Data processing agreement

Version 16 October 2026 · My AI B.V.

This is an English translation, provided for your convenience. The Dutch version is legally binding: if the two differ, the Dutch text prevails.

This data processing agreement applies when a business customer uses My Notetaker. It meets Article 28(3) of the General Data Protection Regulation (GDPR) and forms part of our terms and conditions. By accepting those terms (when creating an account or later in the app), the customer concludes this agreement with us electronically (Article 28(9) GDPR).

Parties
1. The customer: the organisation or self-employed professional that uses My Notetaker for business purposes, as controller;
2. My AI B.V., Colosseum 65 (unit 1.12–1.16), 7521 PP Enschede, Chamber of Commerce (KvK) 98317067, as processor (hereinafter: we).

1. Subject matter and duration

We process personal data on behalf of the customer in order to provide the My Notetaker service, as described in Annex 1.
This agreement runs for as long as we process personal data on behalf of the customer, including after the end of the subscription for as long as data still exists.
In the event of a conflict between this agreement and the terms and conditions, this agreement prevails, insofar as it concerns the processing of personal data.

2. Instructions

We process the personal data only on the basis of written instructions from the customer. The customer gives those instructions through its use of the service: the features that the customer and its users enable, the retention period chosen, and requests to delete or export data. This agreement and the terms and conditions are also instructions.
We do not process the data for our own purposes. In particular, we do not use it to train AI models, we do not use it for marketing, and we do not sell it.
If a legal requirement obliges us to carry out other processing, we will inform the customer in advance, unless that law prohibits this.
If we consider that an instruction infringes the GDPR or other data protection rules, we will inform the customer immediately.

3. Special feature: content is personal to each user

My Notetaker is built so that only the user who recorded a conversation can view that conversation. The customer (for example the administrator of an organisation) is technically unable to view the conversation content of its users. The customer nevertheless remains the controller and determines the purposes and means by deploying the service for its users.
Because the customer itself cannot access the content, the customer handles requests from data subjects (such as access or erasure) through the user concerned, who can export and delete their data in the app. If that is not possible, for example because the user no longer works for the customer, we will assist the customer on request. If we delete a user's content at the customer's request, we will do so only after a written request from an authorised representative of the customer, and we will inform the user.
If a user leaves the customer's organisation, their account with the conversations continues to exist as a personal account. From that moment on, we no longer process that content on behalf of the customer. The customer makes its own arrangements with its users about what happens to work-related conversations when someone leaves.

4. Confidentiality

Everyone at our end who may have access to the personal data is bound by confidentiality. We grant access only insofar as this is necessary to provide the service, to resolve a malfunction, or because the law requires it.

5. Security

We take appropriate technical and organisational measures to secure the personal data against loss and unlawful processing (Article 32 GDPR), taking into account the state of the art, the costs and the risks. The measures are set out in Annex 2.
We may change measures, provided that the level of security does not decrease.

6. Sub-processors

The customer gives us general authorisation to engage sub-processors. The current list is available at my-notetaker.nl/en/subprocessors.
If we wish to add or replace a sub-processor, we will inform the customer at least 30 days in advance via the app, by email to the administrator of the subscription and on that page. The customer may object, stating its reasons, within that period. If we cannot reach agreement together, the customer may terminate the agreement before the change takes effect; we will refund amounts paid in advance for the period after that.
We impose on each sub-processor at least the same obligations as those set out in this agreement. We remain liable to the customer for the performance of our sub-processors.

7. Transfers outside the EEA

Conversation content is stored and processed only in the European Economic Area. A number of sub-processors are part of a group with a parent company in the United States. Insofar as they may access data from a country outside the EEA, this happens only with appropriate safeguards within the meaning of Chapter V GDPR: the EU-U.S. Data Privacy Framework and/or the standard contractual clauses of the European Commission. We carry out any other transfer only with the customer's prior written consent.

8. Assistance to the customer

Taking into account the nature of the processing, we assist the customer in fulfilling its obligations, including responding to requests from data subjects (Articles 12 to 23 GDPR), security, notifying personal data breaches, a data protection impact assessment (DPIA) and a prior consultation of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (Articles 32 to 36 GDPR).
If we receive a request directly from a data subject, we forward it to the customer or the user concerned and do not respond to it ourselves, unless the customer instructs us to do so.
For a DPIA, we will provide information about the processing, the processors and the security free of charge on request. We may charge for extensive assistance beyond that at our usual hourly rate, after prior consultation.

