Data Processing Addendum

This Data Processing Addendum applies to business customers and forms part of theTerms of Service. It is concluded automatically when a business customer accepts the Terms. Questions: privacy@algopoetica.ai.

Processor: ALGOPOETICA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, a Polish limited liability company, Aleja Jana Pawla II 43A / 37B, 01-001 Warsaw, Poland

Controller: the Customer, being a business entity that has entered into an agreement for the Algopulse service (a SaaS service for recording, transcribing and AI-summarizing online meetings)

1. Introduction and Scope

This Data Processing Addendum (“DPA”) governs the processing of personal data by Algopoetica sp. z o.o. (“Processor”) on behalf and on the instructions of the Customer (“Controller”) in connection with the provision of the Services under the underlying service agreement (“Main Agreement”). This DPA applies only to Customers acting as businesses; a consumer cannot act as a data controller under GDPR with respect to Meeting Content, and for such users Provider acts as controller under the Privacy Policy.

2. Definitions

Capitalized terms not defined herein have the meaning given in the Terms of Service or the Privacy Policy. “Personal Data”, “Processing”, “Controller”, “Processor”, “Sub-processor”, “Data Subject” and “Personal Data Breach” have the meanings given in Article 4 GDPR.

3. Subject Matter, Nature and Purpose of Processing

Processor processes personal data contained in Customer Data (recordings, transcripts, and AI-generated summaries) solely to provide the Services: recording Meetings, generating transcripts, generating AI summaries, and making them available to Controller, for the duration of the Main Agreement. Processor does not use Customer Data to train, fine-tune, or otherwise improve any AI models, whether proprietary or third-party.

4. Categories of Data and Data Subjects

Data subjects include Controller’s authorized users, Meeting participants who are not Provider’s customers, individuals referenced by name during a Meeting, and share recipients (people to whom Controller has shared a Recording under the Terms of Service). Data categories include identification data, voice and (if video is enabled) image, meeting content, and meeting metadata. Meeting content may incidentally include special category data (GDPR Art. 9) if raised by participants; Controller is responsible for maintaining its own Art. 9(2) legal basis for such data (see Section 5).

5. Controller’s Obligations

Controller warrants it has a valid legal basis for recording the Meeting and processing the personal data of all participants, fulfills the information obligation towards participants beyond the bot’s visible presence and in-meeting chat notice, and ensures compliance with applicable recording-consent laws in the jurisdictions of the participants (including the All-Party Consent standard adopted for the US market).

6. Processor’s Obligations

In accordance with GDPR Art. 28(3), Processor: (a) processes personal data only on documented instructions from Controller; (b) ensures persons authorized to process personal data are bound by confidentiality; (c) implements the security measures required by GDPR Art. 32 (Schedule B); (d) complies with the conditions for engaging sub-processors under GDPR Art. 28(2) and (4) (Schedule C); (e) assists Controller in responding to data subject requests; (f) assists Controller with its obligations under GDPR Art. 32–36; (g) at Controller’s election, deletes or returns all personal data after the end of the provision of services (Section 13); (h) makes available to Controller all information necessary to demonstrate compliance with Art. 28 and allows for and contributes to audits (Section 14).

7. Processing Instructions

Processor processes personal data only on Controller’s documented instructions, which include entering into the Main Agreement, using the Services in accordance with the Terms of Service, and sharing Customer Data with recipients named by Controller under the Terms of Service. Processor shall promptly inform Controller if, in its opinion, an instruction infringes GDPR or other applicable data protection law. Processing of Customer Data for AI model training is never within the scope of any instruction and is never performed, regardless of instruction content.

8. Confidentiality

Processor ensures that personnel authorized to process Customer Data are bound by confidentiality obligations that survive termination of their engagement, and limits access to personnel for whom access is necessary.

9. Security Measures

Processor implements the technical and organizational measures described in Schedule B and may update them provided the overall level of security is not reduced below the level required by GDPR Art. 32.

