Processing agreement
Version 2 · November 4, 2026
This is a courtesy translation; the Dutch version is binding. Please contact legal@decidesk.ai if you have questions about the documents.
Version 2 of November 4, 2026. A new Customer accepts this version in accordance with Article 0.2 or 0.4. If the Customer had accepted an earlier version, this version takes effect in accordance with Articles 13.3 and 13.4. This processing agreement sets out how DeciDesk processes personal data on behalf of the organizations that use the Service, as required by Article 28 GDPR.
Parties
The Customer: the legal entity or business that uses the Service under the Terms of Service, hereinafter “the Customer”. In the case of an approval in the Service, the Customer is the legal entity or business that takes out the subscription for the organization in the Service. In the case of a signed copy, the Customer is the party named in it. If the Customer also uses the Service for its Group Companies, as defined in the Terms of Service, the Customer enters into this Processing Agreement on behalf of those Group Companies as well. The Customer warrants that it is authorized to do so. The Customer exercises the rights under this Processing Agreement on their behalf and is DeciDesk's point of contact.
DeciDesk: Dennis Heemskerk, trading as DeciDesk, with its business address at Voorhouterweg 25, 2231 NB Rijnsburg, registered with the Dutch Chamber of Commerce under number 42123032, hereinafter “DeciDesk”.
Recitals
A. The Customer uses the Service of DeciDesk, an online service for meetings, decisions, actions, and projects.
B. In providing the Service, DeciDesk processes Personal Data on behalf of the Customer. In doing so, the Customer is the controller and DeciDesk is the processor, within the meaning of Article 4 GDPR.
C. In this Processing Agreement, the parties record the arrangements required by Article 28(3) GDPR.
Formation
0.1 This Processing Agreement forms part of DeciDesk's Terms of Service. The Annexes form part of this Processing Agreement.
0.2 The Customer accepts this Processing Agreement electronically by an Owner giving approval in the Service, either when the organization is created or at a later time. Before giving approval, the Owner can view and save this version of the Processing Agreement. DeciDesk records who gave approval, on behalf of which organization, at what time, and with which version. DeciDesk makes that information available to the Customer upon request.
0.3 Article 28(9) GDPR permits this Processing Agreement to be recorded in electronic form. The parties agree that an approval in the Service, recorded in accordance with Article 0.2, constitutes written acceptance. No signature is required for that purpose.
0.4 At the Customer's request, the parties will also sign this Processing Agreement. The signed copy states the version number and is substantively identical to that version. DeciDesk attaches the Terms of Service in effect on the date of signing to the signed copy. By signing, the Customer also accepts those Terms of Service. A new version of this Processing Agreement or of the attached Terms of Service applies to the signed copy only if both parties agree to it. Even then, DeciDesk announces a new version in accordance with Article 13.3, and changes of Sub-processors proceed in accordance with Article 6.
0.5 Anyone who gives approval or signs on behalf of the Customer declares that they are authorized to represent the Customer in doing so.
Article 1. Definitions
1.1 In this Processing Agreement, capitalized terms have the following meaning:
Terms of Service: the terms of service of DeciDesk, published at decidesk.ai/terms, in the version that applies to the Customer.
GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation.
Annex: an annex to this Processing Agreement.
Personal Data Breach: a personal data breach within the meaning of Article 4(12) GDPR that concerns Personal Data.
Service: the web application, the desktop and mobile apps, the recording bot, and the associated services of DeciDesk.
EEA: the European Economic Area.
Owner: a User who has the role of owner of the Customer's organization in the Service. An account of DeciDesk never qualifies as an Owner, not even if, for example while setting up, it has the role of owner in the Customer's organization (Article 4.2).
User: an employee, contractor, or other person to whom the Customer gives access to the Service.
Customer Data: all content and data that Users enter, upload, or record in the Service, and what the Service creates from it, such as transcripts, summaries, and action proposals.
Agreement: the agreement between the Customer and DeciDesk concerning the use of the Service, to which the Terms of Service apply.
Personal Data: all personal data that DeciDesk processes on behalf of the Customer in providing the Service. Annex 1 describes this data.
Privacy Policy: the privacy policy of DeciDesk, published at decidesk.ai/privacy.
Sub-processor: a third party that DeciDesk engages and that processes Personal Data in doing so.
Processing Agreement: this agreement, including the Annexes.
1.2 Terms not defined in Article 1.1, such as processing, data subject, controller, and processor, have the meaning given to them by the GDPR. Other terms have the meaning given in the Terms of Service. In case of a difference, the definition in Article 1.1 prevails.
1.3 Where this Processing Agreement requires a notification to the Owner, DeciDesk sends that notification to every Owner. In this Processing Agreement, an email is considered to be in writing.
Article 2. Subject matter, nature, purpose and duration
2.1 DeciDesk processes the Personal Data on behalf of the Customer in order to provide, secure, and support the Service. Annex 1 describes the processing operations, the types of personal data, the categories of data subjects, and the retention periods.
