1. Parties and scope
This data processing agreement («DPA») is between the customer organisation named in the order («Customer», the controller) and Collabix.ai B.V., Singel 542, 1017 AZ Amsterdam, the Netherlands, KVK 97088617 («Collabix», the processor). It applies to all personal data Collabix processes for the Customer while providing the Collabix service under the terms of service and the order. It is a processing agreement within the meaning of Article 28 of the General Data Protection Regulation (GDPR). If the Customer and Collabix sign a different DPA, the signed one applies.
2. What is processed
| Subject matter | Preparing meetings, joining them as a visible participant, writing up decisions and actions, and, after a person approves them, updating the Customer's connected tools. |
|---|---|
| Duration | The term of the subscription, plus the deletion periods in section 9. |
| Nature | Collection from connected tools and meetings, storage, transcription, analysis with AI models, presentation to the Customer's users, writing to connected tools on approval. |
| Purpose | Providing the Collabix service to the Customer as described in the terms. No other purpose. |
| Data subjects | The Customer's users, employees and contractors; meeting participants, including people outside the Customer's organisation; people named in the connected tools (ticket assignees, document authors, message senders). |
| Categories of data | Names, work email addresses, roles; calendar events; meeting audio, video frames needed to join the call, and transcripts; the goals, decisions, actions and context written in the product; tickets, documents and messages read from connected tools (Jira, Google Workspace, Slack, Microsoft Teams, Zoom); technical data such as IP addresses and logs; billing contact details. |
| Special categories | Not intended. Meeting content may incidentally contain such data; the Customer decides what is discussed in a meeting Collabix attends. |
3. Instructions
Collabix processes personal data only on the Customer's documented instructions: these terms, the order, the settings the Customer chooses in the product, and the actions its users take. Nothing is written to a connected tool until a person in the Customer's organisation approves it. If Collabix believes an instruction breaks the law, it tells the Customer before acting. Collabix does not use Customer data to train AI models and does not sell or share it with third parties for their own purposes.
4. Confidentiality
Everyone who processes Customer data on Collabix's side is bound by confidentiality by contract or by law and has access only to what their task requires.
5. Security
Collabix takes the technical and organisational measures appropriate to the risk, including: encryption in transit (TLS) and at rest; secrets in Azure Key Vault; per-customer isolation of data; role-based access with multi-factor authentication on administrator access; logging of administrative actions; backups; connector tokens deleted the moment a connector is disconnected. The current description is on the security page. Collabix is not yet SOC 2 or ISO 27001 certified and says so.
6. Sub-processors
The Customer gives general authorisation for the sub-processors below. Collabix remains responsible for their work and binds them to data protection obligations equivalent to this DPA.
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft Azure (Microsoft Ireland Operations Ltd.) | Hosting, storage, Azure OpenAI models | EU; some AI processing on US Azure regions, confirmed per environment in writing |
| Recall.ai, Inc. | Joining meetings and capturing audio | United States (EU-US Data Privacy Framework) |
| Gladia SAS | Live transcription | EU (France) |
| Stripe Payments Europe, Ltd. | Invoices, payments, billing contact details | EU (Ireland); card data stays with Stripe |
| Transactional email provider | Service emails (invitations, briefs, reports, billing) | EU |
| HubSpot, Inc. | Customer relationship records (contact details only) | EU data centre (EU-US Data Privacy Framework) |
Collabix announces a new or replaced sub-processor by email to the account's administrator at least 30 days before it starts processing Customer data. The Customer may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the Customer may end the subscription for the affected service without penalty and is refunded any prepaid period after the end date.
7. Transfers outside the EEA
Where a sub-processor processes data outside the European Economic Area, the transfer rests on the EU Standard Contractual Clauses (Commission Decision 2021/914, module 3) or an adequacy decision, for the United States the EU-US Data Privacy Framework where the provider is certified. The Customer confirms the production region of its environment in the order.
8. Assistance
- Requests from data subjects. Collabix forwards any request it receives to the Customer within 5 working days and helps the Customer answer it; administrators can export and delete data in the product themselves.
- Personal data breach. Collabix tells the Customer without undue delay and at the latest within 48 hours after becoming aware of a breach affecting Customer data, with what it knows at that moment and updates as it learns more, so that the Customer can meet its 72-hour deadline.
- Impact assessments and consultations. Collabix provides the information the Customer reasonably needs for a data protection impact assessment or a prior consultation with a supervisory authority.
9. Deletion and return
During the subscription an administrator can export the Customer's data at any time. After the subscription ends the Customer has 30 days to export; then Collabix deletes or anonymises Customer data within 90 days, and removes it from backups within a further 35 days, unless EU or Dutch law requires longer retention (billing records: 7 years). Connector tokens are deleted the moment a connector is disconnected.
10. Audits
Once a year, or after a breach, the Customer may ask Collabix for the information needed to show compliance with this DPA, including the security description, the sub-processor list and the results of any third-party assessment. If that is not enough, the Customer may audit Collabix, or have an independent auditor do so, on 30 days' notice, during business hours, without disrupting the service and under confidentiality. Each side bears its own costs.
11. Liability and term
The liability limits of the terms of service apply to this DPA. This DPA lasts as long as Collabix processes personal data for the Customer. Dutch law applies.
12. Contact
Data protection questions: info@collabix.ai. Collabix has not appointed a data protection officer; the founders answer in person.