
7.3 Morphcloud keeps records of the use of the Services that it needs for billing and security, for as long as it needs them for those purposes.
8. General
8.1 The limits of liability in the Agreement apply to this Addendum.
8.2 The law of England and Wales governs this Addendum, and the courts of England and Wales have exclusive jurisdiction.
8.3 The Customer can contact Morphcloud about this Addendum and about Customer Personal Data at privacy@morphcloud.com.
Schedule 1 — Details of the processing
Item | Detail |
Subject matter and duration | The provision of the Services, for the term of the Agreement and until deletion under clause 7 |
Nature and purpose | Storage and processing of the Customer’s data, as the Customer configures and uses the Services, including processing by AI models |
Types of personal data | The personal data that the Customer and its users put into the Services, for example names and contact details |
Data subjects | The persons whose personal data the Customer puts into the Services, for example the Customer’s staff, clients and contacts |
Schedule 2 — Security measures
Encryption of data in transit and at rest.
Access to production limited to authorised staff, with multi-factor authentication.
Logging and monitoring of the production systems.
Backups of the production database.
Scans for known vulnerabilities, and regular penetration tests.
A documented incident response process.
Confidentiality obligations and security training for staff.
Connections that the Customer makes. If the Customer connects its own accounts or systems to the Services, the provider of that account or system is not a Sub-processor of Morphcloud.
Acceptance. A Customer that orders the Services accepts this Addendum with the Agreement. For a Customer whose order was made before this Addendum was published, this Addendum applies when the Customer agrees to it in writing, for example by a reply to the email from Morphcloud that sends it. No signature is necessary.
Security and compliance.
ISO 27001, SOC 2 Type 2 and GDPR are in progress. Oneleet shows the live status of each certification.
The agentic system builder
© 2026 Morphcloud