2.2 The processing consists of storing, organizing, and displaying Customer Data, recording and transcribing meetings, summarizing and searching with AI, sending notifications, and deleting data.
2.3 DeciDesk processes the Personal Data solely for the purposes set out in Article 2.1 and Annex 1. DeciDesk does not use the Personal Data for its own purposes, except as described in Article 2.4. DeciDesk does not sell the Personal Data, does not use it for advertising, and does not train AI models with it. Microsoft, the Sub-processor for AI, does not use the Personal Data to train AI models. At ElevenLabs, the Sub-processor for converting speech to text, the use of the Personal Data for improving ElevenLabs' services is disabled.
2.4 DeciDesk is itself the controller for the following processing operations:
managing the customer relationship and invoicing;
answering support questions and feature proposals that Users address to DeciDesk;
recording the acceptance of the Terms of Service and this Processing Agreement, as described in Article 0.2;
keeping the log of administrative actions described in Annex 2;
keeping technical data to monitor the operation, availability, speed and security of the Service and to limit abuse.
For these purposes DeciDesk uses only account data, billing data, technical data, and data about the use of features, such as the number and duration of recordings. DeciDesk does not use the content of meetings, actions or other Customer Data for these purposes, except what a User includes in a support question or feature proposal. DeciDesk never uses the Personal Data for profiling or marketing. These processing operations are governed by the Privacy Policy and not by this Processing Agreement. The Customer agrees to this use of data that DeciDesk processes on behalf of the Customer.
2.5 This Processing Agreement applies for as long as DeciDesk processes Personal Data on behalf of the Customer. It ends only when that Personal Data has been deleted in accordance with Article 11.
Article 3. Instructions and responsibilities of the Customer
3.1 DeciDesk processes the Personal Data only on documented instructions from the Customer, including with regard to transfers to a country outside the EEA. This obligation does not apply if a provision of Union law or Dutch law requires DeciDesk to process the data. In that case DeciDesk informs the Customer of that legal requirement in advance, unless that law prohibits such notification on important grounds of public interest.
3.2 The Customer's instructions consist of this Processing Agreement, the Terms of Service, and the choices that the Customer and its Users make in the Service. Examples are creating a meeting, starting a recording, assigning roles, and deleting data.
3.3 The Customer gives additional instructions in writing via legal@decidesk.ai. If an additional instruction requires work that falls outside the normal operation of the Service, the parties agree in advance on the cost of that work. If DeciDesk cannot reasonably carry out an additional instruction, DeciDesk informs the Customer as soon as possible why the instruction cannot be carried out. The Customer may then terminate the Agreement in writing with immediate effect. DeciDesk refunds the prepaid amount for the period after the termination on a pro rata basis.
3.4 If DeciDesk is of the opinion that an instruction infringes the GDPR or other data protection rules, DeciDesk informs the Customer of that opinion immediately. DeciDesk may suspend the execution of that instruction until the Customer has amended the instruction. DeciDesk is not required to carry out an instruction that, in DeciDesk's reasonable opinion, infringes the GDPR or other data protection rules.
3.5 The Customer is responsible for the lawfulness of the processing. That responsibility means in any event that the Customer:
has a legal basis for the processing and informs the data subjects, as the GDPR requires;
informs the participants in a meeting in advance that the meeting will be recorded and transcribed, including when the recording bot records an online meeting; the recording bot joins under the name DeciDesk and does not itself announce that it is recording;
determines which Users are given access, with which role, and keeps that access up to date;
assesses for itself whether a data protection impact assessment (DPIA) is required; DeciDesk assists with this in accordance with Article 8.4;
assesses for itself whether the works council, the employee participation council, or another employee representation body must consent to the use of the Service, for example because the Service shows per person which actions are open and which are overdue; the Customer can also use the description in Article 8.4 for that purpose.
3.6 The Service is not intended for the processing of special categories of personal data, personal data relating to criminal offenses, or a statutory identification number such as the Dutch citizen service number (burgerservicenummer). If the Customer nevertheless processes such data in the Service, the Customer assesses in advance whether the measures in Annex 2 are appropriate for that purpose. DeciDesk recommends not recording such topics, such as the health of an employee, and not capturing them in an action or note.
Article 4. Confidentiality
4.1 DeciDesk keeps the Personal Data confidential. Everyone who has access to the Personal Data under DeciDesk's authority is bound by a confidentiality obligation under a contract or by law.
4.2 As of the date of this version, only Dennis Heemskerk has access to the Personal Data. He uses that access only for handling an incident, investigating a problem reported by the Customer, maintaining the Service, and carrying out a request from the Customer, such as setting up the Customer's environment. His account in the Service is a member of the Customer's organization only while DeciDesk is setting up the Customer's environment, or if the Customer asks for it. At the Customer's request, DeciDesk ends that membership. If another person is given access, DeciDesk notifies the Customer of that change in advance, or in an emergency as soon as possible.
4.3 DeciDesk does not disclose the Personal Data to third parties, except to Sub-processors in accordance with Article 6 or where the law requires it.
