This Data Processing Agreement (DPA) forms part of the dualoop Coach Terms of Service between dualoop SRL (we) and the customer (you). It applies when we process personal data on your behalf.
1. Roles
For personal data about other people that you put into the Service on behalf of your business or organisation (Customer Personal Data), you are the controller and we are your processor. We process it only to provide the Service to you.
2. Details of the processing
- Subject matter and purpose: providing the Service.
- Nature: storage, encryption, indexing, AI processing and the generation of outputs.
- Duration: until the data or your account is deleted.
- Types of data: the personal data you include, such as names, roles, contact details, opinions and interview or meeting notes.
- Data subjects: people mentioned in your content, such as colleagues, clients, interviewees and stakeholders.
3. Instructions
We process Customer Personal Data only on your documented instructions. The Terms of Service, this DPA and your use of the Service's features are those instructions, including for transfers outside the European Economic Area. If EU or Member State law requires other processing, we tell you first unless that law forbids it. We tell you immediately if we believe an instruction infringes data protection law.
4. Confidentiality and security
Everyone we authorise to process Customer Personal Data is bound by confidentiality. We keep appropriate technical and organisational measures in place, including EU hosting, encryption in transit and at rest, and restricted access.
5. Subprocessors
You authorise the subprocessors listed on our Subprocessors page. We tell you by email at least 30 days before we add or replace one. You can object on reasonable data protection grounds; if we cannot resolve your objection, you can end your subscription before the change applies. We bind each subprocessor to data protection obligations equivalent to this DPA and remain responsible for it.
6. Tools you connect
If you connect another tool or AI assistant to the Service, you instruct us to make data available to it. Its provider is not our subprocessor.
7. International transfers
We transfer Customer Personal Data outside the European Economic Area only with a safeguard recognised by the GDPR, such as the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework.
8. Assistance and breaches
We help you, mainly through the Service's features, to respond to data subjects' requests and to meet your obligations on security, breach notification, impact assessments and prior consultation. We notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
9. End of processing
You can export Customer Personal Data at any time. When you delete it or your account, we delete it immediately, except copies in backups until they expire and copies the law requires us to keep.
10. Audits
On request, we give you the information needed to demonstrate our compliance with this DPA. If that is not enough, you, or an auditor you mandate who is bound by confidentiality, may carry out an audit, at your cost, on 30 days' notice, no more than once a year, without access to other customers' data.
11. Your responsibilities
You are responsible for having a lawful basis for Customer Personal Data, for informing the people concerned where the law requires, and for including sensitive data only where the law allows.
12. Liability and precedence
The limitation of liability in the Terms of Service applies to this DPA. For Customer Personal Data, this DPA prevails over the Terms of Service if they conflict.