Data processing agreement

Parties

1. The client, the company or organisation that enters into an agreement with Tideform for an AI process audit. The client is the controller.
2. [Bedrijfsnaam], [Rechtsvorm], registered with the Dutch Chamber of Commerce (KvK) under number [KvK-nummer], located at [Adres], trading as Tideform. Tideform is the processor.

This data processing agreement is part of the agreement between the client and Tideform and applies from the moment that agreement starts. This English text is a translation. If the Dutch and English versions differ, the Dutch version prevails.

1. Definitions

Terms from the GDPR, such as personal data, processing, controller, processor, data subject, sub-processor and personal data breach, have the meaning given in article 4 GDPR. In addition:

• GDPR: Regulation (EU) 2016/679.
• Agreement: the arrangement about the audit, including Tideform's terms of service.
• Personal data: the personal data Tideform processes for the client, as described in annex 1.

2. Subject and duration

1. Tideform processes personal data for the client to carry out the audit. Annex 1 describes the subject, duration, nature and purpose of the processing, the types of data and the categories of data subjects.
2. This data processing agreement runs as long as Tideform processes personal data for the client.

3. Instructions

1. Tideform only processes the personal data on documented instructions from the client. The agreement and this data processing agreement are those instructions. Instructions the client gives through the admin area also count, such as adding or removing employees.
2. Tideform does not process the personal data for its own purposes. Tideform does not use it to train AI models.
3. If Tideform must process data because EU or member state law requires it, Tideform tells the client in advance, unless that law prohibits this.
4. If Tideform believes an instruction infringes the GDPR or other data protection rules, Tideform tells the client right away.

4. Obligations of the client

1. The client is responsible for a valid legal basis, for informing employees (articles 13 and 14 GDPR) and for handling requests from data subjects.
2. The client checks whether a data protection impact assessment (DPIA) is needed and whether the works council or staff representation has a right of consent (including article 27(1)(k) and (l) of the Dutch Works Councils Act).
3. The client only enters the data that is needed and keeps the admin link secret.
4. The client does not use the audit to assess or monitor individual employees or to make decisions about them.

5. Confidentiality

Tideform ensures that everyone with access to the personal data has committed to confidentiality or is under a statutory duty of confidentiality. Only people who need access for their work get it.

6. Security

1. Tideform takes appropriate technical and organisational measures under article 32 GDPR. Annex 2 describes these measures.
2. Tideform may change the measures, as long as the level of security does not go down.

7. Sub-processors

1. The client gives Tideform general written authorisation to engage sub-processors. Annex 3 lists the sub-processors currently used.
2. If Tideform wants to add or replace a sub-processor, Tideform informs the client at least 30 days in advance. The client may object with reasons within that period. If we cannot resolve it together, the client may end the agreement for the services affected by the change.
3. Tideform imposes on sub-processors, by contract, the same obligations as in this data processing agreement, in particular sufficient guarantees for appropriate security. Tideform remains fully liable to the client for its sub-processors.
4. Tideform only uses the optional sub-processor ElevenLabs in annex 3 if this has been agreed with the client in advance.

8. Transfers outside the EEA

1. Tideform stores the personal data in the EU (Fly.io, Amsterdam region). In production, Tideform runs the AI processing through Google Cloud Vertex AI in the EU multi-region.
2. Some sub-processors are based in or linked to the United States. Tideform only transfers personal data to a country outside the EEA if there is a valid basis under chapter V GDPR. That is the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) for certified recipients, or the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), with supplementary measures where needed.
3. In test mode, content goes directly to Anthropic's API, which is not pinned to the EU. The app then shows "test mode". Tideform runs client audits in production.

9. Assistance to the client

1. Tideform helps the client, with appropriate technical and organisational measures, to answer requests from data subjects (articles 15 to 22 GDPR). If Tideform receives a request itself, Tideform forwards it to the client without undue delay and does not answer it itself, unless the client asks it to.
2. Tideform helps the client with the obligations in articles 32 to 36 GDPR: security, notifying data breaches, a DPIA and prior consultation of the Dutch Data Protection Authority, as far as reasonable given the information Tideform has.
3. If this help clearly goes beyond the normal level, Tideform may charge reasonable costs after consulting the client.

