Data Processing Agreement (DPA)

1. Parties

This Data Processing Agreement ("DPA") forms part of the Terms of Service between ReVoice AI AB (org.nr 559505-0849), operating the ReVoice service ("The Data Processor"), and the customer using the service for professional or commercial purposes ("Customer"), to the extent ReVoice processes personal data on the Customer's behalf and the Customer is the Data Controller.

The DPA is incorporated through valid acceptance of the Terms of Service or customer agreement that expressly incorporates this version of the DPA. The same basic scope applies to professional/B2B use of Individual, Business, a trial or a separately agreed Enterprise solution. Neither a different subscription name nor a separately signed PDF is required solely to bring processing on the Customer's behalf within scope.

Customer-specific processing, documented instructions and differing requirements are supplemented in a schedule or separate customer agreement where needed. Enterprise may be separately agreed; contact privacy@re-voice.io if a manually signed version is required. This DPA does not cover ReVoice's own purposes as a Data Controller, such as its own account and billing administration or its own security and abuse prevention. Those are described separately in the Privacy Policy. Annex 1 states for each processing activity whether ReVoice is a processor or a controller, and Annex 2 describes the technical and organisational measures.

2. Purpose and Nature of Processing

• Purpose and nature: To receive and process meeting material on the Customer's instructions, transcribe audio, generate analyses and summaries, and provide related knowledge and follow-up tools.
• Categories of data: Meeting metadata, participant details, audio and video recordings, text transcripts, summaries and other meeting or document content the Customer instructs ReVoice to process. Voice characteristics and persistent voice profiles/voiceprints for speaker identification are included where the optional feature is used and the processing is performed on the Customer's behalf. Consent, enrollment method, permitted use and erasure must match the processing actually agreed.
• Categories of data subjects: The Customer's employees, users, external meeting participants, clients and other people whose details occur in the material or voice profiles covered by the Customer's instructions.
• Duration: Processing on the Customer's behalf takes place during the agreement and afterwards only for agreed return or deletion, or storage required by applicable law. Section 6 describes return and deletion.

2a. Processing on Documented Instructions

The Processor shall process personal data only on the documented instructions of the Controller, including with regard to transfers of personal data to a third country, unless required to do otherwise by Union or Member State law to which the Processor is subject; in that case the Processor shall inform the Controller of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.

This DPA, the Terms of Service, agreed schedules and the Customer's authorised configuration and use of the Service constitute documented instructions for processing within the processor engagement. Settings and use must not expand processing contrary to agreed restrictions. Voice profiles require valid individual explicit consent where consent is relied upon; an administrator setting does not replace the person's consent. Within this engagement the Processor does not process the data for its own purposes and shall inform the Controller if it considers an instruction to infringe the GDPR or other applicable data protection law.

3. Sub-processors

To deliver processing on the Customer's behalf, the Processor engages sub-processors for functions such as cloud storage, hosting, speech-to-text, AI processing, text-to-speech, meeting assistance and delivery of Customer content. The Processor remains responsible to the Controller for sub-processor obligations under Article 28. Suppliers used solely for ReVoice's own controller purposes are not included in this list merely because of the supplier's name.

By this DPA the Controller gives a general written authorisation under Article 28(2) of the GDPR for the Processor to engage the sub-processors in the published sub-processor list and, following the procedure in this section, new or replacement sub-processors. The Processor shall, by written contract, impose on each sub-processor the same data protection obligations as set out in this DPA, in particular sufficient guarantees of appropriate technical and organisational measures. Sub-processors may process Customer data only for the engagement and must not use Customer content to train their own general models. Storage and technical logging needed for the engagement must be limited to agreed purposes and periods. Third-country transfers require an applicable transfer mechanism under Chapter V of the GDPR. A current list of sub-processors, with the purpose and data region of each, is published at https://re-voice.io/sub-processors. Additions or replacements are notified at least 10 days in advance to the Customer's administrators, before the sub-processor starts processing Customer data. Within that period the Controller may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Controller may terminate the affected part of the Service, or the agreement, with effect before the change applies to the Controller's data.