4.4 If DeciDesk receives a request from a government authority to disclose Personal Data, DeciDesk assesses whether the request is legally valid. DeciDesk discloses no more than is legally required and notifies the Customer of the request, unless the law prohibits that notification.
4.5 The confidentiality obligation continues to apply after the end of this Processing Agreement.
Article 5. Security
5.1 DeciDesk takes appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The measures are aimed at protecting the Personal Data against loss and against unlawful processing. In doing so, DeciDesk takes into account the state of the art and the costs of implementation. DeciDesk also takes into account the nature, scope, context, and purposes of the processing and the risks to data subjects.
5.2 Annex 2 describes the measures. DeciDesk evaluates them regularly and may adjust them, provided the level of security is not lowered as a result.
5.3 The Customer ensures security on its side. It keeps login credentials confidential and asks Users to use two-step verification where appropriate. DeciDesk recommends that at least Owners and administrators use two-step verification. The Customer cannot make two-step verification mandatory in the Service (Annex 2). The Customer revokes the access of departed Users in a timely manner and secures the devices with which Users use the Service.
5.4 Annex 2 describes the measures, so that the Customer can assess whether they are appropriate for the processing described in Annex 1. The Customer may ask DeciDesk questions about them (Article 10.1).
Article 6. Sub-processors
6.1 The Customer grants DeciDesk general written authorization to engage Sub-processors. Annex 3 lists the Sub-processors that DeciDesk uses at the time the Customer accepts this Processing Agreement.
6.2 DeciDesk gives notice of a new or replacement Sub-processor at least 30 days before that Sub-processor is used. DeciDesk gives notice in the same way if an existing Sub-processor moves the processing to a country outside the EEA. DeciDesk sends the notice by email to each Owner and to the privacy contact person referred to in Article 9.1, if the Customer has designated one. The notice states the Sub-processor, the service, the location of the processing, and the basis for any transfer. The current list of Sub-processors is Annex 3 in the most recently published version of this Processing Agreement.
6.3 The Customer may object on reasonable grounds within 30 days of the notice referred to in Article 6.2, via legal@decidesk.ai. During that objection period, a new or replacement Sub-processor does not process the Customer's Personal Data, except in the case of an urgent replacement under Article 6.4. If the Customer objects, the parties consult on a solution. If the parties do not reach a solution, the Customer may terminate the Agreement in writing. The termination takes effect on the day on which the notified change takes effect, or on a later day chosen by the Customer. DeciDesk refunds the prepaid amount for the period after that day on a pro rata basis.
6.4 Sometimes a Sub-processor must be replaced urgently to safeguard the security or the continuity of the Service. DeciDesk may then shorten the period referred to in Article 6.2. DeciDesk gives notice of the replacement as soon as possible, stating the reason for the urgency. The Customer may object within 30 days of that notice. If the parties do not reach a solution, the Customer may terminate the Agreement with immediate effect, with a refund in accordance with Article 6.3.
6.5 With each Sub-processor, DeciDesk enters into a written agreement that meets the requirements of Article 28(4) GDPR. For large providers, that agreement is their standard processing agreement. That agreement imposes on the Sub-processor in substance the same data protection obligations as this Processing Agreement. DeciDesk assesses in advance whether the Sub-processor provides sufficient guarantees for appropriate technical and organizational measures. A Sub-processor's retention periods may differ from the periods in this Processing Agreement. Annex 1 states those differing periods, under Retention at Sub-processors. Those periods apply to copies held by a Sub-processor (Article 11.3).
6.6 DeciDesk remains fully liable to the Customer for the performance of the obligations of the Sub-processors that DeciDesk engages.
Article 7. Transfers outside the EEA
7.1 The database, the file storage, and the AI models of the Service are located in the European Union. The conversion of speech to text takes place in the United States. Push notifications are delivered through the global services of Apple, Google and Microsoft. Sub-processors with an establishment or parent company in the United States may, from the United States, have access to Personal Data, for example for administration and support.
7.2 Some Sub-processors are established outside the EEA or may have access to Personal Data from outside the EEA. Annex 3 states, for each Sub-processor, where the processing takes place and the legal basis for any transfer.
7.3 DeciDesk transfers Personal Data to a country outside the EEA only if that transfer complies with Chapter V of the GDPR. DeciDesk bases a transfer primarily on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified recipients. In the absence of an adequacy decision, DeciDesk uses the standard contractual clauses from Implementing Decision (EU) 2021/914. In that case, DeciDesk assesses in advance the law and practice in the country of destination, documents that assessment, and takes supplementary measures where necessary. Upon request, the Customer receives the applicable standard contractual clauses and a summary of that assessment.
7.4 If the legal basis for a transfer ceases to apply, DeciDesk arranges another valid legal basis as soon as possible or stops the transfer. DeciDesk informs the Customer accordingly.
Article 8. Assistance
8.1 DeciDesk assists the Customer, insofar as reasonably possible, in handling requests from data subjects for access, rectification, erasure, restriction, portability, or objection.
