Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Use (the "Terms") between Dovio AB, corporate identity number 559568-0249, Essingestråket 18, 112 66 Stockholm, Sweden ("Dovio", "we") and the customer that has accepted the Terms ("Customer", "you"). It applies automatically when you accept the Terms. No signature is needed, but you can request a signed copy from support@dovio.io.

In short

This summary is for convenience. The numbered sections below are what govern.

Your data is yours. We process it only to run Dovio for you, following your instructions.
We store and process it in the EU. Each provider and its location is listed on our subprocessors page.
We keep it confidential and secure, and we never use it to train AI models.
If a breach affects your data, we tell you without undue delay and help you handle it.
We announce new subprocessors at least 14 days in advance, and you can object.
When you ask us to, we delete your data within 30 days.

1. Definitions

1.1Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1.2"Customer Personal Data" means personal data that Dovio processes on the Customer's behalf when providing the Service, as described in Annex 1.

1.3"Data Protection Law" means the GDPR and the national laws that supplement it, including the Swedish Data Protection Act (2018:218).

1.4"Subprocessor" means a third party that Dovio engages to process Customer Personal Data.

1.5Other capitalised terms have the meanings given in the Terms.

2. Roles and scope

2.1For Customer Personal Data, the Customer is the controller and Dovio is the processor. Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

2.2This DPA does not apply to personal data for which Dovio is the controller, such as account, billing and usage data about the Customer's users. Our Privacy Policy covers that data.

2.3This DPA does not cover data that the Customer chooses to send from the Service to a third-party service, such as an integration the Customer connects with its own account. The Customer's own agreement with that third party governs that data.

2.4If this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA prevails.

3. Instructions

3.1Dovio processes Customer Personal Data only on the Customer's documented instructions, unless EU or Member State law requires otherwise. In that case Dovio will inform the Customer of the legal requirement before processing, unless the law prohibits it.

3.2The Customer's instructions are this DPA, the Terms, and the Customer's use and configuration of the Service, for example connecting a mailbox, choosing what teammates can see, sending the meeting assistant to a meeting, or deleting a record. The Customer may give additional written instructions if they are consistent with the Terms.

3.3Dovio will inform the Customer immediately if, in Dovio's opinion, an instruction infringes Data Protection Law.

3.4Dovio does not sell Customer Personal Data, does not use it for advertising, and does not use it to train or improve AI models, whether Dovio's or anyone else's.

4. The Customer's responsibilities

4.1The Customer is responsible for having a legal basis for the processing, for the accuracy and lawfulness of the Customer Personal Data, and for giving data subjects the information that Data Protection Law requires.

4.2When the Customer records a meeting with the meeting assistant, the Customer is responsible for informing the participants and, where required, obtaining their consent. The meeting assistant also announces the recording in the meeting chat.

4.3The Customer should not enter special categories of personal data (Article 9 GDPR) or data about criminal convictions and offences (Article 10 GDPR) into the Service unless doing so is necessary and lawful.

5. Confidentiality

5.1Dovio ensures that everyone authorised to process Customer Personal Data is bound by confidentiality, by contract or by law. Dovio personnel access Customer Personal Data only when needed to provide the Service, to give support the Customer has asked for, or to investigate a security incident.

6. Security

6.1Dovio implements the technical and organisational measures described in Annex 2 to protect Customer Personal Data, taking into account the state of the art, the cost of implementation and the risks of the processing (Article 32 GDPR).

6.2Dovio may update these measures over time, provided the overall level of protection does not decrease.

7. Subprocessors

7.1The Customer gives Dovio general authorisation to engage Subprocessors. The Subprocessors in use are listed, with their purpose and location, on our Subprocessors page, which forms part of this DPA.

7.2Dovio will announce any intended addition or replacement of a Subprocessor on the Subprocessors page at least 14 days before the new Subprocessor starts processing Customer Personal Data. Customers who want these announcements by email can subscribe by writing to support@dovio.io.

7.3The Customer may object to a new Subprocessor on reasonable data protection grounds by writing to support@dovio.io within 14 days of the announcement. Dovio will then work with the Customer in good faith to find a solution. If none is found, the Customer may stop using the Service and terminate the Terms.

7.4Dovio requires each Subprocessor, by written contract, to protect Customer Personal Data to at least the same standard as this DPA. Dovio remains responsible to the Customer for its Subprocessors' performance of those obligations.

8. Location and international transfers

8.1Dovio stores and processes Customer Personal Data in the European Union. The location of each Subprocessor is shown on the Subprocessors page.

8.2Dovio will transfer Customer Personal Data outside the European Economic Area only in compliance with Chapter V of the GDPR, for example to a recipient covered by an adequacy decision, such as a company certified under the EU-U.S. Data Privacy Framework, or under the Standard Contractual Clauses approved by the European Commission. This also applies when a Subprocessor's staff access data from outside the EU, for example to provide support.

9. Assistance

9.1Taking into account the nature of the processing, Dovio helps the Customer respond to requests from data subjects exercising their rights. Most requests can be handled directly in the Service, where the Customer can view, export, correct and delete data. If Dovio receives a request directly from a data subject about Customer Personal Data, Dovio will forward it to the Customer and will respond only on the Customer's instructions.

9.2Dovio provides reasonable assistance, using the information available to it, with the Customer's obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority.

9.3If an authority requests access to Customer Personal Data, Dovio will notify the Customer unless the law prohibits it, and will disclose only what it is legally required to disclose.

10. Personal data breaches

10.1Dovio will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Dovio will send the notification by email to the Customer's workspace owners.

