Data Processing Agreement (Template)

This template is provided for review by prospective customers and vendor audits. For an individually signed copy, contact info@heydiane.ai. It supplements the Terms of Service and applies wherever HeyDiane processes personal data on behalf of a customer.

1. Parties and Roles

Processor: S&C Holding GmbH, Halbgasse 1a, 1070 Vienna, Austria ("HeyDiane").
Controller: the customer operating a HeyDiane workspace.

The customer decides which conversations are recorded, uploaded or connected and remains the controller for that content — including the personal data of third parties whose voices appear in recordings. HeyDiane processes this content exclusively on the customer's documented instructions as expressed through the product's functions.

2. Subject Matter, Nature and Purpose

Hosting, transcription (including speaker detection), AI summarization, assistant answers, search, export and deletion of conversation recordings and derived data, as offered by the HeyDiane application.

3. Categories of Data and Data Subjects

• Data subjects: workspace members; third parties who take part in recorded conversations or are mentioned in them; email senders whose messages are forwarded to a workspace ingest address.
• Data categories: audio recordings and voices; transcripts with speaker labels and word timestamps; AI-generated summaries, timelines and documents; chat questions and answers; conversation metadata (titles, tags, participants); account data of members (email, name); technical logs.
• No special categories of data are required by the service; whether recorded conversations contain such data is under the customer's control.

4. Duration

For the duration of the customer's use of HeyDiane. Deletion obligations under §9 survive termination.

5. Obligations of the Processor

• Process personal data only for the purposes in §2 and never for own purposes; no advertising, no profiling, no training of AI models on customer content (also contractually excluded with every AI sub-processor).
• Ensure confidentiality commitments of all persons authorized to process data.
• Implement and maintain the technical and organizational measures in Annex 1 (TOMs).
• Support the controller in answering data subject requests (Art. 12–23) and in obligations under Art. 32–36.
• Notify the controller without undue delay, at the latest within 48 hours, after becoming aware of a personal data breach.
• Process data exclusively within the EU/EEA in the content path; see §7 for the complete sub-processor situation.

6. Obligations of the Controller

• Ensure a legal basis for recording and processing conversations, including any required information of, or consent from, conversation participants under applicable law.
• Use the product's deletion and export functions to honor data subject requests where self-service is available.

7. Sub-processors

The controller grants general authorization for the sub-processors listed in the Trust Center (Annex 2 by reference). HeyDiane announces intended changes at least 30 days before a new sub-processor processes personal data; the controller may object on reasonable data-protection grounds. Every sub-processor is bound by a contract imposing materially the same obligations as this agreement.

8. International Transfers

Content data (recordings, transcripts, summaries, chat) is stored and processed exclusively in the EU. Some infrastructure providers have US parent companies; for those, EU Standard Contractual Clauses are in place as a safeguard for residual intra-group access scenarios. No content data is transferred to a third country in the ordinary course of the service.

9. Deletion and Return

Deletion in the product is effective immediately and complete (rows, storage objects, derived artifacts); exports auto-delete after 7 days; backups rotate within 7 days. On termination, the controller can export the full archive (JSON) and delete the workspace; HeyDiane deletes any remainder within 30 days unless EU or member-state law requires storage.

10. Audits

HeyDiane supports audits by making the Trust Center, TOMs, DPIA and this agreement publicly available, answering security questionnaires, and — where a controller demonstrates that this is insufficient — permitting audits by the controller or a mandated auditor with 30 days' notice, at the controller's expense, during business hours, without access to other customers' data.

11. Liability and Final Provisions

Liability follows Art. 82 GDPR and the Terms of Service. Austrian law applies; place of jurisdiction is Vienna. Should individual provisions be invalid, the remainder stays unaffected.

Annex 1: Technical and Organizational Measures · Annex 2: Sub-processor list (Trust Center)