10. Sub-processors

Controller provides general authorization for Processor’s use of sub-processors listed in Schedule C. Processor will notify Controller of any intended changes at least 30 days in advance. Controller may object on reasonable data-protection grounds within 14 days; if no alternative solution is agreed within 30 days of the objection, Controller may terminate the affected part of the Main Agreement without penalty. Processor remains fully liable for sub-processors’ performance as for its own acts.

11. Assistance with Data Subject Rights

If Processor receives a data subject request directly, it forwards it to Controller within 48 hours without responding to it directly, per Controller’s decision on data subjects who are not Provider’s own customers.

12. Personal Data Breach

Processor notifies Controller of any Personal Data Breach affecting Customer Data without undue delay, and in any event within 24 hours of becoming aware of it, including the information required to enable Controller to comply with its own notification obligations under GDPR Art. 33–34.

13. Data Deletion or Return

During the term, retention follows Controller’s configuration (Recordings — opt-in automatic deletion after 30 days, always deletable manually; Transcripts and Summaries — automatic deletion after 365 days by default, with notice). After all Plans of Controller’s workspace have ended while the Main Agreement continues (a no-plan Account), Customer Data is available in read-only mode and is permanently deleted 12 months after the Plan ended, following e-mail warnings 30 and 7 days before deletion; until then Controller may download, delete, or reinstate the Plan, which cancels the deletion; where two periods apply to the same data, the earlier applies. Upon termination, within 30 days Processor returns or deletes all Customer Data at Controller’s election, subject to statutory retention obligations.

14. Audits

Controller may audit Processor’s compliance with this DPA, including on-site inspection, once per calendar year, unless reasonable cause exists for an additional audit, upon at least 30 days’ notice, at Controller’s cost (unless the audit reveals a material breach by Processor), subject to confidentiality and non-disruption safeguards.

15. International Transfers

Processing occurs in the European Union (AWS cloud — regions located in the European Union) as a rule. Any access from outside the EEA (e.g., sub-processor technical support) is based on the Standard Contractual Clauses adopted by European Commission Decision 2021/914 (Module 3) or an adequacy decision, as detailed in Schedule D.

16. US Privacy Law Provisions

16.1. This Section 16 applies where Customer Data includes “Personal Information” as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, “CCPA”), or equivalent state privacy laws (collectively, “US Privacy Laws”), and Processor acts as a “Service Provider” (or equivalent term, e.g., “Processor” under the Virginia Consumer Data Protection Act) with respect to such data on behalf of Controller acting as a “Business” (or equivalent term).

16.2. Service Provider shall not: a) sell or share Personal Information received from Business; b) retain, use, or disclose Personal Information for any purpose other than the specific business purpose of performing the Services specified in the Main Agreement, including retaining, using, or disclosing it for a commercial purpose other than providing the Services; c) retain, use, or disclose Personal Information outside of the direct business relationship between Service Provider and Business; d) combine Personal Information received from Business with personal information received from or on behalf of another person, or collected from Service Provider’s own interaction with the data subject, except as permitted under US Privacy Laws (e.g., to detect data security incidents, or to perform the Services).

16.3. Service Provider certifies that it understands the restrictions set out in Section 16.2 and will comply with them.

16.4. Service Provider shall notify Business if it makes a determination that it can no longer meet its obligations under US Privacy Laws.

16.5. Business has the right, upon reasonable notice, to take reasonable and appropriate steps to ensure that Service Provider uses Personal Information in a manner consistent with Business’s obligations under US Privacy Laws, and to stop and remediate unauthorized use of Personal Information, consistent with the audit rights in Section 14.

17. Liability

Liability under this DPA is subject to the limitation of liability in the Terms of Service (the total fees paid by Customer in the twelve (12) months preceding the event giving rise to the claim), except that this limitation does not apply to Processor’s statutory liability towards data subjects under GDPR Art. 82, nor to damages caused by gross negligence or willful misconduct.

18. General Provisions

Amendments require documented form. This DPA is governed by the law applicable to the Main Agreement. If any provision is found invalid, the remaining provisions remain in effect.

Schedule A — Description of Processing

In the format required by Annex I to the SCCs (Commission Decision 2021/914).

