Skip to content
DAskDeck

Legal

Data Processing Addendum

Last updated: 2026-06-22

Bottom line

This DPA governs how Deck-Agent processes personal data on your behalf when you use the Service. We follow the EU SCCs and the UK Addendum for international transfers, give 30 days' notice before adding subprocessors, notify you of breaches within 72 hours, and never train AI models on your content. The subprocessor categories, the technical and organizational measures, and the processing details are in the Annexes below; the current named subprocessor list is available on request to [email protected].

This Data Processing Addendum ("DPA") applies when Deck-Agent, Inc. ("Processor") Processes Personal Data on behalf of a customer ("Controller") subject to the GDPR, UK GDPR, Swiss FADP, CCPA, or other Data Protection Laws. The DPA is incorporated into the Terms of Service by reference and applies automatically; no signature is required. Enterprise customers may request a counter-signed copy by emailing [email protected].

1. Scope and order of precedence

This Data Processing Addendum ("DPA") applies when Deck-Agent, Inc. ("Processor") Processes Personal Data on behalf of a customer ("Controller") in connection with the Service. It supplements and is incorporated into the Terms of Service and any signed order form between the parties (together, the "Agreement"). In the event of conflict, the order of precedence is: (1) the Standard Contractual Clauses where applicable, (2) this DPA, (3) the order form, and (4) the Terms of Service.

2. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.
  • "Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the UK Data Protection Act 2018 ("UK DPL"), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the CPRA ("CCPA").
  • "Personal Data," "Processing," "Controller," "Processor," "Data Subject," and "Personal Data Breach" have the meanings in GDPR Art. 4. For purposes of the CCPA, Processor acts as a "Service Provider" and Controller acts as a "Business."
  • "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of Personal Data to third countries adopted by the European Commission in Decision (EU) 2021/914.
  • "UK Addendum" means the International Data Transfer Addendum to the EU Commission SCCs issued by the UK Information Commissioner's Office under section 119A of the UK DPL.
  • "Subprocessor" means any third party engaged by Processor to Process Personal Data on behalf of Controller.

3. Roles and scope of Processing

With respect to Personal Data Processed under the Agreement, Controller is the Controller (or a Processor acting on behalf of a third-party Controller) and Processor acts as a Processor (or Sub-processor). The subject matter, nature, purpose, duration, categories of Data Subjects, and categories of Personal Data are set out in Annex I. Processor will Process Personal Data only (a) to provide the Service in accordance with the Agreement, (b) on Controller's documented instructions (the Agreement and this DPA constitute Controller's complete and final instructions; any further instruction outside that scope requires the parties' agreement, including on price), and (c) as required by applicable law, in which case Processor will notify Controller before Processing unless that law prohibits notice on important grounds of public interest.

4. Confidentiality

Processor will ensure that personnel authorized to Process Personal Data are bound by written confidentiality obligations or appropriate statutory obligations of confidentiality and have received privacy and security training appropriate to their role.

5. Security measures

Processor will implement and maintain the technical and organizational measures described in Annex II to ensure a level of security appropriate to the risk, taking into account the state of the art, costs of implementation, the nature, scope, context, and purposes of Processing, and the risk of varying likelihood and severity for the rights and freedoms of Data Subjects (GDPR Art. 32). Processor will not materially decrease the overall security of the Service during the term of the Agreement.

6. Subprocessors

Controller provides a general authorization for Processor to engage Subprocessors. The categories of Subprocessors are set out in Annex III; the current named list within each category is available to Controller on request to [email protected] and is provided as part of any counter-signed DPA or SCCs. Before engaging a new Subprocessor, Processor will (a) impose data-protection terms substantially as protective as this DPA, including appropriate technical and organizational measures and the SCCs where relevant, and (b) provide at least thirty (30) days' advance notice to Controller by email to the billing contact. Controller may object on reasonable data-protection grounds by written notice within the notice period. The parties will work in good faith to resolve the objection; if not resolved, Controller may terminate the affected Service on written notice without penalty, whereupon future charges for the affected Service stop and we will apply a service credit for the prepaid, unused portion to a future billing period (fees already paid are not refunded as cash). Processor remains liable to Controller for each Subprocessor's acts and omissions to the same extent it would be liable if performing the services directly.

