Data Processing Agreement

Draft version 0.1. Publisher: Transcrib Si.

This is a template, not a signed agreement. The final wording is for a lawyer: it has to be reviewed against the actual contract with the customer, the data protection law that applies to them and the way the service really runs. Every [ЗАПОЛНИТЬ: …] mark is a fact only the owner can supply. Until both are done, this document has no effect.

Ask us for the current version and we will send it as a PDF ready for signature: write to legal@transcrib.si. For a Team plan or an API contract with a committed volume, we sign a DPA and attach it to the order form.

1. Parties

This Data Processing Agreement (the "DPA") is entered into between:
the processor — [ЗАПОЛНИТЬ: юридическое лицо, зарегистрированное наименование, адрес регистрации, номер в торговом реестре, ИНН/налоговый номер], operating the Transcrib Si service ("Transcrib Si"); and
the controller — [ЗАПОЛНИТЬ: наименование и адрес заказчика] (the "Customer").

It applies to the processing of personal data carried out in the course of delivering the Transcrib Si service under the agreement between the parties (the "Agreement"). If the Agreement contains data protection terms that conflict with this DPA, this DPA prevails on data protection, unless the Agreement expressly says otherwise and names the clauses.

2. Roles

The parties agree that the role depends on the processing activity, and that Annex 1 lists it activity by activity:

• Transcrib Si acts as a processor for the personal data contained in the audio, video, transcripts and files the Customer uploads, and for the personal data in the Customer's account and the instructions the Customer gives through the API, the web app or the MCP server. We process that data only on the Customer's documented instructions, including the instructions in the Agreement and in this DPA.
• Transcrib Si acts as an independent controller for the data needed to run our own business: our billing and tax records, our own accounting, the security logs of our infrastructure, the contact data of our own staff and suppliers, and the data in our own marketing communications where the law allows it. That data is described in the privacy policy.

Where a court or a regulator decides that a different role applies to a processing activity, the parties will record that decision in writing and adjust this DPA accordingly.

3. Subject matter, duration and nature

• Subject matter — the transcription service: uploading audio or video, producing a transcript with timestamps and speaker labels, editing and exporting it, and the API and MCP interfaces to the same.
• Duration — the term of the Agreement, plus the retention periods in clause 12 for the data that survives the Agreement.
• Nature — collection, receipt, storage, hosting, retrieval, consultation, analysis (speech recognition and diarisation), editing by the Customer, export, and deletion.
• Purpose — to provide the service to the Customer and to the people the Customer processes recordings for. We do not use the Customer's content to train models for other customers, and we do not sell it.

4. Categories of data

• Data subjects — the Customer's employees, contractors, customers, clients, meeting participants and any other person recorded in the uploaded audio, as well as the Customer's own authorised users.
• Categories of personal data — recorded speech and any personal data spoken in it (names, roles, contact details, business information, health information if the Customer chooses to record it, and anything else the recording contains); transcripts, timestamps and speaker labels derived from that speech; the contact details of the Customer's users (name and email); usage and technical data (IP address, user agent, request timestamps, error logs, file names, file sizes, durations, character counts); and billing data.
• Sensitive data — the service does not exclude it. If the Customer uploads recordings of health, legal, financial or biometric conversations, the Customer decides whether that is lawful and whether extra safeguards are needed. [ЗАПОЛНИТЬ: юрист — решить, запрещаем ли мы в договоре загрузку особых категорий данных или описываем их как риск заказчика]
• Data we never receive — card numbers and bank credentials. Payment data goes to Stripe and stops there.

5. Our security measures

The measures below are the ones we actually operate today. The full description is on the security page; Annex 3 repeats it in the form a customer can file.

• All traffic is encrypted with TLS; the website and the API are served over HTTPS only.
• Passwords and API keys are stored only as salted hashes. A key is shown once, when it is created, and never again.
• Sessions use signed tokens with a limited lifetime, and every request is authorised against the token that carries it.
• Uploaded files are stored on infrastructure we run ourselves, separate from any other service we run, and are reachable only from the transcription path.
• Deleting a file removes it from the live system immediately; it leaves backups within 30 days.
• Logs record what happened — identifiers, timings, counts, error codes — and not the content of your audio or your transcripts.
• Access to production is restricted to the people who need it, and every production change goes through review.
• Secrets live in environment variables, never in the code and never in the repository. The repository is scanned for credential-shaped values before every release.
• The site runs no third-party trackers and loads no assets from third-party CDNs.

