Mistral AI Data Processing Addendum

This document is a data processing agreement that sets out how Mistral AI handles personal data it processes on a business customer's behalf. Mistral AI is only permitted to use that data to deliver its products, not for broader commercial purposes, and must delete or return all data after the service ends. Mistral AI may also use personal data to train its AI models as a Controller, unless the customer has opted out or uses a product that defaults to opted-out.

This Data Processing Addendum establishes the terms under which Mistral AI processes Personal Data as a Processor on behalf of Customer, confining all processing to what is necessary to provide the Mistral AI Products within the direct Processor-Customer relationship. Mistral AI is prohibited from combining Personal Data with other data it collects or from processing it for any commercial purpose outside service delivery. Customer bears the obligation to provide required notices and obtain all consents under Applicable Data Protection Law. Mistral AI retains a distinct Controller role for AI model training purposes, subject to Customer opt-out rights. The addendum incorporates Module 4 Standard Contractual Clauses for International Data Transfers, requires prompt breach notification, mandates ongoing technical and organizational security measures, and preserves Mistral AI's liability for Subprocessor failures under a prior and general authorization to engage Subprocessors.

For individuals whose personal data is processed through a business customer's use of Mistral AI products, this document limits Mistral AI to processing that data solely to provide those products and prohibits combining it with other datasets. Mistral AI may process personal data as a Controller to train its AI models unless the business customer has opted out of training or uses a product that defaults to opt-out. If your organization is a Mistral AI customer, it can opt out of AI training data use, which stops Mistral AI from acting as Controller over your personal data for that purpose.