Data Processing Agreement

1. Roles and the law that applies

Your organization is the controller of the personal data in its workspace, and we process it as your processor. For members' accounts and sign-in, our security logs, billing, the messages people send us and our own marketing, we are the controller, as our Privacy Policy explains. "Data protection law" means the UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies to your organization.

2. The processing

• Subject matter: providing Glassa to your organization under the Terms.
• Duration: while your organization uses Glassa, and until its data is deleted under section 11.
• Nature and purpose: hosting, storing, sending, displaying and otherwise processing your workspace's content to provide Glassa's features, including the AI teammates your organization hires and the AI features it turns on, and keeping the service secure and supported.
• Categories of data: chat (conversations, messages, threads, reactions, voice notes and attachments); work items (objectives, work items, parts, links and progress updates); the people directory (members, AI teammates, roles, groups, presence and profile photos); team mail (messages, headers, attachments and mail domains); meetings (call details, audio and video, transcripts, summaries and notes); files and published documents; and AI teammates' audit logs (their actions, tool calls and model usage).
• Data subjects: your organization's members and guests, the people who exchange team mail or join meetings with them, and anyone your workspace's content is about.
• Special category data: Glassa is not designed for it. If your workspace holds any, your organization is responsible for having a lawful basis for it, as our Acceptable Use Policy says.

3. Your instructions

We process your organization's personal data only on its documented instructions: these terms, and the way its members and administrators use and configure Glassa, including the AI teammates it hires. If the law requires us to process it otherwise, we will tell you first unless the law forbids that. We will tell you if we think an instruction breaks data protection law.

We do not use your organization's personal data, or anything else in its workspace, to train AI models.

AI teammates. A teammate acts in your workspace on your organization's behalf, only within the access your organization gives it, and records what it does in an audit log your organization can review. Glassa shows it as AI in the people directory and on its profile. Today a teammate runs in the Glassa desktop app, on the computer of the member who hires it, and works through the AI model account that member connects to it, such as their own ChatGPT account. That computer and that account are your organization's choice: the provider of the account processes what the teammate sends it under your organization's or that member's own agreement with it, not as our sub-processor. Apart from the teammate's audit log and the work it does in your workspace, what it keeps on that computer stays there, and we have no access to it. We plan to offer teammates that run on a computer we provide, with our own model account; any sub-processor those need will be added to our list, with notice under section 6, before it is used.

4. Confidentiality

Everyone we allow to process your organization's personal data is bound to keep it confidential, and only people who need it to provide or support Glassa can reach it.

5. Security

We keep technical and organisational measures appropriate to the risk, as Article 32 of the GDPR requires. The measures in place today are listed in the annex below. We may improve them, but we will not lower the overall level of protection.

6. Sub-processors

You authorise us to use the sub-processors on our sub-processor list. We bind each one, in writing, to data-protection obligations no less protective than this DPA, and we remain responsible to you for its work.

We give at least 30 days' notice before we add or replace a sub-processor, to the organizations that subscribe on that page. Your organization may object on reasonable data-protection grounds within those 30 days. We will work with you in good faith to resolve it, and if we cannot, your organization may stop using the part of Glassa the change affects, or close its workspace, without a charge for doing so.

Services your organization or its members choose and connect themselves, such as the model account a teammate works through, are not our sub-processors. Their own terms with you apply to them.

7. International transfers

Glassa's servers, databases, files and call server run on Microsoft Azure in India (the Central India region), with backup copies in South India, and its mail is sent from Azure in India. AI summaries are written on Microsoft Azure in the United States, or in another Azure region, transcription runs in the United States and on Google's global infrastructure, and Cloudflare stores meeting transcripts, received mail and service logs in Asia-Pacific. The sub-processor list gives the place for each sub-processor.

For each transfer of personal data out of the UK or the EEA to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses with the UK Addendum, or the UK International Data Transfer Agreement, or another safeguard data protection law allows. Where an adequacy decision covers a transfer, such as the EU's decision for the UK, we rely on that. If a safeguard stops being valid, we will move to another that the law allows.