[ЗАПОЛНИТЬ: юрист — дополнить перечень мерами, которых нет в коде (например, шифрование дисков, ротация бэкапов, журналирование доступа), только если они действительно внедрены]

6. Sub-processors

Annex 2 lists the sub-processors we use. We give the Customer 30 days' notice before adding or replacing one, and the Customer may object in writing during that period. If we cannot resolve the objection, the Customer may terminate the affected part of the Agreement without penalty.

7. International transfers

The processing described in Annex 1 happens partly outside the EEA, the UK and Switzerland. The parties will put in place a valid transfer mechanism before any such processing starts: [ЗАПОЛНИТЬ: название механизма — стандартные договорные условия ЕС (SCC) с подписанным экземпляром, либо иной применимый механизм, и оценка риска передачи].

Until that is done, the Customer may not upload personal data subject to the GDPR or the UK GDPR into the service. [ЗАПОЛНИТЬ: владелец — решить, блокируется ли загрузка для клиентов из ЕЭС/Великобритании до подписания SCC]

8. Data subject rights

Where the Customer asks us to act on a request from a data subject, we will forward the request to the Customer without undue delay and assist the Customer in answering it. We will not answer a data subject directly about data we process on the Customer's behalf, unless the law requires it or the Customer instructs us in writing. The Customer's users can already exercise their rights directly in the app: delete a file, close an account, or ask us for a copy of their data at support@transcrib.si.

9. Security incidents

We notify the Customer without undue delay after becoming aware of a personal data breach affecting data processed under this DPA. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records involved, the likely consequences, and the measures taken or proposed. We will keep the Customer informed as the investigation develops and will provide the information the Customer needs for its own notification obligations.

10. Assessments and regulator enquiries

We will make available the information the Customer needs for a data protection impact assessment, and will cooperate with the competent supervisory authorities where the law requires it. The Customer will tell us in good time about a specific assessment or enquiry that concerns our processing, so we can take part.

11. Audit

• The Customer may audit us once a year, and more often if there has been a personal data breach or a supervisory authority has asked for it.
• The audit is on reasonable written notice, during business hours, in a way that does not disrupt the service or the rights of other customers.
• The Customer bears the cost of the audit, unless the audit finds that we are in breach of this DPA, in which case we bear it.
• We will normally satisfy an audit request with the documents in Annex 3, the security page, a summary of an independent test we have run, and a live demonstration. We do not hand over the personal data of other customers, our source code or our credentials.

[ЗАПОЛНИТЬ: юрист — согласовать формулировку про аудит с учётом того, что публичного отчёта об аудите (SOC 2 / ISO 27001) у нас пока нет; обещать его нельзя]

12. Deletion and return

• On termination of the Agreement, we delete or return the personal data processed on the Customer's behalf, at the Customer's choice, unless the law requires us to keep it.
• Deletion from the live system happens immediately; the data leaves our backups within 30 days. Billing and tax records survive for as long as the law requires.
• Where the Customer asks us to delete a specific file or transcript during the term, we do it immediately, in the same way as a user deleting it in the app.

[ЗАПОЛНИТЬ: владелец — проверить, что сроки хранения выключены в коде; сейчас автоматической уборки по срокам в API нет]

13. Liability

This DPA does not change the liability agreed in the Agreement. Where the Agreement limits our liability, that limit applies to claims under this DPA as well. Where the law does not allow a limit, the limit applies as far as the law permits. [ЗАПОЛНИТЬ: юрист — проверить, что «заголовок» DPA не даёт клиенту обойти потребительские гарантии и что совокупная ответственность не удваивается]

14. Termination

This DPA ends when the Agreement ends. Clauses that by their nature survive — confidentiality, liability, audit records, and the deletion obligations — survive the end.

Annex 1 — Processing description

Annex 2 — Sub-processors

Annex 3 — Technical and organisational measures

The measures listed in clause 5, plus the following, are the measures in place on the date of this DPA. [ЗАПОЛНИТЬ: владелец — подтвердить каждую строку; в тексте не должно быть мер, которых нет в коде]

• [ЗАПОЛНИТЬ: шифрование диска / тома — да или нет]
• [ЗАПОЛНИТЬ: место и защита резервных копий]
• [ЗАПОЛНИТЬ: двухфакторная аутентификация для сотрудников — да или нет]
• [ЗАПОЛНИТЬ: регулярное резервное копирование и проверка восстановления — расписание]
• [ЗАПОЛНИТЬ: политика обновления зависимостей и патчей — расписание]

Signatures

Questions about this document: legal@transcrib.si. Security questions: security@transcrib.si.