10. Data breaches

1. If Tideform discovers a personal data breach, Tideform notifies the client without undue delay and at the latest within 48 hours after discovery.
2. Tideform provides as much as possible of the information in article 33(3) GDPR: what happened, which data and roughly how many data subjects are involved, the likely consequences and which measures have been or will be taken. Information that is not yet known, Tideform provides as soon as possible.
3. Tideform immediately takes reasonable measures to limit the consequences.
4. The client decides whether the breach is notified to the Dutch Data Protection Authority and to data subjects.

11. Audits and information

1. Tideform gives the client all information needed to show that Tideform complies with article 28 GDPR.
2. The client may, at most once a year and with reasonable notice of at least 30 days, have an audit carried out by an independent expert bound by confidentiality. After a data breach or with a concrete suspicion of a violation, this may happen more often. The costs are for the client, unless the audit shows a material failure by Tideform.

12. Retention, return and deletion

1. Tideform keeps interview data until 12 months after the audit ends, unless the client asks for earlier deletion. Audio is deleted right after transcription and never kept longer. Backups follow the same periods.
2. At the end of the processing, Tideform deletes the personal data, or returns it if the client asks for that in advance. Copies are also deleted, unless EU or member state law requires storage.
3. On request, Tideform confirms in writing that the data has been deleted.

13. Liability

The liability of the parties is governed by Tideform's terms of service, as far as the GDPR (in particular article 82) allows.

14. Term and end

1. This data processing agreement ends when Tideform no longer processes personal data for the client.
2. Obligations that by their nature continue after the end, such as confidentiality and deletion, remain in force.

15. Order of precedence, law and disputes

1. If this data processing agreement differs from the agreement or the terms of service, this data processing agreement prevails as far as the processing of personal data is concerned.
2. Dutch law applies to this data processing agreement. Disputes go to the competent court as set out in the terms of service.

Version: [Datum]

Annex 1: Description of the processing

Subject: carrying out an AI process audit for the client.

Nature of the processing: collecting, storing, converting speech to text, analysing with an AI model, summarising, combining into a report, showing to the client and deleting.

Purpose: giving the client insight into recurring work processes, the time they take and the opportunities for automation, combined per role and department.

How it works:

1. The client enters a first name for each employee and, if they want, a role, and sends each employee a personal link.
2. The employee talks with an AI interviewer (Claude, by Anthropic) for about 20 minutes, by voice or by typing, in Dutch or English. The interviewer says at the start that it is an AI.
3. The conversation is about recurring tasks: how often, how long, which systems, from and to whom, what takes time and what the employee wants to get rid of.
4. At the end the employee sees their own summary and can change, remove or add tasks. Only after approval does the interview count in the report. Interviews that are not approved are not in the report.
5. The report shows processes, hours and automation potential per role and department, combined. Quotes are linked to a role, never to a name. The client does not see transcripts. The admin area shows each employee's first name and status (invited, in progress, awaiting approval, approved).
6. Show it once (optional, when building): an employee can voluntarily demonstrate one process by sharing their screen and talking it through. The employee starts and stops the recording, watches it back first and can have it deleted. Only Tideform and the client can view it, and it is only used to build the agent for that process.
7. System scan (optional): the client can upload exports and documents from its own systems, such as lists of invoices, quotes, orders or job sheets and procedures. Claude counts volumes in them and puts them next to the interviews. The outcome contains counts and ways of working, not data about people. The client can delete files itself and removes what is not needed beforehand. If the client chooses, Tideform works as a member of the client's own Claude workspace, with read-only connectors the client turns on itself. There Tideform only reads the owner's mailbox and shared inboxes, not employees' personal mailboxes, counts volumes and kinds of work, and quotes no content. The client can remove Tideform from that workspace at any time.

What does not happen: no emotion recognition, no assessment of individual performance, no scores or ratings of people, no automated decisions about people, no training of AI models with the data.

Categories of data subjects: employees of the client who are invited for an interview, and people who appear in files the client uploads for the system scan (such as contacts at customers and suppliers).