A.1 Parties

	Processor	Controller
Name	ALGOPOETICA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ	The business customer named in the Main Agreement
Address	Aleja Jana Pawla II 43A / 37B, 01-001 Warsaw, Poland	As provided in the customer’s Account
Role	Processor	Controller
Contact	privacy@algopoetica.ai	The Account e-mail address

A.2 Description of processing

Item	Description
Categories of data subjects	Controller’s users, Meeting participants (including people outside Controller’s organization), individuals mentioned in what is said, share recipients
Categories of personal data	Identification data, voice, image (if video is enabled), content of statements, Meeting metadata
Special categories of data	Possible if raised in the Meeting (GDPR Art. 9) — see Section 4
Frequency of transfer	Continuous, during each recorded Meeting
Nature of processing	Recording, transcription, AI-generated summaries, storage, sharing, deletion
Purpose of processing	Providing the Algopulse — Intelligent Meeting Assistant service
Retention	As set out in Section 13 (Recordings: opt-in 30 days or manual deletion; Transcripts and Summaries: 365 days by default; after a Plan ends: 12 months in read-only mode)
Sub-processors and their processing	Schedule C

A.3 Competent supervisory authority

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland — competent for Processor as an entity established in Poland.

Schedule B — Technical and Organizational Measures

In the format of Annex II to the SCCs.

Area	Measure
Pseudonymisation and encryption	Encryption of data at rest (AES-256)
Encryption in transit	Encrypted connections (TLS 1.2+), SSL certificate
Confidentiality and integrity	Passwords stored as a secure hash
Confidentiality and integrity	Two-factor authentication for user Accounts
Confidentiality and integrity	Role-based access control (RBAC) for Processor’s staff, limited to people who need access to Customer Data
Confidentiality and integrity	Multi-factor authentication (MFA) required for staff with access to the production environment
Confidentiality and integrity	Logging of staff access to Customer Data
Availability and resilience	Regular backups
Availability and resilience	Regular software updates
Incident management	A written internal procedure for responding to personal data breaches, consistent with the deadline in Section 12
Testing and evaluation	Periodic security testing / penetration testing of the infrastructure

Compliance certifications (e.g., ISO/IEC 27001, SOC 2 Type II), if obtained, will be listed here with their date and scope.

Schedule C — List of Sub-processors

Sub-processor	Role	Data categories	Processing location	Transfer safeguard
Amazon Web Services EMEA SARL	Infrastructure hosting, file storage (S3), meeting content database (Amazon DocumentDB), transcription (Amazon Transcribe), AI models run in Amazon Bedrock (model developers do not receive data), transactional e-mail (Amazon SES)	Recordings, Transcripts, Summaries, Meeting metadata, Account data	European Union — AWS regions located in the EU	AWS GDPR Data Processing Addendum + SCCs (module 3), only for technical support
Stripe Payments Europe, Ltd.	Payment and subscription processing	Billing data, e-mail address, transaction data	Ireland / European Union	Stripe DPA + SCCs; EU-U.S. Data Privacy Framework

The current list is published at https://algopulse.ai/subprocessors. Controller is notified of every change as set out in Section 10.

Schedule D — Standard Contractual Clauses

D.1. To the extent that processing Customer Data involves a transfer of personal data outside the European Economic Area within the meaning of Chapter V GDPR, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (“SCCs”) apply and are incorporated into this DPA by reference in full, in the module that fits the parties’ relationship:

• Module 3 (processor → sub-processor) — for transfers between Processor and the sub-processors listed in Schedule C whose parent company is established outside the EEA.

D.2. The parties complete the options in the SCCs as follows:

• Docking clause (Clause 7): applies;
• Governing law of the SCCs: the law of the EU Member State where Processor is established (Poland);
• Choice of forum (Clause 18): the courts of that Member State;
• Annex I to the SCCs: Schedule A to this DPA;
• Annex II to the SCCs: Schedule B to this DPA.

D.3. The full text of the SCCs is not reproduced here; the text published in the Official Journal of the European Union applies. Incorporation by reference avoids any discrepancy between a copy and the official text.

D.4. If the European Commission adopts an updated version of the SCCs, Processor implements it in place of the 2021 version within the period set by the Commission and informs Controller.