9. Personal data breaches

If we discover a personal data breach relating to personal data that we process for the customer, we will notify the customer without undue delay, and no later than 36 hours after we discovered it, so that the customer can notify the Dutch DPA within 72 hours.
In doing so, we will provide, insofar as known: the nature of the breach, the categories and approximate number of data subjects and data records, the likely consequences, the measures we have taken or propose, and a contact person. We will provide any information we do not yet have as soon as possible afterwards.
We take measures immediately to limit the consequences and keep a register of all breaches.
Notifying the Dutch DPA and data subjects is the responsibility of the customer.

10. End: return and deletion

During the agreement and for at least 30 days after it ends, the customer and its users can export all data themselves (see Article 12 of the terms and conditions).
After that, we delete the personal data that we process for the customer, at the customer's written request or when the user concerned deletes their account or conversations, unless a legal obligation requires us to retain it. An account that has become a personal account after the user left the customer (Article 3.3) is not covered by this.
Deleted data may remain in backups for a short time; these are overwritten within 30 days and are not restored.

11. Information and audits

We make available to the customer all information necessary to demonstrate that we comply with this agreement and Article 28 GDPR.
The customer may have an audit carried out once a year, or more often after a personal data breach, by an independent expert who is bound by confidentiality. The customer announces the audit at least 30 days in advance. The audit may not disrupt the service for other customers and does not give access to data of other customers. The costs are borne by the customer, unless the audit reveals a material shortcoming on our part.
Where possible, we refer to certifications and reports of our sub-processors. Our AI platform Artific is certified to ISO/IEC 27001:2022.

12. Obligations of the customer

The customer warrants that it has a valid legal basis for the processing, that it informs data subjects (including conversation partners and its own employees) as the GDPR requires, and that it carries out a DPIA where necessary, including for special categories of personal data such as health data.
The customer ensures that its users comply with the rules in Article 8 of the terms and conditions.

13. Liability

The liability of the parties is governed by Article 14 of the terms and conditions, provided that nothing in this agreement limits the rights of data subjects or liability under Article 82 GDPR.

14. Governing law and forum

This agreement is governed by Dutch law. Disputes will be submitted to the competent court of the District Court of Overijssel (Rechtbank Overijssel).

Annex 1: description of the processing

Nature and purpose	Recording, transcribing (speech to text), summarising and analysing conversations with AI; storing them and making them searchable per user; answering questions about the user's own conversations; building contact profiles for the user.
Categories of data subjects	Users (employees of the customer or the customer itself); conversation partners of users (such as clients, patients, colleagues, customers, suppliers) and persons who are talked about in conversations.
Categories of personal data	Voice and speech recordings; everything said in conversations; names and organisations of contacts; AI-derived summaries, action items, keywords, descriptions of mood and contact profiles; metadata (time, duration, source, device). Depending on the customer's use, also special categories of personal data, such as data concerning health and data of a criminal nature.
Location	European Union: Google Cloud europe-west4 (the Netherlands) via Artific; application server and database in Frankfurt (Germany).
Retention period	Until the user deletes the conversation or their account, or until the retention period chosen by the user expires; temporary audio on our server until the processing of the recording has ended; audio that could not be processed until the user has it processed again or deletes it.

Annex 2: security measures

Separation per user: row-level database security on all tables containing content, enforced with separate database roles; a separate knowledge base, index and search function per user at Artific; every search query filtered by user and every result checked afterwards for ownership.
Data minimisation: our own database contains no transcripts, summaries, titles or names of contacts. Questions asked and their answers are, like the conversation content, stored only at Artific and are not used as a source for new questions. Temporary records at Artific are deleted after use.
Encryption: HTTPS (TLS) with HSTS for all connections; encrypted storage at all sub-processors; temporary audio additionally encrypted with AES-256-GCM.
Access: passwords stored as scrypt hashes; optional two-step verification with an authenticator app (secret stored encrypted, recovery codes only as hashes); session keys stored only as hashes; cookies HttpOnly, Secure and SameSite=Strict; origin check on every change; limits on login attempts and other sensitive actions; a linked watch can only add recordings and cannot read anything.
Web security: strict Content Security Policy without third-party scripts or resources; no trackers.
Administration: access to production systems and keys only for those who need it; credentials kept outside the source code; log files without conversation content, passwords or cookies.
Deletion: deleting conversations and accounts also erases the content at Artific; failed deletions are retried automatically; automatic deletion after the retention period chosen by the user.
Continuity: hosting with parties that have redundant infrastructure in the EU, and automatic backups of the database.