Types of personal data:

• first name
• role (optional)
• text of the conversation
• structured data about tasks (frequency, duration, systems, from and to whom, bottlenecks)
• status and approval of the interview
• an optional note
• speech (audio), only temporarily during conversion to text
• when showing a process: the screen image and the employee's voice during that one recording
• for the system scan: the data in the uploaded files, such as names of customers and suppliers, amounts and dates

Special categories of personal data: not intended and not asked for. Employees are asked not to share them. If an employee mentions them anyway, they may appear in the text of the conversation.

Duration: as long as the agreement runs and after that until the end of the retention period.

Retention periods: interview data until 12 months after the audit ends, or earlier at the client's request. Audio never longer than needed for transcription. Backups follow the same periods.

Location: storage at Fly.io in the Amsterdam region (EU). AI processing in production through Google Cloud Vertex AI in the EU multi-region.

Annex 2: Security measures

Encryption and network

• All connections between browser and server use HTTPS (TLS).
• Traffic to Google Cloud and other sub-processors is encrypted.

Access

• The client gets access through a personal admin link with a long, random code that cannot be guessed. There is no password: the link is the key.
• Each employee gets their own link and only sees their own interview.
• The client does not see transcripts, only first name, status and the combined report.
• Within Tideform, only people who need it for their work have access. They use an owner code and are bound by confidentiality.

Data minimisation

• Only a first name and optionally a role; no last name, email address or phone number of employees.
• Speech is converted to text on Tideform's own server (open-source Whisper through whisper.cpp). The audio file is deleted right after.
• Text to speech happens in the browser (nothing is sent) or through the EU endpoint of Google Cloud Text-to-Speech, where only the text of the interviewer's question is sent.
• The report combines data per role and department and does not show names.

Storage and hosting

• Server and database (SQLite) run at Fly.io in the Amsterdam region (EU).
• Backups follow the same retention periods as the data itself.

Website

• No cookies, no analytics or tracking tools.

AI

• In production, Claude runs through Google Cloud Vertex AI in the EU multi-region. The app shows "test mode" when another route is used.
• Under Google's and Anthropic's terms, customer content is not used to train models.

Organisation

• Duty of confidentiality for everyone with access.
• A fixed procedure for reporting and handling data breaches (see article 10).
• Regular review and updating of software and dependencies.

Annex 3: Sub-processors

Fly.io, Inc.

• Service: hosting of server and database.
• Location of processing: Amsterdam region (EU).
• Established in: United States.
• Transfer safeguard: certified under the EU-US Data Privacy Framework (including the UK and Swiss extensions), according to Fly.io's own DPF statement.

Google Cloud EMEA Limited (Ireland), with Google LLC and affiliates as further sub-processors

• Service: Vertex AI, to run Claude in the EU multi-region; and Cloud Text-to-Speech through the EU endpoint (only the text of the interviewer's questions).
• Location of processing: EU. According to Google, machine learning processing on the EU multi-region endpoint stays within EU member states, and data on the Text-to-Speech EU endpoint stays within Europe.
• Transfer safeguard: Google's Cloud Data Processing Addendum with standard contractual clauses; Google LLC is certified under the EU-US Data Privacy Framework.
• Training: under Google's Service Specific Terms, Google does not use customer data to train AI models without permission.

Anthropic (maker of the AI model Claude)

• Role in production through Vertex AI: Anthropic provides the model. According to Google's documentation, prompts and responses for partner models are not shared with third parties, including the partner. So through this route Anthropic does not receive the content directly; Google processes it as sub-processor.
• Role in test mode: content goes directly to Anthropic's API. That route is not pinned to the EU.
• Transfer safeguard: Anthropic's Data Processing Addendum and standard contractual clauses, as Anthropic describes in its privacy policy.
• Training: under Anthropic's Commercial Terms, Anthropic does not train models on customer content.

ElevenLabs (optional, not used by default)

• Service: text to speech for the interviewer's questions.
• Only used if agreed with the client in advance.
• Transfer safeguard: ElevenLabs states that it participates in the EU-US Data Privacy Framework (including the UK and Swiss extensions).