8.2 The Customer handles many of those requests itself in the Service. The Customer can modify or delete data, delete recordings, and remove Users. After a User is removed, that User's name remains visible with earlier meetings and actions. If the Customer wants that name removed or replaced as well, DeciDesk carries this out upon request. For access and portability, DeciDesk provides the Customer, upon request, with an export of a data subject's Personal Data within 10 business days.
8.3 If DeciDesk receives a request directly from a data subject, DeciDesk forwards it to the Customer within 5 business days. DeciDesk does not respond to the substance of the request itself, unless the Customer instructs DeciDesk to do so.
8.4 DeciDesk also assists the Customer in complying with the obligations under Articles 32 to 36 GDPR. These concern the security of the processing, the notification of Personal Data Breaches, a data protection impact assessment (DPIA), and a prior consultation of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). In doing so, DeciDesk takes into account the nature of the processing and the information available to DeciDesk. For a DPIA, DeciDesk makes available upon request a written description of the Service, the data flows, the Sub-processors, and the measures.
8.5 The assistance under Article 8.2 and the description for a DPIA under Article 8.4 are free of charge, as is other assistance that falls within the normal operation of the Service. For other assistance, DeciDesk may charge reasonable costs, after providing a statement of those costs in advance. Assistance with a Personal Data Breach attributable to DeciDesk is always free of charge.
Article 9. Personal Data Breaches
9.1 DeciDesk notifies the Customer of a Personal Data Breach without undue delay, and no later than 48 hours after DeciDesk has become aware of the Personal Data Breach. This notification obligation also applies to a Personal Data Breach at a Sub-processor, from the moment DeciDesk has become aware of it. DeciDesk sends the notification by email to every Owner. The Customer may designate a privacy contact person by email to legal@decidesk.ai or upon signing. If the Customer has done so, the notification is also sent to that person.
9.2 The notification contains, insofar as known:
the nature of the Personal Data Breach;
the categories and the estimated number of data subjects and data records;
the likely consequences;
the measures that DeciDesk has taken or proposes;
a contact person at DeciDesk.
If not all information is known yet, DeciDesk first reports the information that is known and supplements the notification as soon as possible.
9.3 DeciDesk immediately takes measures to contain the Personal Data Breach and to prevent recurrence. DeciDesk keeps the Customer informed of the progress.
9.4 The Customer decides whether a Personal Data Breach is reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to data subjects. DeciDesk does not itself notify the supervisory authority or data subjects, unless the law requires DeciDesk to do so or the Customer requests it.
9.5 DeciDesk documents every Personal Data Breach, including the facts, the consequences, and the measures taken. The Customer may inspect that record insofar as it concerns its Personal Data.
9.6 If the Customer discovers a possible security issue in the Service, the Customer reports it immediately via legal@decidesk.ai.
Article 10. Information and audits
10.1 On request, DeciDesk provides the Customer with all information necessary to demonstrate that DeciDesk complies with this Processing Agreement. DeciDesk provides that information primarily in writing, for example with an explanation of the measures or with answers to a reasonable questionnaire.
10.2 If that information is not reasonably sufficient, the Customer may have an audit carried out at most once per year. The audit is carried out by the Customer's data protection officer or internal auditor, or by an independent expert. Every auditor is bound by a confidentiality obligation. The Customer announces the audit at least 30 days in advance, with a description of its scope.
10.3 In addition to that annual audit, the Customer may also have an audit carried out after a Personal Data Breach concerning its Personal Data, or if a supervisory authority requests it.
10.4 An audit takes place on business days and does not unnecessarily disrupt DeciDesk's business operations. An audit takes place primarily remotely, on the basis of documents, a shared screen, and interviews. An on-site visit takes place only if a remote audit is not reasonably sufficient, at a location designated by DeciDesk. The auditor is not given access to data of other customers. For Sub-processors, the audit relies on their own certifications and audit reports.
10.5 The Customer bears the costs of the audit, including DeciDesk's reasonable time at a rate stated in advance. If the audit shows that DeciDesk materially fails to comply with this Processing Agreement, DeciDesk bears the costs of the audit.
10.6 DeciDesk remedies shortcomings revealed by an audit within a reasonable period. The parties treat the audit report as confidential.
10.7 DeciDesk does not hold an information security certification, such as ISO 27001, NEN 7510, or SOC 2. On request, DeciDesk refers the Customer to the certifications and audit reports that the Sub-processors make publicly available.
Article 11. Retention, return, and deletion
11.1 During the term, the Customer determines how long Customer Data is retained, by keeping or deleting it in the Service. In addition, the fixed retention periods in Annex 1 apply, such as the automatic deletion of meeting audio 90 days after the recording.
11.2 After the end of the Subscription, DeciDesk retains the Customer Data for 90 more days, so that the Customer can reactivate the Service. During the term and during that period, the Customer may request an export via legal@decidesk.ai. DeciDesk delivers the export within 10 business days as a JSON file, a common format that other software can read. On request, DeciDesk also delivers the attachments and the audio that are still present at that time. DeciDesk announces the deletion by email to every Owner at least 14 days in advance. An Owner can also delete the organization in the Service, after confirmation through a link sent by email to an Owner. The Service then deletes the Customer Data from the database immediately; this cannot be undone. DeciDesk then deletes the files and the accounts within 30 days in accordance with Article 11.3. The Customer must request an export before that deletion.