4. Security and Confidentiality

The Processor shall implement the technical and organisational measures required by Article 32 of the GDPR. The measures are described in Annex 2.

Customer data, including recordings and uploaded documents, is stored with the encryption at rest provided by the hosting and storage providers. In addition, transcript text, summary text, AI chat and meeting chat messages, comments, highlights, takeaways, meeting titles, voiceprints and stored credentials (integration and OAuth tokens, SSO client secrets and two-factor secrets) are encrypted at field level with AES-256-GCM. Traffic between the browser and re-voice.io is encrypted with TLS. Not every internal connection within the hosting provider's private network is encrypted.

Personnel engaged by the Processor to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

5. Personal Data Breaches

If the Processor becomes aware of a personal data breach affecting the Controller's data, the Processor shall notify the Controller without undue delay, and in any event no later than 48 hours after becoming aware of the breach.

The notification shall, to the extent the information is available, contain the information listed in Article 33(3) of the GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information that is not available at the time of notification shall be provided in phases without undue further delay.

5a. Assistance to the Controller

Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR (access, rectification, erasure, restriction, portability, and objection). The Service provides self-service export and deletion tools for this purpose. Where the Processor receives such a request directly, it shall promptly forward it to the Controller and shall not respond to it itself except on the Controller's documented instructions.

Taking into account the nature of the processing and the information available to it, the Processor shall assist the Controller in ensuring compliance with the Controller's obligations under Articles 32 to 36 of the GDPR, including security of processing, notification of personal data breaches to the supervisory authority and to data subjects, data protection impact assessments, and prior consultation with the supervisory authority.

5b. Records and Audits

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

In the first instance, the Processor provides, within 30 days of a written request, written answers and the documentation needed, including Annex 2, the sub-processor list and the audit reports or certificates from sub-processors that the Processor may disclose. If that material is not sufficient to demonstrate compliance, the Controller may carry out an audit or inspection.

An audit or inspection takes place on at least 30 days' written notice, during normal business hours, no more than once in any twelve-month period and in a way that does not disclose other customers' data or compromise the security of the Service. The once-per-period limit and the notice period do not apply where a supervisory authority requires the audit, following a personal data breach affecting the Controller's data, or where there are specific reasons to believe that the Processor is in breach of this DPA. An auditor who is not employed by the Controller shall be bound by confidentiality and must not be a competitor of the Processor. Each party bears its own costs of the audit.

6. Return and Deletion

Upon termination of the Agreement, the Processor shall, at the Controller's choice, delete or return the personal data covered by the processor engagement and delete existing copies, unless Union or Member State law requires storage.

Before termination, the Controller may export data with the self-service export; where it does not cover the request, the Processor shall assist with additional reviewed delivery. The Controller may also delete the data itself at once by deleting conversation records, Spaces or the account in the Service. Otherwise the Processor deletes the data from the Service's database and file storage no later than 30 days after termination of the Agreement. Within the same period the Controller may request an export or an earlier deletion. Where the Customer is a company, the deletion covers the company's shared Spaces (Main Space and Project Spaces) and their content. Members' My Private Space and accounts stay with the member and are deleted when the member deletes their account.

Deletion at sub-processors that store files and at the meeting bot provider is requested at the same time, and a request that fails is retried until it succeeds. Encrypted backups of the database are kept for 35 days, and deleted files remain in the encrypted file copy for at most 35 days; after that the data is gone there too. The most recent valid backup and the most recent backup that passed a restore drill are kept until a newer one exists, which only extends the period if later runs fail. The copies are used solely for restoration.

At the Controller's request the Processor provides a written confirmation of the deletion stating what was deleted and when, and which steps remain (backups and providers' confirmations). An accepted request or local account deletion does not by itself prove that all steps are complete. Retention during the term depends on the actual plan, the Space's retention settings and the data category as described in section 9 of the Privacy Policy and the Customer's documented instructions.

7. Relationship to Other Agreements

If this DPA conflicts with the Terms of Service or any other agreement between the parties, this DPA prevails in matters concerning processing of personal data on the Customer's behalf, unless a written agreement signed by both parties expressly departs from a specific provision of it. This DPA applies for as long as the Processor processes personal data on the Customer's behalf.

