Sales Pep Data Processing Agreement

Version 15 October 2026

1. Parties and scope

This agreement forms part of the Sales Pep Terms or applicable written service agreement between the same contracting Customer defined in section 1 of the Sales Pep Terms and identified in the acceptance record ("Customer") and TRDL, CVR 43474766, Hyllingeparken 15A, 4070 Kirke Hyllinge, Denmark ("TRDL"), contact [email protected]. Sales Pep is TRDL's product name.

The Customer is controller of the personal data it supplies for its business meeting and preparation purposes; TRDL is processor. If the Customer acts for another controller, it must have authority to give the instructions and authorisations here. GDPR definitions apply. This agreement applies to free and paid use and continues while TRDL processes retained Customer personal data. It does not retrospectively record acceptance. TRDL's own necessary account, contracting, security and support processing is described separately in the Privacy Notice.

2. Instructions and Customer responsibilities

TRDL processes Customer personal data only on documented instructions, including about transfers, unless EU or Member State law requires otherwise. It informs the Customer beforehand unless law prohibits notice on important public-interest grounds. The service agreement, this DPA, Annex A and the Customer's authorised actions/settings form the initial instructions. Additional lawful instructions may be given in writing. TRDL immediately informs the Customer if it considers an instruction contrary to applicable data protection law and may pause affected processing while it is resolved.

The Customer determines the purpose and lawful basis, informs participants and other affected people, obtains required permissions, minimises content and gives lawful instructions. Agreement acceptance is not recording consent. Special-category or criminal-offence data, national identification numbers, passwords and financial credentials are outside the standard intended scope and require separate assessment and written agreement. Customer content is not authorised for advertising or providers' general-purpose model training.

3. Confidentiality and security

TRDL ensures that authorised people are bound by confidentiality or an appropriate statutory duty and access only what their duties require. It implements appropriate technical and organisational measures under GDPR Article 32, taking account of the risk and processing. Annex B describes the service measures and limits. Measures may develop without materially reducing overall protection. This DPA does not represent a TRDL certification or an agreed uptime/recovery guarantee.

4. Assistance, breaches and audit

Taking account of the processing and information available, TRDL assists with data subject rights and applicable obligations under GDPR Articles 32–36, including security, breach notifications, impact assessments and prior consultation. Requests concerning Customer-controlled data are referred to the Customer without undue delay unless instructed or legally required otherwise. TRDL does not determine the Customer's substantive response independently.

TRDL notifies the Customer without undue delay after becoming aware of a personal data breach affecting its data. It provides available details of nature, affected people/records, likely consequences, contact and mitigation, and supplies missing information as it becomes available. It cooperates with containment and remediation. The Customer remains responsible for its own notifications; no fixed-hour notification promise replaces the statutory standard.

TRDL makes available information needed to demonstrate compliance and allows and contributes to audits, including inspections, by the Customer or its authorised auditor. Review normally starts with documentation, reasonable notice and proportionate confidentiality/security arrangements, without obstructing statutory rights, urgent justified review or supervisory powers. Standard and legally required assistance is included; exceptional bespoke work and reasonable cost allocation require advance agreement and cannot obstruct mandatory assistance.

5. Subprocessors and transfers

The Customer gives general written authorisation for the suppliers and relevant processing chains in Annex C. TRDL imposes the relevant data-protection obligations by written contract, including appropriate security, and remains responsible to the Customer for their performance.

For a direct subprocessor addition/replacement chosen by TRDL, TRDL gives at least 30 days' written notice to the Customer's account/agreement email; the Customer may object on reasonable data-protection grounds within 14 days. For a change within an existing provider's onward chain, TRDL forwards the supplier notice without undue delay with the available advance period and handles objections in time for the upstream deadline. If that leaves insufficient opportunity to object, or an objection remains unresolved, TRDL avoids or pauses the affected processing until a lawful solution is agreed. A shorter upstream deadline does not automatically authorise the change. The Customer may terminate the affected service without future charges for it if no solution is possible; confidentiality, return and deletion duties continue. Objections/contact: [email protected].

Transfers outside the EEA require a lawful GDPR Chapter V basis, such as an applicable adequacy decision or appropriate safeguards including applicable Commission transfer SCCs and necessary supplementary measures. TRDL provides relevant transfer/onward-provider information on request. This Article 28 DPA does not itself execute vendor transfer SCCs. An EU database or EEA contracting entity does not mean EU-only processing. Annex C reflects the current US Soniox route and international provider processing.