7. Assistance with Data Subject requests

Taking into account the nature of the Processing, Processor will assist Controller through appropriate technical and organizational measures, insofar as possible, to respond to requests from Data Subjects to exercise their rights under Data Protection Laws, including access, rectification, erasure, restriction, portability, objection, and the right not to be subject to automated decision-making. Processor will respond to a Controller request for assistance within seven (7) business days. If Processor receives a Data Subject request directly relating to Controller's data, it will (unless prohibited by law) forward it to Controller without undue delay and will not respond except on Controller's instructions.

8. Personal Data Breach notification

Processor will notify Controller without undue delay and, where feasible, within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting Controller's Personal Data. The notification will describe, to the extent then known, the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and measures taken or proposed to address it and to mitigate adverse effects. Processor will provide reasonable cooperation, information, and assistance to enable Controller to meet its own notification obligations under Data Protection Laws.

9. Data Protection Impact Assessments

Processor will provide reasonable assistance to Controller with any data protection impact assessments and prior consultations with supervisory authorities that Controller is required to carry out under GDPR Articles 35 and 36, taking into account the nature of Processing and the information available to Processor.

10. International transfers

Where Processing of Personal Data under this DPA involves a transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, the parties agree:
  • The SCCs (Module 2 — Controller-to-Processor) are incorporated by reference and apply to such transfers, with Controller as "data exporter" and Processor as "data importer." Clause 7 (docking) is included; the optional wording in Clause 11(a) regarding independent dispute resolution is not selected; Clause 17 Option 1 is selected with the governing law of Ireland; Clause 18(b) designates the courts of Ireland. The Annexes to the SCCs are populated by Annexes I, II, and III of this DPA.
  • For transfers subject to the UK GDPR, the UK Addendum is incorporated and applies in place of the SCCs as modified by the Addendum. For transfers subject to the Swiss FADP, references in the SCCs to the GDPR are read as references to the FADP, and references to EU supervisory authorities and courts are read as references to the Swiss FDPIC and courts.
  • Processor will assess transfer impact in light of the standards described in EDPB Recommendations 01/2020 and will inform Controller if it can no longer comply with the SCCs.

11. Audits

Processor will make available to Controller information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Controller or an independent auditor mandated by Controller (subject to confidentiality obligations), as required by GDPR Art. 28(3)(h).
  • Controller may conduct one audit per calendar year on at least thirty (30) days' advance written notice, during normal business hours, with reasonable scope and duration, and without disrupting Processor's operations or the security or confidentiality of other customers' data.
  • Where available, Processor will satisfy audit requests by providing current third-party reports and certifications under NDA in place of an on-site audit.
  • Each party will bear its own costs; if an audit reveals material non-compliance attributable to Processor, Processor will reimburse Controller's reasonable, documented audit costs.
  • Audits in regulated industries or by supervisory authorities are permitted as required by law on the timelines required by law.

12. Return or deletion on termination

On termination or expiration of the Agreement, Processor will, at Controller's choice, delete or return all Personal Data Processed under the Agreement and delete existing copies, except to the extent applicable law requires retention. Controller may export its data through the Service before termination. Absent a Controller instruction, Processor will delete Personal Data within ninety (90) days of termination, subject to backup overwrite schedules (no longer than 35 days) and the retention requirements set out in the Privacy Policy. Processor will, on written request, certify completion of deletion.

13. CCPA terms

With respect to Personal Information governed by the CCPA, Processor is a "Service Provider" and Controller is a "Business." Processor will not (a) sell or share Personal Information, (b) retain, use, or disclose Personal Information for any purpose other than the business purposes specified in the Agreement and this DPA, (c) retain, use, or disclose Personal Information outside the direct business relationship, or (d) combine Personal Information received under the Agreement with Personal Information from another source, except as permitted by the CCPA. Processor certifies that it understands and will comply with these restrictions.

14. Liability

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement. The SCCs Clause 12 governs liability between data exporter and data importer with respect to claims by Data Subjects.

15. Term, modifications, and notices

This DPA takes effect on the date Controller accepts the Agreement and continues for as long as Processor Processes Personal Data under the Agreement. Processor may amend this DPA from time to time where required to reflect changes in law, Subprocessors, or material operational changes, on at least thirty (30) days' notice. If a modification has a material adverse effect on Controller, Controller may terminate the affected Service on written notice within the notice period without penalty. Notices to Processor go to [email protected]; notices to Controller go to the billing contact on file or as otherwise specified in the order form.

Annex I — Description of Processing

Categories of Data Subjects: Controller's authorized users, end-customers, employees, contractors, and any other natural persons whose Personal Data is included in briefs, voice recordings, transcripts, brand-kit assets, or other materials submitted to the Service.

