Data Processing Agreement

Applies to: echo.agenticagency.dev, echo-beta.agenticagency.dev and the Echo service provided through them. Version: 1.2 · Effective: 23 September 2026

This Data Processing Agreement ("DPA") records the terms required by Article 28(3) of Regulation (EU) 2016/679 ("GDPR") for our processing of personal data on your behalf.

It forms part of the Echo Beta Terms and Conditions (the "Terms") and is accepted when you accept them. Capitalised terms not defined here have the meaning given in the Terms. It is a different document from our Privacy Notice, which describes the processing we carry out as controller in our own right.

Parties. Agentic Agency ApS, CVR 46326458, Gammel Kongevej 152 B, 3., 1850 Frederiksberg C, Denmark ("we", "Processor") and the organisation that has accepted the Terms ("you", "Controller").

Precedence. Where this DPA and the Terms conflict on the processing of personal data, this DPA prevails. Where this DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses prevail.

1. Subject matter, duration, nature and purpose

Art. 28(3), opening paragraph.

1.1 The subject matter is our processing of personal data contained in Customer Data in order to provide the Service.

1.2 The duration is the term of the Terms, plus the period in clause 9 for return and deletion.

1.3 The nature and purpose is the operation of a shared-agent platform: storing your project content, contacting the individuals you name, conducting typed and spoken conversations with them through an AI agent, and returning the results to you.

1.4 The types of personal data and categories of data subjects are set out in Annex I.

2. Roles

2.1 In respect of Customer Data — the documents you upload, the missions you define, the contacts you enter and the answers Participants give — you are the controller and we are the processor.

2.2 You are responsible for the lawfulness of the processing you instruct: for having a lawful basis to contact the individuals you name and to process their responses, and for giving them the information Articles 13 and 14 GDPR require. Clause 8 of the Terms sets this out in full.

2.3 We process personal data about your Authorised Users for our own purposes — account administration, security, support and billing — as controller. That processing is outside this DPA and is described in our Privacy Notice.

2.4 Neither of us is a joint controller with the other within the meaning of Article 26 GDPR.

3. Processing on documented instructions

Art. 28(3)(a).

3.1 We process personal data only on your documented instructions, including as to transfers to a third country, unless required to do otherwise by Union or Member State law — in which case we will tell you of that requirement before processing, unless the law prohibits it on important grounds of public interest.

3.2 The Terms, this DPA, and your use of the Service through its interfaces and API together constitute your documented instructions. Configuring a mission, creating an interview link or sending a message is an instruction.

3.3 We will tell you if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection law. We may suspend the affected processing until the instruction is withdrawn or amended.

3.4 We do not use Customer Data for our own purposes. In particular we do not use it to train or improve models, and neither do our AI providers: Anthropic is prohibited by its commercial terms from training models on Customer Data, and ElevenLabs' use of content to train or improve its models is disabled at account level for the account the Service uses. We will not change either position without notice under clause 6.2.

4. Confidentiality

Art. 28(3)(b).

4.1 We ensure that persons authorised to process personal data under this DPA are bound by an appropriate obligation of confidentiality, whether contractual or statutory, and that the obligation survives the end of their engagement.

4.2 Access to Customer Data in production is limited to the personnel who need it to run the Service, to resolve a fault, or to act on your instruction. Our staff do not read project content as a matter of routine.

5. Security

Art. 28(3)(c), and Art. 32.

5.1 We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.

5.2 The measures in place are described in Annex II. That annex states both what is implemented and what is not. It is accurate as at the version date at the top of this document and will be updated as measures change.

5.3 The Service is offered in pre-release form. Clause 3 of the Terms describes what that means, and Annex II should be read as the security position of a beta, not of a certified production platform.

6. Subprocessors

Art. 28(2), Art. 28(3)(d) and Art. 28(4).

6.1 You give us general authorisation to engage subprocessors. Those engaged at the version date of this document are listed in Annex III, with what each is used for and where it processes.

