Data Processing Agreement (DPA)

Data processing agreement under Article 28.3 of the GDPR (Regulation (EU) 2016/679) and the LOPDGDD. It is incorporated into the Service Terms and Conditions and is mandatory acceptance to contract the platform.

• Data Controller: the Customer that contracts Business Copilot.
• Data Processor: SOLIDPULSE LABS, SL (CIF B27565878), Av. Emilio Lemos 32, Bl.1, P5, Pta B, 41020 Seville (Spain) ('Business Copilot').
• Data Protection Officer (DPO): after due assessment, Business Copilot considers that, at its current scale and processing volume, there is no obligation to designate a DPO under Art. 37 GDPR. Data protection contact point: privacy@idptrust.com. Business Copilot will reassess this as processing volume grows.

Business Copilot processes personal data on the Customer's behalf as necessary to provide the Service. With respect to the Customer's End Users' data (contacts, participants in recorded or transcribed meetings, etc., which the Customer processes in the Service), the Customer is the Controller and Business Copilot the Processor. Data of the Customer's own portal account and its Authorized Users is processed by Business Copilot as Controller and governed by the platform Privacy Policy, not by this DPA.

The purpose is the processing of End Users' personal data described in Annex I. The duration matches the term of the Service contract; clause 9 applies upon its end.

Business Copilot will process the data only following documented instructions from the Customer (including those resulting from the Service configuration, such as enabling AI and configuring the OpenAI key, and these contractual documents), also regarding international transfers, unless required by law (in which case it will inform of this, unless legally prohibited). If Business Copilot considers that an instruction infringes data protection regulations, it will notify the Customer.

Business Copilot ensures that persons authorized to process the data have committed to confidentiality or are under a statutory duty of confidentiality, and limits access to those who need it to provide the Service.

Business Copilot will implement the appropriate technical and organizational measures described in Annex II, taking into account the state of the art, costs, and the nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of data subjects.

The Customer grants Business Copilot general authorization to engage subprocessors for the provision of the Service. The list of current subprocessors appears in Annex III.

Business Copilot will impose on each subprocessor, by contract, data protection obligations equivalent to those of this DPA, and will remain fully liable to the Customer for their compliance.

Business Copilot will inform the Customer of the addition or replacement of subprocessors with reasonable advance notice, giving the opportunity to object on reasonable data protection grounds. If the objection cannot be resolved, the Customer may terminate the affected part of the Service.

Business Copilot will assist the Customer, to the extent possible and taking into account the nature of the processing:

• through appropriate technical and organizational measures, so the Customer can respond to data subjects' requests to exercise their rights (access, rectification, erasure, objection, restriction, portability). The Service offers query, export, and deletion features the Customer can use autonomously;
• to ensure compliance with the obligations of Arts. 32 to 36 (security, breach notification, impact assessments, and prior consultations), given the information available to it.

Business Copilot will notify the Customer, without undue delay after becoming aware of a security breach affecting personal data processed on the Customer's behalf, providing the reasonably available information for the Customer to comply, where applicable, with its notification obligations (Arts. 33 and 34 GDPR). Business Copilot will send the notification to the contact designated by the Customer, through the means indicated in the portal and/or by email.

Upon termination of the Service, and at the Customer's choice, Business Copilot will delete or return the personal data processed on its behalf, and will delete existing copies, unless retention is required by EU or Member State law. The Customer will have an export period of 30 days from termination; the specific deletion/retention periods appear in Annex I.

Business Copilot will make available to the Customer the information necessary to demonstrate compliance with the obligations of Art. 28 and will allow and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by it. The parties will agree on the scope and procedure (reasonable notice, business hours, confidentiality duty, no impact on other customers); Business Copilot may satisfy this right through third-party reports or certifications when available. It may also share summaries of its security reviews under confidentiality.

Data is hosted in the European Union. Where a subprocessor may process data outside the EEA, the transfer will rely on an adequacy decision (e.g., the EU-US Data Privacy Framework) or on Standard Contractual Clauses and supplementary measures, as set out in Annex III.

The parties' liability in relation to the processing is governed by the GDPR and by the limitation of liability agreed in the Service Terms and Conditions.

In the event of conflict between this DPA and other contractual documents on data protection matters, this DPA will prevail.

Nature and purpose: provision of Business Copilot — CRM, live meeting assistant with a browser extension (transcription and reports), projects and boards, AI training, proposals, and connectors with the Customer's tools (Gmail, Google Calendar, Google Drive, HubSpot, Jira, and GitHub), on the Customer's behalf.

Categories of data subjects: the Customer's End Users (individuals whose data the Customer processes in the Service, e.g., the Customer's contacts and clients, participants in recorded or transcribed meetings, and people appearing in the emails, events, and files the Customer syncs through the connectors).

Categories of personal data:

• Identification and contact data (name, email, phone, company, job title), as entered or synced by the Customer.
• Meeting content: audio transmitted for transcription, transcripts, participant names, summaries, and reports.
• Content of projects, boards, proposals, and notes, and data synced from the connectors (emails, calendar events, files, HubSpot records, Jira issues, GitHub repositories) to the extent the Customer connects them.
• AI training sessions and their evaluations.
• Technical connection data and activity logs.

Special categories (Art. 9): not processed intentionally. The Customer refrains from entering sensitive data outside the purposes of the Service.

Duration / retention: data is processed during the term of the contract. After termination: 30-day export period followed by deletion. Indicative periods: the Customer's operational data (contacts, meetings, transcripts, reports, projects, and other content) deleted after the grace period; activity logs retained for a limited time; billing documentation, where Business Copilot acts as Controller, up to 6 years (Commercial Code, Art. 30) / 4 years (tax obligations).

• Encryption of data in transit and of sensitive data at rest.
• Role-based access control, least-privilege principle and strong authentication for privileged access.
• Logical isolation of each customer's data.
• Backups and recovery procedures.
• Logging and auditing of security-relevant activity.
• Vulnerability management and security testing before each production release.
• Staff access restricted to what is necessary and confidentiality commitments.
• Technical details of these measures are provided to the Customer, under confidentiality, on request for an audit or risk assessment.

Subprocessors that may process End Users' personal data on the Customer's behalf. Providers that process Customer account data (payments and email) act in the relationship where Business Copilot is Controller and are detailed in the platform Privacy Policy, not here.

• Google Cloud EMEA Limited (Ireland) — Cloud infrastructure for the Service. Location: European Union. Safeguard, for any access from outside the EEA: EU-US Data Privacy Framework and Standard Contractual Clauses.
• Cloudflare, Inc. (USA) — Delivery and protection of the Service's web traffic. Location: global network, with possible processing outside the EEA. Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses.

Artificial intelligence (Customer's own key): the AI features use the OpenAI key that the Customer itself configures in its workspace. OpenAI is not a subprocessor of Business Copilot: it is a provider contracted directly by the Customer, under its own account and terms, and enabling AI and configuring the key constitute Customer instructions. Without a configured key, the Service sends no data to OpenAI. The same applies to the connectors (Gmail, Google Calendar, Google Drive, HubSpot, Jira, and GitHub), which are connected with the Customer's accounts and at its initiative.

This annex is maintained as the current published version; changes are communicated in accordance with clause 6.