Back to Denvora
TermsPrivacyUK GDPR Art. 28 & IDTA Binding
⚖️

Data Processing Addendum (DPA)

Pursuant to Article 28 of the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018, and Article 28 of the EU GDPR. Incorporated by reference into the Denvora Terms of Service.

1. Parties & Scope

This Data Processing Addendum ("DPA") forms a legally binding contract between the Workspace Subscriber ("Controller") and MyRevue Technologies Ltd, registered in England and Wales with registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Processor" or "Denvora").

This DPA applies automatically whenever Processor processes Personal Data on behalf of Controller in the course of providing the Denvora Service.

2. Article 28 Processor Obligations

  1. Documented Instructions (Art. 28(3)(a)): Processor shall process Personal Data solely on documented instructions from Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by UK or EU law.
  2. Confidentiality (Art. 28(3)(b)): Processor ensures that all personnel authorized to process Personal Data have committed themselves to statutory or contractual confidentiality obligations.
  3. Security of Processing (Art. 28(3)(c) & Art. 32): Processor implements and maintains the Technical and Organisational Measures set out in Annex II below.
  4. Sub-Processing (Art. 28(2) & (4)): Controller grants general written authorization for Processor to engage the Sub-Processors listed in Annex III. Processor shall notify Controller at least thirty (30) days prior to adding or replacing any Sub-Processor and imposes equivalent Article 28 data protection obligations on each Sub-Processor.
  5. Data Subject Rights Assistance (Art. 28(3)(e)): Processor provides self-service API and dashboard tooling (`GET /api/account/privacy` and `DELETE /api/account/privacy`) enabling Controller to fulfill Data Subject requests under Articles 15–22 at no additional cost.
  6. Personal Data Breach Notification (Art. 33): Processor shall notify Controller without undue delay (and in any event within 48 hours) after becoming aware of a confirmed Personal Data Breach affecting Controller's workspace.
  7. Deletion or Return of Data (Art. 28(3)(g)): Upon termination of the Service or Controller's execution of `DELETE /api/account/privacy`, Processor shall permanently delete all Personal Data and issue a cryptographic Erasure Certificate, save to the extent UK statutory law requires retention of billing invoices.

3. International Data Transfers (UK IDTA & EU SCCs)

Where the processing of Personal Data involves a restricted transfer outside the United Kingdom or the European Economic Area to a jurisdiction without an adequacy regulation:

  • EEA Transfers: The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two: Controller to Processor) are incorporated herein by reference.
  • UK Transfers: The UK Information Commissioner's Office (ICO) International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Version B1.0) is incorporated herein by reference, with Table 4 election permitting either Party to end the Addendum as set out in Section 19 thereof.

Annex I — Details of Processing

Subject Matter: Provision of the Denvora AI meeting transcription, live template tracking, and post-call dossier synthesis SaaS platform.
Duration: For the term of the Customer's active Workspace Subscription until deletion under Section 2.7.
Categories of Data Subjects: Interview candidates, prospective clients, Customer employees, and meeting participants joining recorded Zoom, Google Meet, or Microsoft Teams sessions.
Types of Personal Data: Participant names, email addresses, spoken utterances, interview transcripts, structured competency evaluations, and calendar event metadata.
Special Categories of Data: Denvora is not designed to collect Special Category Data (Art. 9); Fair Hiring Mode actively suppresses protected characteristics from synthesized dossiers.

Annex II — Technical and Organisational Security Measures (TOMs)

Cryptographic Vault & Transit Security

All OAuth tokens and secrets are encrypted at rest using authenticated AES-256-GCM (`enc:v1:`) with a dedicated production vault key. All traffic is enforced over HTTPS/TLS 1.3 with HSTS preload.

Strict Multi-Tenant Isolation & RBAC

Every database query is strictly scoped by `workspace_id` with fail-closed ownership guards (`canAccessBot`, `canAccessMeeting`, `canAccessReport`) and 4-tier RBAC (`OWNER`, `ADMIN`, `MEMBER`, `REVIEWER`).

Automated Encrypted Backups & Restore Drills

Daily automated (`03:00 UTC`) AES-256-GCM logical snapshots across all 7 multi-tenant tables with automated non-destructive restore verification and SHA-256 checksum validation.

Immediate Audio Erasure & PII Redaction

Raw meeting audio is purged immediately post-synthesis (`gdprAudioPurged: true`). All structured operational logs and error telemetry pass through recursive UK GDPR PII redaction.

Annex III — Authorized Sub-Processors

Controller authorizes the engagement of the six (6) infrastructure Sub-Processors detailed in Section 5 of the Privacy Policy:

  1. Recall.ai Inc. — Frankfurt, Germany (eu-central-1) — Meeting bot & transcription
  2. Google Cloud (Gemini API) — EU/UK Cloud — Zero-retention template synthesis
  3. Supabase Inc. — EU West (eu-west-1) — PostgreSQL database & auth
  4. Stripe Payments Europe Ltd — Dublin, Ireland — PCI-DSS Level 1 billing
  5. Resend Inc. — Dublin, Ireland (eu-west-1) — Transactional email delivery
  6. Vercel Inc. — Frankfurt / London (fra1 / lhr1) — Serverless execution