6.2 We will give you reasonable advance notice before adding or replacing a subprocessor that processes Customer Data. You may object on reasonable data protection grounds within 30 days. If we cannot resolve the objection, either of us may terminate the affected part of the Service without penalty, and clause 9 applies.

6.3 We impose on every subprocessor, by written contract, data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

7. Assisting you with data subject requests

Art. 28(3)(e).

7.1 Taking account of the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests to exercise rights under Chapter III GDPR — access, rectification, erasure, restriction, portability and objection.

7.2 Where a data subject makes such a request to us directly, we will not respond to it on the substance. We will tell them without undue delay to approach you, and tell you that the request was made, unless the law prevents it.

7.3 Section 12 of the Privacy Notice tells Participants exactly this: the organisation that sent the interview link is the one who must act on their request, and if they cannot identify that organisation we will identify you and pass the request on.

8. Assisting you with security, breaches and impact assessments

Art. 28(3)(f), covering Arts. 32-36.

8.1 We notify you of a personal data breach affecting Customer Data without undue delay and in any event within 48 hours of becoming aware of it, with the information you need to meet your own obligations under Articles 33 and 34 — the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

8.2 We assist you, taking into account the nature of the processing and the information available to us, in ensuring compliance with Articles 32 to 36 — including data protection impact assessments and prior consultation with a supervisory authority.

8.3 Notification under clause 8.1 is not an acknowledgement of fault or liability.

9. Return and deletion

Art. 28(3)(g).

9.1 At your choice, we delete or return all personal data processed on your behalf at the end of the provision of the Service, and delete existing copies, unless Union or Member State law requires storage.

9.2 You may export your project content at any time during the term. Clause 16 of the Terms describes export and switching.

9.3 Unless you ask for return, we delete Customer Data within 30 days of the end of the term. Backups are overwritten on their own cycle; data in a backup is not restored to active use and is deleted when that backup expires.

9.4 We act on a deletion request from you during the term without undue delay.

Beta status of this clause. The Service has no automated deletion job today, and deletion under this clause is performed manually. This is recorded in section 8 of the Privacy Notice and is a known gap being closed before general availability. It does not reduce the commitment in 9.1 to 9.4.

10. Information and audits

Art. 28(3)(h).

10.1 We make available to you the information necessary to demonstrate compliance with Article 28 — this DPA, its annexes, and our security documentation.

10.2 You may audit that compliance once in any twelve-month period, on 30 days' written notice, during business hours, without unreasonable disruption, and subject to confidentiality. You bear your own costs; we bear ours. Where a supervisory authority requires it, an audit may be conducted more often and on shorter notice.

10.3 An auditor you appoint must not be a competitor of ours, and must accept the same confidentiality obligations.

10.4 We hold no ISO 27001 or SOC 2 certification, and we do not claim one. Where that matters to you, say so before you rely on the Service.

11. International transfers

11.1 We transfer personal data outside the EU/EEA only where a valid Chapter V transfer mechanism applies — an adequacy decision, the EU–US Data Privacy Framework where the recipient is certified, or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with the supplementary measures the transfer requires.

11.2 The subprocessors in Annex III that process outside the EU/EEA are marked as such, with the mechanism relied on. A copy of the relevant mechanism is available on request from privacy@agenticagency.dev.

11.3 Where the Standard Contractual Clauses apply between us, Module Two (controller-to-processor) is incorporated, with Annex I of this DPA as their Annex I, Annex II as their Annex II, and Annex III as their list of subprocessors. The governing law is Danish law and the forum is the Danish courts.

12. Term, liability and general

12.1 This DPA takes effect when you accept the Terms and continues for as long as we process personal data on your behalf.

12.2 Each party's liability under this DPA is subject to the limitations and exclusions in clause 19 of the Terms. Nothing in this DPA limits a data subject's rights under Article 82 GDPR.

12.3 We may update this DPA where a change in law, in the Service or in our subprocessors requires it. Material changes are notified in accordance with clause 20 of the Terms. The version number and effective date at the top identify the current text, and each published version is tied to the release it shipped in.