8. Requests from individuals

If someone asks us directly to see, correct, export or delete personal data in your workspace, we will pass the request to your organization, unless the law requires us to act on it ourselves. We will help your organization answer such requests. Glassa does not yet let your organization export or delete a person's data itself, so when your organization asks, we do it for you by hand, promptly enough for it to meet the deadlines the law sets.

9. Personal data breaches

If we become aware of a personal data breach affecting your organization's data, we will tell your organization's owners and administrators by email without undue delay, and within 48 hours. We will say what happened, the kinds of data and roughly how many people are affected, the likely consequences, and what we are doing about it, and we will keep you updated as we learn more. This is so your organization can meet its own duty to report a breach to the supervisory authority, such as the UK Information Commissioner's Office, within 72 hours of becoming aware of it, and to tell the people affected where the law requires.

10. Help with your obligations

We will give your organization the information we reasonably can to help with its security, breach notifications, data protection impact assessments, and any consultation with a supervisory authority, as Articles 32 to 36 of the GDPR describe.

11. When your organization leaves: return and deletion

When your organization stops using Glassa, we will, as it chooses, either give it a copy of its personal data and then delete it, or delete it, and we will delete existing copies unless the law requires us to keep them.

• Today, on request: Glassa does not yet let an organization export its data or close its workspace itself. Your organization's owner writes to hello@easyloops.ltd, and we do it by hand: a complete, machine-readable copy of its data if it wants one, then deletion from Glassa's databases and file storage.
• Backups: deleted data stays in our backups until they age out: database backups within 35 days, point-in-time recovery logs within 7 days, and deleted files within 365 days. Until then we keep it secure and do not use it, and if we ever restore a backup, we delete your organization's data from it again before it is used.
• Billing records: we keep financial records for 6 years where the law requires, with personal data removed from them where the law allows.

What we are building. We have decided how closing a workspace will work, and are building it. When your organization closes its workspace, or its access ends for non-payment, the workspace will become read-only for 30 days so that its owners and administrators can export its data, with a reminder 7 days before the end. Then an audited purge will delete its data from every Glassa store, the owner will receive a certificate confirming the deletion, and its Glassa subdomain will be retired and never issued to anyone else. Until this section says it is in place, the request route above applies.

12. Demonstrating compliance and audits

We will make available the information your organization reasonably needs to show that we meet this DPA, first through our written reports and answers to its reasonable security questions. If that is not enough, or a supervisory authority requires it, your organization, or an independent auditor it appoints under a duty of confidentiality, may audit our compliance with this DPA, on at least 30 days' notice, no more than once in any 12 months unless after a breach, and without disrupting the service or other organizations' data.

13. Changes, governing law and contact

If we change this DPA in a way that matters, we will publish it as a new version, with the date it takes effect above, and tell organizations in Glassa or by email at least 30 days before the change applies. This DPA is governed by the law of England and Wales, and its courts have exclusive jurisdiction. Questions go to hello@easyloops.ltd.

Annex: security measures

• Organizations kept apart: Glassa's gateway takes the organization from each member's verified sign-in and scopes their requests to it. We are extending the same check to every Glassa service.
• Encryption: data is encrypted in transit over HTTPS, and our storage and databases accept only encrypted connections. Stored data, files and backups are encrypted at rest by Microsoft Azure and Cloudflare.
• No public databases: Glassa's databases cannot be reached from the internet.
• Sign-in: members sign in with a password or with Google. A member's access token lasts 15 minutes, and a teammate's 5 minutes.
• Files: files are uploaded and downloaded only through short-lived signed links, and Glassa's own services cannot delete stored files, so a fault or an attack on them cannot destroy your files.
• AI teammates on the record: every action, tool call and model use of a teammate is kept in a sealed, append-only audit log.
• Least access: only staff who need it to run or support Glassa can reach production systems.