11.3 After the period in Article 11.2, or earlier if the Customer so requests, DeciDesk deletes the Personal Data within 30 days. This applies to the database, the file storage containing audio, attachments, profile photos and logos, and the accounts of Users who are not members of another organization. For copies that Sub-processors retain on DeciDesk's instructions, the periods in Annex 1, under Retention at Sub-processors, apply. Where Annex 1 does not state a fixed period, the Sub-processor retains those copies in accordance with its own terms.
11.4 Database backups may still contain deleted Personal Data for up to 14 days after the deletion. DeciDesk uses those backups only to restore the Service after a failure or error. After 14 days they are deleted automatically.
11.5 The deletion obligation does not apply to data that DeciDesk is required to retain by law. DeciDesk uses that data only for that statutory purpose.
11.6 On request, DeciDesk confirms in writing that the deletion has been carried out.
11.7 If DeciDesk stops providing the Service, DeciDesk notifies the Customer of that termination at least 3 months in advance, unless bankruptcy or force majeure makes that impossible. The Customer may request an export in accordance with Article 11.2 until the end of that period. After that, DeciDesk deletes the Personal Data in accordance with Articles 11.3 through 11.6.
Article 12. Liability
12.1 The liability of the parties under this Processing Agreement is governed by Article 19 of the Terms of Service, subject to the deviations and additions in Article 12.2. Liability under this Processing Agreement and under the Terms of Service falls together under the same caps in Article 19 of the Terms of Service. Those caps also apply to recourse under Article 12.3 and to the indemnity under Article 12.5.
12.2 For liability under this Processing Agreement, the following deviations from and additions to Article 19 of the Terms of Service apply:
the limitations in Article 19 of the Terms of Service do not apply in the cases that article excludes: intent or deliberate recklessness, and liability that cannot be limited under mandatory law;
the exclusion of damage caused by loss of data does not apply to damage caused by a Personal Data Breach attributable to DeciDesk;
DeciDesk's liability for a Personal Data Breach attributable to DeciDesk, and for other breaches of this Processing Agreement or the GDPR by DeciDesk, is subject to the separate cap in Article 19 of the Terms of Service, and not to the general cap; in the cases in the first item, such as intent or deliberate recklessness, no cap applies.
12.3 Toward data subjects, the parties are liable as provided in Article 82 GDPR. If a party pays compensation for damage that is wholly or partly attributable to the other party, it may recover that part from the other party.
12.4 A fine imposed by a supervisory authority is borne by the party on which it was imposed.
12.5 The Customer indemnifies DeciDesk against third-party claims resulting from an instruction of the Customer that violates the GDPR, or from the Customer's failure to comply with Article 3.5 or 3.6.
Article 13. Duration, amendment, and governing law
13.1 This Processing Agreement takes effect at the moment of acceptance and ends as provided in Article 2.5. It also applies to processing that DeciDesk carried out on behalf of the Customer before that moment. It cannot be terminated separately from the Agreement.
13.2 For the processing of Personal Data, this Processing Agreement prevails over the other provisions of the Terms of Service. The Privacy Policy is for information and does not form part of the Agreement. In the event of a conflict between the articles of this Processing Agreement and an Annex, the articles prevail.
13.3 DeciDesk may amend this Processing Agreement. DeciDesk gives notice of each new version at least 30 days before it takes effect, together with an overview of the changes. The notice is sent by email to each Owner and to the privacy contact person referred to in Article 9.1, if the Customer has designated one. An Owner can also accept the new version earlier in the Service; that version then applies from that moment. For a signed copy, Article 0.4 also applies.
13.4 An amendment that reduces the protection of the Personal Data or the Customer's rights under this Processing Agreement applies to the Customer only after the Customer has agreed to it, for example by an Owner accepting the new version in the Service. As long as that agreement has not been given, the previous version continues to apply. In that case, DeciDesk may terminate the Agreement with a notice period of at least 30 days. In case of doubt as to whether an amendment reduces the protection or the Customer's rights, the amendment counts as a reduction. Any other amendment applies from the announced date. If the Customer does not agree to such other amendment, the Customer may terminate the Agreement with effect from the day on which the amendment takes effect. In the event of termination under this article, DeciDesk refunds the prepaid amount for the remaining period on a pro rata basis. Amendments to Annex 3 proceed in accordance with Article 6.
13.5 If a provision is null and void or voidable, the remaining provisions remain in effect. The parties then replace that provision with a valid provision that approximates its intent as closely as possible.
13.6 This Processing Agreement is governed by Dutch law. Disputes are submitted to the court designated in Article 27 of the Terms of Service.
13.7 This Processing Agreement is drawn up in Dutch. In the event of a difference between the Dutch text and a translation, the Dutch text prevails.