12.4 This DPA is governed by Danish law, and clause 22 of the Terms governs jurisdiction.

Annex I — Details of the processing

Categories of data subjects

• Your Authorised Users, insofar as their personal data appears in project content.
• Participants — the individuals you name and an Agent contacts, who may respond without registering.
• Any individual whose personal data appears in a document you upload, in a mission definition, or in a Participant's answer.

Types of personal data

• Contact records: name, email address, and optionally organisation and a free-text note, entered by you about the people you want an Agent to contact.
• Conversation content: the full transcript of every chat and every voice interview, typed and spoken — questions asked, answers given, and anything a Participant chooses to say.
• Voice audio: processed in real time for speech recognition and synthesis during a voice interview.
• Project files: whatever personal data the documents you upload or Echo writes happen to contain. You control this entirely; we do not inspect it.
• Interview link metadata: the mission goal, the expected result, an expiry, and a hash of the link token. The token itself is never stored.

Special categories of personal data

None is intended or requested. The Service is not designed for Article 9 data, and clause 9 of the Terms restricts what you may put into it. Where such data nonetheless appears because a Participant volunteers it in an answer, we process it under the same measures as all other Customer Data.

Nature and purpose of the processing

Storage, organisation, retrieval, transmission by email, disclosure to the AI model and speech providers listed in Annex III for the purpose of generating a reply, transcription, and return of the results to you.

Frequency — continuous, for the duration of the Terms.

Duration — as clause 9.

Retention — as section 8 of the Privacy Notice. Data is retained until you delete it or ask us to; there is no automatic expiry today.

Annex II — Technical and organisational measures

Art. 32 GDPR. This annex states what is implemented and what is not. It describes a pre-release service and should be read as such.

Encryption in transit. All traffic to the Service is served over TLS, with certificates issued by Let's Encrypt and renewed automatically by cert-manager. Connections to our AI, speech and email subprocessors are over TLS.

Encryption at rest. The database and file volumes are OVHcloud block-storage volumes of the LUKS-encrypted class (csi-cinder-high-speed-luks), encrypted server-side with an OVHcloud-managed key per volume. Nightly volume snapshots inherit that encryption.

Authentication and credentials. Passwords are stored only as bcrypt hashes; we never hold the password itself. Interview link tokens are stored only as hashes, so a copy of the database yields no working links. Sessions are signed and carry a server-side version counter, so every session for an account can be revoked at once — which happens automatically on password reset.

Access control. Access to production is limited to the personnel who need it. Deployment runs through a Kubernetes ServiceAccount scoped to the two Echo namespaces and to Deployment operations only. Application secrets are held as Kubernetes Secrets, not in the image or the repository.

Tenant isolation. Every record carries a tenant identifier, and queries are scoped to it. Interview links are scoped to a single project; a Participant sees only the project they were invited to.

AI disclosure. Participants are told they are interacting with an AI system before the conversation starts, as Article 50(1) of Regulation (EU) 2024/1689 requires and clause 8.3 of the Terms promises.

Logging. Application and access logs are retained for operational and security purposes.

Backups. Persistent volumes are backed up nightly.

Availability. The Service runs on managed Kubernetes with automated rollout, rollback and health checks. Deployments are versioned by image tag, and the running version is publicly verifiable.

Development practice. Changes are reviewed before merge and covered by an automated test suite. Releases are built by CI from a tagged commit, never by hand.

Measures not currently in place. Stated explicitly, because their absence is part of an accurate description:

• No rate limiting or login-attempt throttling on the API or the sign-in route.
• No security-headers middleware (for example Content-Security-Policy or HSTS beyond what the ingress provides by default).
• No formal periodic access review, and no documented access-revocation procedure.
• No independent penetration test or vulnerability assessment.
• No automated data-deletion job — see clause 9.
• No certification against ISO 27001, SOC 2 or an equivalent scheme.

Annex III — Subprocessors

As at the version date at the top of this document.

Changes to this list are notified under clause 6.2.

Agentic Agency ApS · privacy@agenticagency.dev Gammel Kongevej 152 B, 3., 1850 Frederiksberg C, Denmark · CVR 46326458