8. Data Protection Contact Point

The Processor's contact point for questions about this DPA, personal data breaches, data subject requests, audits and deletion is ReVoice AI AB's data protection contact. The Processor has not appointed a data protection officer under Article 37 of the GDPR. The Controller notifies its contact person for data protection matters to the same address; where none has been given, notices are sent to the Customer's administrators.

Annex 1. Roles and Purposes

The table states who is the controller of each processing activity in the Service and the role ReVoice has. This DPA applies to the rows where ReVoice is the processor. Where ReVoice is the controller, the Privacy Policy applies.

For the rows where the Customer is the controller, the Customer decides the legal basis and the information given to data subjects (section 13 of the Terms).

Annex 2. Technical and Organisational Measures

The measures describe how the Service is built and operated. The Processor may change a measure provided the level of protection is not reduced. Where data is stored and processed is stated per provider in the sub-processor list.

• Encryption: traffic between the browser and re-voice.io is encrypted with TLS and the website requires HTTPS (HSTS). The database and file storage are encrypted at rest by the hosting and storage providers. Transcripts, summaries, chat messages, comments, meeting titles, voiceprints and stored sign-in keys are also encrypted in the application with AES-256-GCM; older voiceprints saved before the encryption are encrypted by a daily maintenance job. Not every internal connection within the hosting provider's private network is encrypted.
• User access: sign-in with a password, Google, Microsoft or single sign-on (SSO), with support for two-factor authentication. Permissions follow roles in the company and in each Space, and the server checks the permission on every request.
• Separation: each Space is its own permission boundary. Processing of a single meeting may only read that meeting. When someone outside the Customer's organisation takes part in the meeting, Matilda holds back internal knowledge such as Company Knowledge and earlier meetings.
• Administrative access: the Processor's administration interface can only be reached from approved IP addresses and requires a fresh verification before sensitive actions. When staff open a customer's account for support, who, which account, when and why are recorded.
• Logging: audit and security events are kept for twelve months and other audit log entries for 90 days. Known sensitive fields, such as passwords, tokens, cookies, email addresses, transcripts and participant names, are masked in the application logs. Error reports are sent without IP address and cookies and with the same masking, but an error message may exceptionally contain an excerpt.
• Data minimisation in meetings: what was recorded is not shown and not processed by AI until the meeting owner has joined, and if the owner never joins the recording is discarded. If a participant writes stop as the whole message in the meeting chat, Matilda leaves the meeting and the recording is discarded.
• Voiceprints: created only with the data subject's explicit consent, which is valid for twelve months and can be withdrawn. Recognition is only performed against a separate audio track for one person at a time (1:1).
• Sentiment analysis: based only on the transcript text, requires the Space to have switched the feature on, is shown only to the meeting owner and is never performed in recruitment meetings.
• Backups: the database is backed up daily, encrypted with AES-256-GCM using its own key, stored in Cloudflare R2 under EU jurisdiction and kept for 35 days. Restoration is rehearsed regularly, and failures in the backups or the rehearsals raise an alert.
• Deletion and retention: a daily retention run applies the retention periods in section 9 of the Privacy Policy and the Space's retention settings. Deleted conversation records are removed from the Service at once and permanently erased after 30 days. A file that could not be deleted at the storage provider is queued and deleted on a later run.
• Abuse protection: Cloudflare protects the website, Turnstile checks sign-up and checkout, the number of requests is limited for features including import and AI, and incoming webhooks from the meeting bot, payment and email providers are only accepted with a valid signature.
• AI: the Customer's content is not used to train, fine-tune or improve AI models. Known attempts to manipulate the assistant through meeting text, transcripts or documents are blocked, and allowed and blocked decisions are written to an audit log.
• Incidents: the Processor has a procedure for detecting, investigating and documenting personal data breaches and notifies the Controller under section 5.
• Sub-processors and personnel: sub-processors are engaged under a written contract as set out in section 3, and personnel processing the data have committed themselves to confidentiality.