Version 1.0 · in force from 16 October 2026
1.1. This Annex supplements the MELP Personal Data Processing Agreement V1.1 (the "DPA"). It applies only to a Client whose agreement with MELP incorporates it. Each sub-processor in section 3 processes the Client's data only if the Client uses the feature shown next to it.
1.2. For other clients the DPA applies without this Annex, and the sub-processors listed below do not process their data.
1.3. If this Annex and the DPA conflict, this Annex prevails for the processing it covers.
2.1. Expense compensation: recognises invoices and receipts uploaded by Users, mostly from sports clubs and other sports and health providers. It extracts the provider, date, amount and service, and checks whether the expense can be categorised as tax-exempt under the rules of the Estonian Tax and Customs Board (Maksu- ja Tolliamet) and the Client's compensation rules, so the Client's approver can see whether the invoice is acceptable for payment.
2.2. AI and Ask AI, where selected, assist Users and Admins within the platform's features. Current examples: in News, Surveys and Trainings, translating texts and generating images; in Surveys and Trainings, also generating content such as survey questions and training materials; in Recognition, guiding the writer by checking the recognition text against the Client's rules before it is sent; and, with Ask AI, answering Users' questions from the Client's knowledge base.
2.3. No automated decisions. The AI only assists. Approval of expense claims and any other decision with an effect on a User is made by the Client's authorised person, not solely by automated means (GDPR Article 22).
2.4. No individual profiling. AI is not used to profile employees. It does not evaluate, score, rank or monitor any employee's performance, behaviour, engagement, health or other personal characteristics, and its output is not used to build profiles of individuals. Checking an invoice or a recognition text concerns that document only, not the person who submitted it. Aggregated, anonymous statistics at team or company level, from which no individual can be identified, are not profiling.
2.5. New AI-assisted features. MELP may add AI assistance to further features of the platform. Such features use the sub-processors listed in section 3 and are covered by the safeguards in this Annex. MELP informs the Client in the platform or by email before AI is used in a new feature, and the AI switch in section 4.4 applies to it. Adding a new sub-processor follows the notice procedure in section 4.5.
Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Used only for: expense compensation, AI, Ask AI. Purpose: AI processing through Google Cloud (Gemini / Vertex AI) for the purposes in section 2. Data: only the content submitted for each task (invoice images and text; texts to translate, image prompts and instructions for survey or training content; recognition text being checked; Ask AI questions, answers and knowledge-base documents); no employee records are sent. Location: storage in Google Cloud region europe-west1 (Belgium); AI processing on Google Cloud under Google's data residency terms.
Swedbank, AB, Konstitucijos pr. 20A, Vilnius, Lithuania. Used only for: expense compensation. Purpose: executing expense compensation payments to Users. Data: User name, surname, bank account number, payment amount and reference. Location: Lithuania / EU.
Revolut Bank UAB, company code 304580906, Konstitucijos pr. 21B, Vilnius, Lithuania. Used only for: expense compensation. Purpose: executing expense compensation payments to Users. Data: User name, surname, bank account number, payment amount and reference. Location: Lithuania / EU.
ConnectPay, UAB, company code 304696889, Algirdo g. 38, Vilnius, Lithuania. Used only for: expense compensation. Purpose: executing expense compensation payments to Users. Data: User name, surname, bank account number, payment amount and reference. Location: Lithuania / EU.
AB SEB bankas, Konstitucijos pr. 24, Vilnius, Lithuania. Used only for: MELP shop. Purpose: processing Users' own payments (co-payments) in the MELP shop. Data: User name, payment amount and reference. Location: Lithuania / EU.
Google processes the data under the Google Cloud Data Processing Addendum. Under Google Cloud's terms, Google does not use the Client's data to train its AI models.
4.1. Data minimisation. Google has no access to the Client's employee records (such as names, IDs, contact or HR data). It receives only the content submitted for each task. That content may itself contain a name, for example an invoice addressed to the employee or a recognition message naming a colleague; it is used only for the task and not combined with other data.
4.2. Health-related information. Most invoices concern sports services. Occasionally an invoice for a health service may reveal information about a User's health. MELP processes such invoices only to assess the claim, does not build profiles from them, and gives them the same protection as other Client data under the DPA.
4.3. Retention. Receipts and claim data are kept for the term of the agreement and deleted as set out in the DPA. Ask AI questions and answers are kept until the Client asks for their deletion.
4.4. Switching AI on or off. AI is switched on or off for the Client as a whole. When it is on, it applies to all AI-assisted features the Client uses (currently News, Recognition, Surveys, Trainings and Expense compensation, and any feature added under section 2.5). The Client may switch AI off at any time; Google then no longer processes the Client's data for these features, and they work without AI (expense claims are then reviewed without AI assistance). Ask AI is a separate feature: Google processes Ask AI data only if the Client uses Ask AI, independently of the AI switch.
4.5. Changes. MELP notifies Clients using this Annex at least 30 days before adding or replacing a sub-processor listed here, as set out in the DPA.
If language versions differ, the English version prevails.