Categories of Personal Data: identifiers (name, email, phone), authentication identifiers, billing contact details, audio recordings and transcripts of calls placed to Processor's voice number, SMS / iMessage messages exchanged with Processor's messaging number, brief content (which may include any information the Controller chooses to include), generated outputs, brand-kit assets, telemetry, IP addresses and device data, and support communications. Controller is responsible for ensuring it has a lawful basis for any special-category Personal Data it submits.

Sensitive Data: none required by the Service. Processor does not solicit or rely on sensitive Personal Data.

Frequency of transfer: continuous, on demand as the Service is used.

Nature and purpose of Processing: hosting, storage, transmission, transcription, generation of .pptx presentations, account and billing administration, support, security, and product analytics, as described in the Agreement and the Privacy Policy.

Duration: for the term of the Agreement and the retention periods described in the Privacy Policy.

Competent supervisory authority (for SCCs): where Controller is established in the EEA, its lead supervisory authority; otherwise, the Irish Data Protection Commission.

Annex II — Technical and Organizational Measures

  • Encryption in transit: TLS 1.2 or higher for all external connections; encrypted, network-isolated channels for internal service-to-service traffic.
  • Encryption at rest: AES-256 server-side encryption on object storage and on managed database volumes, using provider-managed keys.
  • Access control: single sign-on with multi-factor authentication required for all production access; role-based access control with least-privilege defaults; quarterly access reviews; immediate revocation on role change or departure.
  • Tenant isolation: logical isolation of each customer's data, enforced at the application and storage layers.
  • Audit logging: append-only audit log of every mutating action and every administrative access to Personal Data; retained for 12 months.
  • Vulnerability management: continuous dependency, container, and code scanning, with remediation SLAs by severity.
  • Secure SDLC: code review for every change; required automated tests, type checking, and lint; secrets managed outside source control.
  • Backups and recovery: encrypted backups retained for up to 35 days; documented restore procedures tested periodically.
  • Incident response: on-call rotation, documented runbooks, post-incident reviews, customer notification process aligned with Section 8.
  • Personnel: background checks proportionate to role for personnel with production access; written confidentiality obligations; annual security and privacy training.
  • Physical security: all production infrastructure runs in audited, enterprise-grade cloud data centers whose operators maintain physical security controls equivalent to ISO 27001 / SOC 2.
  • Data minimization: retention schedules enforced automatically; deletion APIs available to Controller and to Data Subjects.
  • No model training: Customer Content is not used to train or fine-tune machine-learning models; contractual prohibitions in place with model Subprocessors.

Annex III — Authorized Subprocessors

Personal Data may be Processed by the following categories of Subprocessors, each located in the United States. The current named Subprocessor within each category is available to Controller on request to [email protected] and is provided as part of any counter-signed copy of this DPA or the SCCs.

  • LLM provider (United States) — AI text-generation that drafts deck content; receives brief text. Contractually prohibited from training on Customer Content.
  • Voice / speech-to-text provider (United States) — voice intake and transcription; receives call audio and transcripts.
  • Authentication / identity provider (United States) — authentication and account management; receives email addresses and authentication identifiers.
  • Payment processor (United States) — PCI-DSS Level 1 payments; receives billing details and card data.
  • Telephony provider (United States) — inbound voice number and voice-agent telephony; receives phone numbers and call audio.
  • Messaging provider (United States) — SMS / iMessage / RCS intake and outbound replies; receives phone numbers and message content.
  • Transactional email provider (United States) — outbound and inbound email; receives email addresses and message content.
  • Webhook delivery provider (United States) — webhook delivery; receives webhook payloads emitted to Controller endpoints.
  • CDN / edge-security provider (United States) — CDN, DNS, and edge security; processes traffic metadata and IP addresses.
  • Cloud compute provider (United States) — compute hosting; processes Service traffic and ephemeral runtime state.
  • Managed database provider (United States) — managed relational database; stores account, brief, deck, and billing records.
  • Object storage provider (United States) — stores .pptx files, audio recordings, and brand-kit assets.
  • Product analytics provider (United States) — first-party product analytics served from our own domain; receives page-view and click events and opt-in session replay.

Processor will notify Controller at least thirty (30) days before adding or replacing a Subprocessor, in accordance with Section 6.

Contact

For questions about this DPA, requests for the SCCs as a standalone document, or to request a counter-signed copy: [email protected].