Data Processing Agreement – Standard DPA

1. Contracting Parties and Introductory Provisions

Controller: the customer of the Truebar service who has entered into a subscription relationship for any plan and has accepted this document (hereinafter: the Controller).

Processor: VITASIS, informacijske tehnologije, d.o.o., Partizanska cesta 8A, 1381 Rakek, Slovenia, company registration number: 8299919000, tax number: SI 73387797 (hereinafter: the Processor).

1.1 This agreement governs the processing of personal data carried out by the Processor on behalf of the Controller in providing the Truebar service, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act (ZVOP-2).

1.2 This agreement forms an integral part of the Terms of Use of the Truebar service. In the event of any conflict between them regarding the protection of personal data, the provisions of this agreement shall prevail.

1.3 This agreement enters into force when the Controller accepts it electronically or signs it, and remains in force for the entire duration of the subscription relationship and until the data is deleted in accordance with Section 10.

1.4 This agreement applies in a uniform form to all plans. Customized terms and the specifics of an individual environment (processing location, Sub-processors, access, audits) may be agreed with customers on the Enterprise plan by means of an individual agreement; in the event of any conflict, the individual agreement shall take precedence over this agreement.

2. Definitions

Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given to them in Article 4 of the GDPR. In addition, in this agreement the following terms mean:

3. Subject Matter, Nature, Purpose and Duration of Processing

3.1 The Processor processes personal data solely for the purpose of providing the Service to the Controller: speech recognition, speaker segmentation, editing, translation, subtitle creation, AI summarization and storage of Controller Content.

3.2 The types of personal data, categories of data subjects and methods of processing are described in more detail in Annex 1.

3.3 The Controller decides independently which content to upload to the Service. If the content contains special categories of personal data under Article 9 of the GDPR (e.g. health data) or data relating to criminal convictions, the Controller shall, on the basis of its own risk assessment, determine whether the measures set out in Annex 2 are sufficient for it and, where necessary, agree additional measures with the Processor by means of an individual agreement.

3.4 Processing continues for the entire duration of the subscription relationship and ends with the deletion of data in accordance with Section 10.

4. Obligations of the Processor

The Processor undertakes to:

1. process personal data only on the documented instructions of the Controller; this agreement, the Terms of Use and the Controller’s use of the features of the Service constitute such instructions;
2. inform the Controller without delay if, in its opinion, an instruction infringes the GDPR or other data protection legislation;
3. ensure that persons authorized to process the data have committed themselves to confidentiality;
4. implement the technical and organizational measures set out in Annex 2;
5. not use Controller Content for its own purposes, including for training or improving artificial intelligence models, and not permit Sub-processors to do so;
6. assist the Controller in fulfilling the obligations under Section 8 of this agreement;
7. provide the Controller, upon request, with the information necessary to demonstrate compliance with this agreement and Article 28 of the GDPR, in accordance with Section 9.

5. Obligations of the Controller

5.1 The Controller warrants that it has an appropriate legal basis under Article 6 of the GDPR (and, where applicable, Article 9) for the processing of the personal data it uploads to the Service.

5.2 The Controller is responsible for informing data subjects, in particular participants in recorded meetings or conversations, about the recording, transcription and processing of their data.

5.3 The Controller independently assesses whether the measures described in this agreement and in Annex 2 are appropriate for the type of data it processes, including the processing location referred to in Section 7.

5.4 The Controller is responsible for the security of its user account, including passwords, and shall notify the Processor of any misuse.

6. Sub-processors

6.1 By accepting this agreement, the Controller grants general written authorization for the engagement of the Sub-processors listed in the list of Sub-processors published on the Processor’s website, as amended from time to time (Annex 3).

6.2 The Processor publishes the list of Sub-processors at https://truebar.si/subprocessors and notifies the Controller of any intended changes (addition or replacement) by e-mail or in the application at least 14 days in advance. For each Sub-processor, the list states its name, the purpose of processing, the processing location and the basis for any transfer to a third country.

6.3 The Controller may object to a change within that period on reasonable data protection grounds. If the parties cannot find a solution, the Controller may terminate the subscription relationship without a notice period.

6.4 The Processor concludes an agreement with each Sub-processor imposing on it the same data protection obligations as those of the Processor under this agreement, and remains liable to the Controller for the Sub-processor’s performance.

7. Processing Location and Transfers to Third Countries

7.1 The Service is hosted in a Sub-processor’s data center in Slovenia, where Controller Content is stored. Certain features are performed by Sub-processors from the list of Sub-processors, with whom processing takes place in the EU.

7.2 For customers on the Enterprise plan with a dedicated isolated environment or a local (on-premise) installation, the processing location and any Sub-processors may be determined by an individual agreement (Section 1.4).

7.3 Some Sub-processors are established outside the EEA (e.g. in the USA). Where personal data is transferred to or accessed from a third country, the Processor ensures an appropriate basis under Chapter V of the GDPR, in particular an adequacy decision (e.g. the EU-U.S. Data Privacy Framework) or the European Commission’s standard contractual clauses.