Annex 1. Processing Activities
Purposes. Providing the Service: preparing, capturing and following up on meetings, managing decisions and actions, transcribing, improving and summarizing recordings, determining the status of meetings with AI, using AI to propose agenda items and action titles and to create an overview of the previous meeting, sending notifications, searching with the DeciDesk Assistant, and securing and supporting the Service.
Categories of data subjects.
Users of the Customer and persons whom the Customer invites.
Participants in meetings that are recorded with the Service, including external participants in an online meeting.
Other persons who appear in Customer Data, for example in a decision, an action or a note.
Types of personal data and retention periods.
| Data | Description | Retention period |
|---|---|---|
| Account data | Name, email address, role, position in the organization, language, time zone, notification preferences, hashed password, two-step verification setting, optional profile photo, time of last use | For as long as the User is a member of the organization. If the User is removed from the organization, DeciDesk immediately deletes the email address, the password, the two-step verification setting, the profile photo, the login sessions and the push notification tokens. The name is retained so that earlier meetings and actions remain readable. When the organization is deleted, DeciDesk also deletes, within 30 days, the accounts of Users who are not members of another organization. |
| Invitations | Name and email address of the invited person, who sent the invitation and the intended manager | An accepted invitation until 30 days after acceptance. If an invitation is not accepted, the Service sends the invited person a new invitation weekly, up to 8 times. After that, the inviter receives a final notification, in which the inviter chooses whether the invitation is sent again. If the inviter does nothing, the Service deletes the invitation 7 days after that final notification. If an action had already been assigned to the invited person, the name and email address remain with that action after the invitation lapses, until the action is assigned to someone else. The name also remains in the history of that action. |
| Organizational structure | Companies within the organization, who reports to whom, project members | Until the Customer deletes the data, and at the latest until deletion in accordance with Article 11 |
| Content | Meetings, agenda items, decisions, actions with owner and deadline, updates, messages, projects, attachments | Until the Customer deletes the data, and at the latest until deletion in accordance with Article 11 |
| Meeting audio | Recordings in a room or via the recording bot in Teams, Google Meet or Zoom, containing the voices of participants | Automatically deleted 90 days after the recording. If the Customer deletes the recording earlier, DeciDesk deletes the audio immediately. If the Customer deletes the meeting or the organization, DeciDesk deletes the audio and the attachments within 30 days. For copies held by Sub-processors, see Retention at Sub-processors. |
| Recording bot | For each deployment of the recording bot: the link to the online meeting that a User enters, the title, the platform, the scheduled times and the status. The recording bot is scheduled from the meeting page. If a User nevertheless sends a calendar invitation to meeting@decidesk.ai, containing the names and email addresses of the invitees, the Service sends the User an explanation of how to schedule the recording bot from the meeting page. | A calendar invitation that arrives at meeting@decidesk.ai is deleted after processing. The data for each deployment is retained until the meeting is deleted. After that, only data for invoicing is retained, without the link and title. When the organization is deleted, DeciDesk deletes all data for each deployment within 30 days. For Recall.ai, see Retention at Sub-processors. |
| Recordings on the device | A temporary copy of a recording in the browser or the app, until the upload has been confirmed. If the upload fails, the Service may save the audio file on the User's device. | The copy is deleted as soon as the upload has been confirmed. If a copy in the browser has not been uploaded after 14 days, the Service deletes that copy the next time the Service is opened in that browser. A saved audio file remains on the device until the User deletes it. |
| Transcripts and summaries | Transcribed text, names of speakers and participants, AI-generated summaries and action proposals | Until the Customer deletes the meeting, and at the latest until deletion in accordance with Article 11. For copies held by Sub-processors, see Retention at Sub-processors. |
| Spoken updates | Voice-recorded updates on actions | DeciDesk retains only the text, as an update, and does not store the audio. For the copy held by ElevenLabs, see Retention at Sub-processors. |
| Questions to the DeciDesk Assistant | The question and the data that the User is permitted to see and that is needed for the answer | DeciDesk does not retain the question and the answer and processes them only to produce the answer. If the User confirms a feature proposal, DeciDesk retains that question as controller (Article 2.4). For Microsoft, see Retention at Sub-processors. |
| Notifications | Notifications in the Service, by email and as push notifications. A notification may contain names, titles of meetings, actions and projects, the text of updates and proposed deadlines. Push notifications are delivered with that content to the device via the operating system's push service (Annex 3). | Until the User is removed from the organization, and at the latest until deletion in accordance with Article 11. When the organization is deleted, DeciDesk deletes the notifications within 30 days. |
| Technical data | Login sessions per device with browser and operating system, push notification tokens, failed login attempts and sign-up attempts with email address or IP address | Sessions until sign-out or until a new login replaces the session. Push notification tokens until the platform rejects the token or the User is removed from the organization. Failed login attempts count for 15 minutes and sign-up attempts for 1 hour. Attempts older than 24 hours are cleaned up periodically. |
| Log files | Technical logs of the hosting with time, route, error messages and sometimes an email address | In accordance with Vercel's retention period, no longer than 30 days |
Retention at Sub-processors. In addition to the periods in the table, the following periods apply at Sub-processors:
Recall.ai deletes the recording made by the recording bot no later than 3 days after the recording ends. Recall.ai deletes the link to the online meeting after 14 days and log files after 7 days. Recall.ai retains other data about the deployment of the recording bot without a fixed period.
