Data processing agreement (DPA)
This data processing agreement (“DPA”) forms part of the agreement between the customer (“Controller”) and Digital Genics (“Processor”) for the use of HeyOtto, and governs the processing of personal data in accordance with Article 28 GDPR.
1. Subject matter, duration, nature and purpose
The Processor processes personal data solely to provide the HeyOtto service: categorising incoming email and preparing draft replies and tasks. The processing lasts for the duration of the agreement. HeyOtto never sends email itself.
Categories of data subjects and data
- Data subjects: the customer's staff and their correspondents.
- Data: name and email address, the content of emails and drafts, and related tasks and metadata.
2. Processing on instructions
The Processor processes the data solely on documented instructions from the Controller, as set out in the agreement and the settings in the app (including the training opt-in, which is off by default). The Processor does not use the data for its own purposes.
3. Confidentiality
Persons with access to the data are bound by confidentiality. Access is limited to what is necessary to provide and support the service.
4. Security measures (TOMs)
The Processor takes appropriate technical and organisational measures, including:
- Encryption of data in transit (TLS) and of sensitive tokens at rest;
- Strict access control, role-based permissions and logical separation per organisation (multi-tenant);
- Minimal OAuth permissions — read and draft, never send;
- Logging, monitoring and error recording for security purposes;
- Backups and recovery procedures;
- Processing within the EU.
5. Sub-processors
The Controller grants general authorisation for the engagement of the subprocessors listed below. The Processor informs in advance of any changes, so that an objection is possible.
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic | AI model for categorising and drafts | Processing in accordance with API terms; does not train on customer data |
| Microsoft | Microsoft 365 / Graph (if you connect this) | EU |
| Gmail (if you connect this) | EU | |
| [Hostingpartner] | Hosting and database | EU |
| [Betaalpartner] | Subscriptions and billing | EU/EEA |
6. International transfers
Data is in principle processed within the EU/EEA. If a transfer to a third country is necessary, this takes place with appropriate safeguards (such as the European Commission's standard contractual clauses).
7. Assistance to the Controller
The Processor assists, to the extent reasonable, with responding to data subject requests and with obligations relating to security, data protection impact assessments and prior consultation.
8. Data breaches
The Processor reports a personal data breach without undue delay after becoming aware of it, with the information necessary to comply with the notification obligation.
9. Return and deletion
At the end of the service, the Processor deletes the personal data or returns it, at the Controller's choice, subject to statutory retention obligations. HeyOtto provides a data export and a deletion function for this purpose.
10. Audits
The Processor makes available the information necessary to demonstrate compliance with Article 28 GDPR, and cooperates with reasonable audits.
Questions about this text or your data? Email privacy@heyotto.eu. HeyOtto is a product of Digital Genics.