6. Return, deletion and separate records

At the end of processing, the Customer chooses return in an available commonly usable text/notes format or deletion. It may request still-available content for 30 days after termination through the contact above; TRDL then deletes remaining Customer content unless EU or Member State law requires retention. An earlier deletion instruction takes precedence. The window does not extend ordinary expiry, restore already deleted content or guarantee continued login. Return/deletion is coordinated and verified; failed operations are followed up, not described as completed.

Managed saved meeting transcript, notes and summaries expire 365 days from the original meeting date. Reading, editing and import do not renew it. Daily bounded cleanup may be delayed by backlogs, locks or missed/failed runs. A limited tombstone prevents stale managed content being synced back. Closed/offline devices may retain copies until trusted sync. Independent local originals, exports and copied notes remain under their holder's control. TRDL explains the verified scope and residual copies; provider operational records follow Annex C. Any protected backup copies expire through their applicable cycle and deleted/expired data must not return to ordinary use after restoration.

TRDL separately retains only necessary agreement/business-identity/closure evidence during the relationship and three years after verified closure for contractual accountability and claims, subject to a specific documented legal hold or applicable legal duty. It does not retain meeting content under that exception. Account deletion does not silently erase that evidence. Copies and lawful correction/erasure requests remain available through TRDL with proportionate identity checks. Signing out or ending a meeting is not account deletion.

7. Notices and precedence

The Customer's notice contact is the recorded account/agreement email unless updated. TRDL's contact is [email protected]. Substantive amendments require written agreement, including electronic acceptance; subprocessor notices and non-material security improvements follow sections 3 and 5. Existing agreed copies remain available. This DPA prevails over conflicting general Terms on processing; a separately agreed customer DPA controls within its scope. Mandatory law and valid applicable transfer clauses prevail. Section 9 of the Sales Pep Terms governs contractual liability under this DPA within the same Customer-level aggregate caps; this DPA creates no additional or separate cap per agreement, account, user or claim. Its special cap, non-addition rule and exceptions apply. These limits and the Danish-law provisions do not restrict mandatory data subject rights, supervisory powers or applicable transfer clauses. A separately agreed customer DPA controls where it expressly provides otherwise.

Annex A — Processing details

• Subject/purpose: meeting preparation, live transcription and coaching, saved review, synchronisation and instructed support for the Customer.
• Operations: receive/stream two audio sources; transcribe and analyse text/context; generate suggestions and recaps; store, retrieve, export and delete meeting text/notes.
• People: the Customer's business users, meeting participants and contacts/prospects described in supplied content.
• Data: names/business/contact context, streamed voices, transcripts, preparation, notes, coaching/recaps, account/user identifiers and necessary technical metadata.
• Frequency/duration: user-initiated capture and account sync, followed by the retention/instructed completion period. No unattended listening or separate disk recording of live PCM is part of this flow. Optional public-website import retrieves bounded page text for preparation.

Annex B — Technical and organisational measures

Individual authenticated accounts; owner-scoped account/history authorisation; database access policies and guarded privileged operations; HTTPS/TLS transport; controlled administrator access and confidentiality; explicit capture/pause/end controls; bounded provider requests and cancellation/stale-account guards; version-controlled changes and proportionate validation; incident assessment/notification and verified request handling; retention cleanup, trusted-time device expiry and deletion markers.

Desktop account/history storage uses OS-backed encryption where supported. Browser storage, renderer preferences and drafts are not all encrypted. Users must protect devices, exports and credentials. A closed/offline device cannot be remotely wiped. App integrity does not itself establish code-signing, notarisation or device trust. No special hosting, SSO, managed backup/restore service, fixed RPO/RTO or certification is included unless separately agreed. TRDL's duty to maintain risk-appropriate security remains unchanged.

Annex C — Authorised suppliers and locations

Supplier standard DPAs and lawful onward chains apply to their relevant services. Applicable transfer safeguards and current onward lists are available through TRDL on request. Soniox's infrastructure references to AWS, Google Cloud and Oracle Cloud describe examples, not a representation that every one processes this Customer's stream. Regional options offered by a supplier do not change Sales Pep's actual configured route. No additional speech-generation, async recording, team analytics or payment provider is authorised merely by being available from one of these suppliers.