Oteo Data Processing Agreement

1.1The Customer is the controller of the personal data in its Customer Data. Oteo (J. von Oven trading as Oteo, KvK 82061386, The Hague) is the processor.

1.2For data Oteo processes for itself, such as account details, invoices for the subscription and security logs, Oteo is itself the controller. The Privacy Statement applies to that data.

3.1Oteo processes the data only on the Customer's written instructions. Use of the Service and the settings the Customer chooses count as those instructions.

3.2If Oteo must process data because the law requires it, Oteo reports this in advance, unless the law forbids it.

3.3If Oteo believes an instruction breaches the GDPR, Oteo reports this immediately.

Everyone who has access to the data on Oteo's behalf is bound by confidentiality. An Oteo team member looks at a document only if the Customer asks for help or if it is needed for security or an outage. Every access is logged with a reason and is visible in the workspace activity.

5.1Oteo takes appropriate technical and organisational measures. The main ones are listed in Annex 2.

5.2Oteo may change the measures, as long as the level of security does not decrease.

6.1The Customer authorises Oteo to engage the sub-processors in Annex 1.

6.2Oteo imposes on each sub-processor at least the same obligations as in this agreement.

6.3Oteo announces a new sub-processor by email at least 30 days in advance. The Customer may object with reasons within that period. If we cannot resolve it, the Customer may cancel with a refund of the remaining period.

7.1Oteo stores Customer Data in the EU (database in Ireland, servers in Dublin, Ireland).

7.2Some sub-processors are US companies or process data in the US, such as Google, Anthropic and OpenAI for reading documents. Transfers take place only on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses, with supplementary measures where needed.

8.1Oteo helps the Customer with requests from data subjects, such as access or erasure. The Customer can do much of this itself in the app: view, correct, export and delete.

8.2If Oteo receives such a request directly, Oteo forwards it to the Customer and does not handle it itself.

8.3Oteo reasonably assists the Customer with a data protection impact assessment (DPIA) or a question from the supervisory authority. If this takes more than a few hours, Oteo may charge the reasonable costs.

9.1If Oteo discovers a security breach affecting the Customer's data, Oteo reports it without undue delay, and no later than 48 hours after discovery, by email to the owner of the workspace.

9.2Oteo provides what is known: what happened, which data and data subjects are affected, the consequences and the measures taken. Anything that becomes known later follows as soon as possible.

9.3The Customer decides whether to report the breach to the supervisory authority (in the Netherlands the Autoriteit Persoonsgegevens) and to data subjects.

10.1After the subscription ends, the workspace remains read-only for 90 days so the Customer can export everything. Oteo sends a reminder by email on day 60 and day 85.

10.2After that, Oteo deletes the data within 30 days, unless the law requires retention or a dispute is ongoing; in that case Oteo waits until it is resolved. Copies in backups are overwritten within the normal backup retention period.

10.3Oteo confirms the deletion by email to the owner of the workspace. Accounts that belong to no other workspace are deleted at the same time.

11.1On request, Oteo gives the Customer the information needed to show that Oteo complies with this agreement.

11.2If that is not enough, the Customer may, once a year and with 30 days' notice, have an audit carried out by an independent expert bound by confidentiality. The Customer bears the costs, unless the audit finds a serious shortcoming.

Article 16 of the Terms of Service applies to liability under this agreement.

• Each workspace is isolated per customer in the database (row level security). Even a bug in the app cannot show another customer's data.
• Sign-in with a one-time code by email; bot check against misuse; extra checks for Oteo administration.
• Encryption of connections (TLS) and of stored data at the hosting providers.
• Integration keys stored encrypted; Gmail and Outlook: reading, and only labelling or moving if the Customer turns on filing. Oteo never sends or deletes email.
• Files are checked for scripts, hidden text and dangerous links before anyone opens them.
• Rate limits per person, workspace and network.
• A log of every access by Oteo team members, with a reason.
• Database backups: Oteo does not make these yet. If they are introduced, Oteo will keep them for at most 7 days. The Customer can export everything at any time.
• Monitoring of errors and background jobs, with an alert when something fails.
• Changes to the software are reviewed before they go live.