10.2The notification will describe, as far as the information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where not all of this is known at once, Dovio will provide it in phases without further undue delay.

10.3Dovio will take reasonable steps to contain the breach and limit its consequences, and will help the Customer notify the supervisory authority and data subjects where required. Notifying the supervisory authority remains the Customer's responsibility as controller.

11. Audits

11.1Dovio makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, including this DPA, the Subprocessors page, the security measures in Annex 2 and, on request, information about Dovio's most recent CASA Tier 2 assessment, an independent security assessment.

11.2If that information is not sufficient, the Customer, or an independent auditor mandated by the Customer and bound by confidentiality, may audit Dovio's compliance with this DPA, including through inspections. The Customer will give at least 30 days' written notice. Audits take place during normal business hours and at most once every 12 months, unless a supervisory authority requires otherwise or a personal data breach gives reason for one.

11.3Each party bears its own costs of an audit. If an audit requires significant work from Dovio beyond providing documentation, the Customer will reimburse Dovio's reasonable costs, agreed in advance.

12. Term, return and deletion

12.1This DPA applies for as long as Dovio processes Customer Personal Data under the Terms.

12.2During the term, the Customer can export its data from the Service, for example to CSV or Excel, and delete individual records at any time.

12.3When the Customer stops using the Service, Dovio keeps the Customer Personal Data in the locked workspace so the Customer can return, unless the Customer instructs Dovio to delete it. The Customer may give that instruction at any time by writing to support@dovio.io.

12.4Within 30 days of a deletion instruction, Dovio deletes the Customer Personal Data, including copies held by Subprocessors on Dovio's behalf, and confirms the deletion in writing. Copies in backups are deleted as the backups expire, within a further 30 days. Dovio keeps data only where EU or Member State law requires it.

13. Liability

13.1Each party's liability under this DPA is subject to the limitations of liability in the Terms, except where Data Protection Law does not allow such a limitation. Liability towards data subjects is governed by Article 82 GDPR.

14. Changes to this DPA

14.1Dovio may update this DPA to reflect changes in the law, in the Service or in its Subprocessors. Dovio will notify the Customer's workspace owners by email at least 30 days before a material change takes effect. If the Customer objects, it may terminate the Terms before the change takes effect. Otherwise the updated DPA applies from that date.

14.2Changes to the list of Subprocessors follow section 7, not this section.

15. Governing law and language

15.1This DPA is governed by Swedish law. Disputes are resolved as set out in the Terms.

15.2This DPA is provided in English and may be translated into other languages for convenience. If the English version and a translation differ, the English version prevails.

Annex 1: Details of the processing

Subject matter: Provision of the Dovio CRM service to the Customer under the Terms.
Duration: The term of the Terms, and afterwards until the data is deleted under section 12.
Nature and purpose: Hosting and storing the Customer's CRM data; syncing connected mailboxes and calendars and showing email next to the right records; transcribing the meetings the Customer sends the meeting assistant to; generating AI summaries, suggested tasks, email drafts and answers in Ask Dovio at the Customer's request; sending email on the Customer's behalf; preparing contracts for electronic signature; providing support; and keeping the Service secure.
Categories of data subjects: The Customer's users; the Customer's contacts, such as customers, prospects, partners and suppliers, and their employees; people who email or meet with the Customer's users; meeting participants; contract signers.
Types of personal data: Names, email addresses, phone numbers, job titles and company details; notes, tasks, deals and other content the Customer enters; email messages and metadata from connected mailboxes (fetched when viewed and not stored by Dovio, apart from the contacts created from them); calendar events and attendees; meeting audio (processed to create a transcript), transcripts and summaries; contract documents, signatures and signing audit trails.
Special categories: None intended. See section 4.3.
Location: European Union. The Subprocessors page shows each Subprocessor's location.
Retention: Until the Customer deletes the data or instructs deletion under section 12. Meeting audio held by the meeting assistant provider is deleted after 7 days.

Annex 2: Technical and organisational security measures

Hosting and location: The Service runs in EU data centres in Germany and Ireland.
Encryption: Data is encrypted at rest (AES-256) and in transit (HTTPS with TLS).
Separation between customers: Each customer's data belongs to its own organisation. Every database query is scoped to the organisation, and row-level security in the database acts as a second safeguard.
Access control in the Service: Role-based access (owner, admin, member). The person who connects a mailbox decides how much of it teammates can see.
Authentication: Sign-in through Google or Microsoft (OAuth 2.0) or a one-time email link, with secure session management.
Staff access: Access to production systems and Customer Personal Data is limited to the Dovio personnel who need it, and is used only to operate the Service, give support the Customer has asked for, or investigate security incidents.
Data minimisation: Email content is fetched from the mailbox when viewed rather than stored. The meeting assistant records no video, and meeting audio at the provider is deleted after 7 days.
AI processing: AI requests are processed in the EU with zero data retention, and AI providers are contractually barred from training on the data.
Monitoring and logging: Errors are monitored with pseudonymous user identifiers. Request bodies and password fields are removed from error reports.
Backups and recovery: The database is backed up automatically, with point-in-time recovery.
Independent testing: Dovio has passed CASA Tier 2 (Cloud Application Security Assessment), which tests the application against the OWASP Application Security Verification Standard. An authorised lab verifies the results, and the assessment is renewed every year.
Subprocessor management: Each Subprocessor is bound by a data processing agreement and assessed for security before it is engaged.
Incident handling: Security incidents are investigated and contained, and affected customers are informed as described in section 10.

Questions

For questions about this DPA, or to request a signed copy, email support@dovio.io.