ElevenLabs converts the audio into text. As soon as DeciDesk has received the transcript, DeciDesk instructs ElevenLabs through the API to delete the transcript. According to ElevenLabs, this instruction immediately removes the audio and the text from the ElevenLabs database. If the deletion fails, DeciDesk tries again. ElevenLabs then keeps deleted data in backups for up to 30 days. ElevenLabs' logs for debugging and moderation may contain data about the request. ElevenLabs does not state a retention period for those logs. The use of this data for improving ElevenLabs' services is disabled (Article 2.3).
Microsoft may retain input and output of the AI models to detect abuse, in accordance with Microsoft's terms. Microsoft does not use that data to train models.
Apple, Google and Microsoft temporarily retain a push notification that cannot yet be delivered, in accordance with their own terms.
Article 11.4 applies to database restore points.
Special categories of personal data. The Service is not intended for such data; see Article 3.6.
Voice and AI. The Service uses voice audio only to convert speech into text and to distinguish speakers from one another within a single recording. The Service does not recognize or identify persons by their voice. The Service does not make decisions about persons based solely on automated processing.
Annex 2. Security Measures
This Annex describes the technical and organizational measures that DeciDesk has implemented as of the date of this version.
| Component | Measure |
|---|---|
| Encryption in transit | All connections to the Service run over HTTPS (TLS). Login cookies are sent only over a secure connection and cannot be read by scripts. |
| Encryption at rest | The following data is encrypted per field with AES-256-GCM, a common and strong form of encryption: messages, titles and questions of meetings and meeting series, agenda items, titles, descriptions and notes of actions and recurring actions, titles of child actions in the history of an action, updates, transcripts, summaries, the overview of the previous meeting, file names of attachments, links to and titles of online meetings, notifications and project updates. One key applies to all customers. The key is not stored in the database but in the protected settings of the hosting environment. Names and email addresses, names of organizations and companies, audio and attachments are not encrypted per field. In addition, the providers encrypt the database and the file storage in their entirety. |
| File storage | Audio and attachments are stored in protected storage in the EU. The Service provides a temporary link to a file only after verifying access rights. For transcription, ElevenLabs receives a temporary link that is valid for 2 hours. Profile photos and organization logos are stored at a web address with a long, random code. Anyone who has that link can see the photo or logo without signing in. |
| Hosting | The server functions of the application run in the EU region Frankfurt. Connections to the Service run through Vercel's global network. The database is located in the EU region Frankfurt and the file storage in the EU. The test environment uses a separate database. |
| Backups and recovery | Backups of the database are made automatically. Those backups are retained for no more than 14 days and are used only to restore the Service after a failure or error (Article 11.4). Audio and attachments have no separate backup. |
| Login | Passwords are stored only as hashes (bcrypt), so that the password itself cannot be derived from the database. An account only works after the email address has been confirmed or after an invitation has been accepted by email. Two-step verification with an authenticator app is available to every User. After a successful code, the Service does not ask for a new code on that device for 24 hours. The Customer cannot make two-step verification mandatory. Links for password recovery and for confirmation of the email address are valid temporarily and are stored only as a hash. Invitation links are valid for 7 days. |
| Protection against abuse | The number of login attempts is limited to 5 failed attempts per 15 minutes per account. Sign-up and requests for password recovery are limited per email address and per IP address. The number of AI requests in quick succession is limited per User. That limit is separate from the AI budget in Article 11 of the Terms of Service. |
| Sessions | An account can be logged in on no more than 2 devices at the same time, for example a laptop and a phone. If a User logs in on a third device, the Service first asks whether the device that has not been used for the longest time may be signed out. Users can see their logged-in devices and sign them out. A password change or password recovery signs out the other devices. A session expires after 7 days without use. |
| Access control | Each User sees only the data of their own organization, according to their role (owner, administrator or member) and their position in the organization. The Service verifies membership and permissions on every request. |
| Administrative access by DeciDesk | Only Dennis Heemskerk has administrative access. Administration takes place through a separate administration environment on its own domain, with one personal administrator account and sessions of no more than 12 hours. Signing in to the administration environment requires a password, a code from an authenticator app and a code sent by email. The administration screens do not display encrypted content. An export for a request under Article 8.2 or Article 11.2 does contain that content in readable form. The administration environment records sign-ins, exports of personal data, the removal of members and the deletion of organizations in a log. For maintenance and recovery, Dennis Heemskerk also has direct access to the database and the key. That direct access is not recorded automatically. Article 4.2 applies to the account of Dennis Heemskerk in the Service. |
