Data Processing Agreement

When Enterwise processes your personal data on behalf of your organisation, we act as a processor under GDPR Article 28. Our standard Data Processing Agreement (DPA) governs that relationship.

What our DPA covers

Our DPA is written to satisfy, in one document:

• EU/EEA GDPR Article 28 (processor obligations)
• UK GDPR
• California CCPA / CPRA (service-provider terms)
• Other US state privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and similar)

International transfers are made under the European Commission's Standard Contractual Clauses (2021/914) and the UK IDTA / Addendum for UK data.

Key commitments

• Customer content is not used to train third-party AI models. Our AI subprocessors are contractually bound to the same.
• Audio recordings are transient. Audio is uploaded only for transcription and deleted from our storage as soon as the transcript is stored. If transcription fails, audio is retained for up to seven (7) days to allow retry and then automatically deleted. Audio is never retained indefinitely.
• 30 days' advance notice before adding or replacing a subprocessor. The full list is at enterwise.ai/trust#subprocessors.
• Breach notification to the controller within 48 hours of becoming aware.
• Return or deletion of customer data within 30 days of the contract ending.
• Reasonable assistance with data subject requests and compliance enquiries.

Request the DPA

The DPA is available on request. Email privacy@enterwise.ai with:

• Your company name and country
• The email address to send the DPA to
• Any custom terms or annexes you would like to discuss

We respond within five business days.

For enterprise customers with custom procurement requirements, the standard DPA can be negotiated under a Master Services Agreement; mention this in your request.

Related documents

• Privacy Policy
• Terms of Service
• Trust (security, subprocessors, AI commitments)
• Subprocessor list

Contact