7.4 For AI summarization, the Processor uses a provider from the list of Sub-processors with whom requests are processed in the EEA. If the provider is established outside the EEA, the basis set out in Section 7.3 applies to any access from a third country.

7.5 For speech recognition in the OSNOVNI, ZAČETNI and PRO plans, and for translation in all plans, the Processor uses an external provider from the list of Sub-processors with whom processing takes place in the EU. In the Enterprise plan, speech recognition is by default performed using the Processor’s own models deployed in its environment (Section 7.1), so that audio for transcription is not disclosed to third parties; the customer may choose to use an external provider for speech recognition. The Processor retrieves the processing results (transcripts and translations) into its own environment, where it stores them in accordance with Section 7.1, and immediately after retrieval deletes the submitted files and results at the external provider, so that they do not remain stored there. The external provider does not use the data for training models. If the provider is established outside the EEA, the basis set out in Section 7.3 applies to system data (e.g. request metadata) and any limited access from a third country.

8. Security, Breaches and Assistance to the Controller

8.1 The Processor implements the technical and organizational measures set out in Annex 2, which are appropriate to the risks of processing in accordance with Article 32 of the GDPR. It may update the measures provided that the level of protection is not reduced.

8.2 The Processor shall notify the Controller without undue delay, and no later than 72 hours after becoming aware of it, of any personal data breach affecting Controller Content. The notification shall contain the information available to the Processor that the Controller needs to fulfill its obligations under Articles 33 and 34 of the GDPR.

8.3 The Processor shall assist the Controller to a reasonable extent in responding to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). The Controller can handle most requests itself using the features of the Service (exporting and deleting sessions). The Processor shall forward to the Controller any request addressed by a data subject directly to the Processor.

8.4 The Processor shall, upon request, provide the Controller with the information necessary for a data protection impact assessment and for prior consultation with the supervisory authority, insofar as it relates to the Service.

9. Audits

9.1 The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 of the GDPR (a description of the measures, the list of Sub-processors, access logs to the extent they concern the Controller), and allows for and contributes to audits, including documentation reviews, responses to a written questionnaire or remote reviews, conducted by the Controller or an auditor mandated by it. Such a review shall be announced at least 30 days in advance, carried out during normal business hours, no more than once per year (except in the event of a breach or at the request of a supervisory authority), and in a manner that does not interfere with the data of other customers.

9.2 An on-site inspection at the Processor’s premises is possible only if a review under Section 9.1 is not sufficient to demonstrate compliance, where it is required by a supervisory authority, or where a security breach affecting the Controller’s data has occurred. An on-site inspection shall be announced at least 30 days in advance (or, in the event of a security breach, within a reasonable shorter period) and carried out during normal business hours in a manner that does not interfere with the data of other customers or the Processor’s trade secrets. The auditor must be bound by confidentiality, and the costs of the on-site inspection shall be borne by the Controller.

10. Data Retention and Deletion

10.1 Controller Content is retained until the Controller deletes it. Source recordings and transcripts are automatically deleted 90 days after their creation.

10.2 Upon termination of the subscription relationship or closure of the account, the Controller has 14 days to export its content. After this period expires, the Processor deletes the content, and deletes backup copies within no more than 90 days, unless the law requires longer retention.

10.3 The Sub-processor for AI summarization does not retain requests and responses for longer than necessary for processing.

11. Liability

11.1 The liability of the parties for damage resulting from a breach of this agreement is governed by the limitation of liability provisions of the Terms of Use, to the extent permitted by Article 82 of the GDPR and other mandatory regulations.

12. Final Provisions

12.1 The Processor may amend this agreement due to changes in legislation, guidance from the supervisory authority or changes to the Service. The Processor shall notify the Controller of material changes at least 14 days in advance; in such case, the Controller has the right to terminate in accordance with Section 6.3.

12.2 This agreement is governed by the law of the Republic of Slovenia. The court with subject-matter jurisdiction in Ljubljana shall have jurisdiction over any disputes.

12.3 If any provision is invalid, this shall not affect the validity of the other provisions.

12.4 Data protection contact at the Processor: dpo@vitasis.si.

Annex 1: Description of Processing

Annex 2: Technical and Organizational Measures

• Encryption: data in transit protected via TLS 1.2.
• Access control: employee access to Controller Content only when necessary for support or troubleshooting, based on the principle of least privilege; two-factor authentication for administrative access.
• User authentication: login via Keycloak; option of two-factor authentication.
• Data segregation: logical separation of individual users’ data.
• Logging: logging of access and administrative actions, with logs retained for 90 days.
• Availability: regular backups, incident recovery plan.
• Vulnerability management: regular system updates, periodic security reviews.
• Personnel: contractual confidentiality obligations, data protection training.
• Sub-processors: data processing agreements, assessment of security practices prior to engagement; for AI summarization, the provider does not use the data for training models.

Annex 3: List of Sub-processors

The list of Sub-processors is published at https://truebar.si/subprocessors and forms an integral part of this agreement as amended from time to time. Changes to the list are made in accordance with the procedure set out in Section 6.