| AI | The AI models run on Microsoft Azure within the EU data zone. The processing may take place in any EU member state. Microsoft does not use input and output to train models. Microsoft may retain input and output to detect abuse. DeciDesk does not retain conversations with the DeciDesk Assistant. The assistant uses only data that the User is themselves permitted to see. |
| Automatic deletion | Meeting audio 90 days after the recording. Incomplete audio uploads after 7 days. Accepted invitations 30 days after acceptance. Organizations for which no subscription has been activated 30 days after creation and in which nothing has been recorded, 7 days after a warning by email. Organizations without an activated subscription of which no member still has an active account, once they have existed for 7 days. Organizations with an ended subscription 90 days after the end of the subscription, after a warning by email at least 14 days in advance. Where this cannot be done automatically, for example with payment by invoice, DeciDesk deletes those organizations manually within the period in Article 11.3. Unconfirmed sign-ups without content after 30 days. |
| Integrations | Messages from the payment service and from the recording bot are accepted only if a digital signature proves that they really come from that service. Messages from the transcription service are accepted only if they belong to a job that the Service itself has submitted. |
| Changes and updates | All changes to the software go through version control and are first deployed to a separate test environment. Software libraries are updated during the development of new features and when a known vulnerability requires it. |
| Personnel | DeciDesk is a sole proprietorship. Who has access to the Personal Data, and under which conditions, is set out in Articles 4.1 and 4.2. |
| Incidents | Personal Data Breaches are handled and recorded in accordance with Article 9. |
Annex 3. Sub-processors
DeciDesk engages these Sub-processors as of the date of this version. Changes take place in accordance with Article 6.
| Sub-processor | Service | Location of the processing | Basis for transfer |
|---|---|---|---|
| Neon, part of Databricks, Inc., United States | Database | EU (Frankfurt) | EU-US Data Privacy Framework and standard contractual clauses |
| Vercel Inc., United States | Hosting of the application, and storage of audio, attachments, profile photos, and organization logos | Application in the EU (Frankfurt), with connections via Vercel's global network. File storage in the EU. | EU-US Data Privacy Framework and standard contractual clauses |
| Microsoft Ireland Operations Ltd., Ireland (Azure OpenAI) | AI models for summaries, action proposals, the status of meetings, the improvement of transcripts, proposals for agenda items and action titles, an overview of the previous meeting, and the DeciDesk Assistant | EU (EU Data Zone) | Processing within the EU; EU-US Data Privacy Framework and standard contractual clauses for access from the US |
| ElevenLabs (Eleven Labs Inc.), United States | Converting speech to text, for recordings of meetings and spoken updates | United States | EU-US Data Privacy Framework and standard contractual clauses |
| Recall.ai (Hyperdoc Inc.), United States | Recording bot for online meetings in Teams, Google Meet, and Zoom | EU (Frankfurt): DeciDesk uses Recall.ai's EU region. Recall.ai's processing agreement also names the United States as the place of processing. | Standard contractual clauses, for processing in or access from the United States |
| Mijndomein B.V., the Netherlands | Sending emails from the Service, and the mailboxes that receive undeliverable emails and calendar invitations for the recording bot | EU | No transfer |
| Microsoft Ireland Operations Ltd., Ireland (Microsoft 365) | DeciDesk's mailboxes for support and privacy requests, and receiving and forwarding incoming email | EU | Processing within the EU; EU-US Data Privacy Framework and standard contractual clauses for access from the US |
| Apple Inc., United States (Apple Push Notification service) | Delivery of push notifications on iPhone and iPad. Apple receives a device token and the title and text of the notification. | Worldwide | Standard contractual clauses |
| Google LLC, United States (Firebase Cloud Messaging) | Delivery of push notifications on Android. Google receives a device token and the title and text of the notification. | Worldwide | EU-US Data Privacy Framework |
| Microsoft Corporation, United States (Windows Push Notification Services) | Delivery of push notifications in the Windows app. Microsoft receives a channel address and the title and text of the notification. | Worldwide | EU-US Data Privacy Framework |
DeciDesk processes invoicing data as a controller (Article 2.4). Stripe Payments Europe, Limited, which processes the payments, is therefore not included in this list. The measurement of visits and loading times of the website and the Service with Vercel Web Analytics and Speed Insights is also DeciDesk's own processing (Article 2.4), without cookies.
Signing
Only required if the Customer wishes to have a signed copy (Article 0.4). The parties sign version 2 of this Processing Agreement without modifications. By signing, the Customer also accepts the Terms of Service attached to the signed copy (Article 0.4).
| Customer | DeciDesk | |
|---|---|---|
| Organization name | Dennis Heemskerk, trading as DeciDesk | |
| Dutch Chamber of Commerce number | 42123032 | |
| Group companies on whose behalf the Customer also signs (name and Dutch Chamber of Commerce number) | Not applicable | |
| Name of signatory | Dennis Heemskerk | |
| Position | Proprietor of the sole proprietorship | |
| Privacy contact for notifications (name and email address) | Dennis Heemskerk, legal@decidesk.ai | |
| Place and date | Rijnsburg, | |
| Signature |