Data processing agreement

Template text for the demo build. Have a lawyer review it before launch and fill in the company details.

Template — Data Processing Agreement under Art. 28 GDPR

This agreement is concluded between the customer (the "Controller") and EchoScribe (demo company placeholder) (the "Processor") and forms part of the Terms of service for Team plans.

1. Subject matter and duration

Processing of audio, video, transcripts and related metadata uploaded by the Controller for the purpose of automated transcription, translation and summarisation, for the duration of the subscription.

2. Nature and purpose

Storage, speech recognition, language processing, export and deletion as instructed through the Service.

3. Categories of data subjects and data

Employees, customers, interviewees, meeting participants and other persons whose speech is contained in the recordings; personal data of any category contained in the speech, potentially including special categories under Art. 9 GDPR where the Controller chooses to upload such content.

4. Obligations of the Processor

  • Process data only on documented instructions of the Controller.
  • Ensure confidentiality of personnel.
  • Implement the technical and organisational measures in Annex 1 (encryption in transit and at rest, access control, logging, EU data location EU (Frankfurt), backup and deletion routines).
  • Engage sub-processors only as listed in Annex 2, notifying the Controller of changes 30 days in advance with a right to object.
  • Assist the Controller with data-subject requests and Art. 32–36 obligations.
  • Delete or return all data at the end of the service, and delete existing copies unless EU or member-state law requires storage.
  • Make available all information necessary to demonstrate compliance and allow audits.

5. Transfers

Processing takes place in the EU/EEA. Any transfer to a third country occurs only under Chapter V GDPR safeguards (SCCs or adequacy decision) and is listed in Annex 2.

6. Annexes

  • Annex 1: Technical and organisational measures (available on request).
  • Annex 2: Sub-processor list (see Privacy policy, section 4).

Contact: hello@echoscribe.example