Tenure Data Processing Agreement
Version 1.5 (2026-11-04.2) · 4 November 2026
| Document | Data Processing Agreement (GDPR art. 28) |
|---|---|
| Version | 2026-11-04.2 |
| Release | 1.5 |
| Date | 2026-11-04 |
| Languages | English and French, one version (dpa.en.md, dpa.fr.md) |
| Status | Published 4 November 2026, and applies from that date (section 17.2). Section 17.2 states what releases 1.1 to 1.5 changed |
| Goes with | Terms of Service, version 2026-11-03 (terms-of-service.en.md) |
1. Parties and scope
1.1 This Data Processing Agreement ("DPA") is concluded between the organisation that uses Tenure (the "Customer"), as controller, and HighKnow SRL, Rue Auguste van Zande 95 bt 2, 1080 Bruxelles, Belgium, enterprise number 1033.752.853, RPM Bruxelles ("HighKnow"), as processor.
1.2 It forms part of the contract made of the Terms of Service and, where there is one, an order form. It applies to all personal data HighKnow processes on the Customer's behalf in providing Tenure (the "service"), the "Customer Personal Data". Where this DPA and the Terms of Service conflict on personal data, this DPA prevails.
1.3 It is concluded electronically when an owner of the Customer's organisation accepts it in the service, which records the version, the language, the person and the time (GDPR art. 28(9)).
1.4 Terms defined in the GDPR (Regulation (EU) 2016/679), such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority, have the same meaning here.
2. Roles
2.1 The Customer is the controller of the meeting content and decides whether to record, whom and why. HighKnow processes it on the Customer's behalf: capture, transcription, storage, extraction, retrieval, cards, questions and answers, summaries, and sharing within the service.
2.2 The processing covered by this DPA is:
| Processing | Controller | HighKnow |
|---|---|---|
| Meeting content: the audio stream, transcripts, claims, cards, answers, summaries | Customer | Processor |
| Data about meeting participants who are not users of the service | Customer | Processor |
| Calendar and document data a member connects | Customer | Processor |
| Invitation emails, until the invitee signs up | Customer | Processor |
2.3 Outside this DPA. HighKnow is the controller, and its privacy policy applies, for: sign-in, accounts, membership and roles; billing records and usage metering; security records such as the audit log and sign-in protection; the account of an invitee once they sign up; visitors to its website; and its operator dashboard, which shows organisation-level figures only.
2.4 The extraction joint. HighKnow defines the menu of claim types the service can extract, their meaning and the extraction logic. The Customer chooses which of those types are active (section 4.3). The parties' view is that HighKnow remains a processor for extraction. Annex 4 is a dormant joint-controller arrangement that takes effect only in the case it describes.
2.5 The Customer's lawful basis. As controller, the Customer chooses and documents the lawful basis for recording and processing what meeting participants say, usually its legitimate interests, and is responsible for it. The service supports that choice: a disclosure to participants that cannot be skipped, one consent flow run in every meeting whatever the participants' location, and an objection that stops the recording (section 4.5).
3. Subject matter, duration, nature and purpose
3.1 Subject matter: the provision of Tenure to the Customer, as described in the Terms of Service and the Instructions for Use.
3.2 Duration: for as long as HighKnow processes Customer Personal Data under the contract, and until it is deleted or returned under section 11.
3.3 Nature and purpose, the categories of data subjects and the types of personal data are described in Annex 1.
4. Documented instructions (GDPR art. 28(3)(a))
4.1 HighKnow processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a third country, unless EU or Member State law requires otherwise. In that case HighKnow informs the Customer of that legal requirement before processing, unless that law prohibits it.
4.2 The Customer's instructions are: this DPA; the Terms of Service; and the configuration the Customer sets in the service, each setting of which is a documented instruction from the moment it is saved.
4.3 The claim-type configuration is a documented instruction. An owner or admin of the Customer's organisation chooses which claim types extraction may produce, from the documented set, each shown with a one-line description. The two types that describe an aspect of a named person (a person's relationship to a deal and a person's stated preferences) are off by default. Extraction produces only the types that are enabled. Every change is written to the organisation's audit log with who made it, when, and the settings before and after, and that record is the Customer's instruction for extraction.
4.4 The other instructions set in the service include:
- transcript retention: 90 days by default, which the Customer may extend up to 24 months, recording a justification at the time of the change;
- the default visibility of claims (private to the user, or shared with the organisation) and what members share and with whom;
- the consent policy and the participant notice used in meetings;
- which calendar and document sources members connect, and which folders or files they select;
- objections, erasures and restrictions the Customer records for a person.
4.5 Local-only capture is not offered. An objection stops the recording (Off). The service does not capture the user's own speech after a participant declines, and does not continue in any other mode. If HighKnow ever introduces local-only capture, it will carry three conditions that HighKnow will never relax: the user chooses it in the meeting, and it is never set by organisation policy; it is disclosed to the participants as a question of its own; and the claims extracted from it are scoped to that user, never shared with the organisation. It would be offered only when the user's computer plays sound through headphones, so that the other participants' voices are not picked up from the speakers, and it would be announced as a material change under section 16.
4.6 HighKnow informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection law (GDPR art. 28(3), last subparagraph).
4.7 No processing for HighKnow's own purposes. HighKnow does not process Customer Personal Data for any purpose of its own. Section 14 states the most important consequence as a warranty.
5. Confidentiality (GDPR art. 28(3)(b))
HighKnow ensures that every person it authorises to process Customer Personal Data is bound by a duty of confidentiality, by contract or by statute, and accesses Customer Personal Data only where needed to provide the service, to answer the Customer's request, or to meet a legal obligation.
6. Security (GDPR arts. 28(3)(c) and 32)
6.1 HighKnow implements the technical and organisational measures in Annex 2, which are designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.
6.2 Annex 2 summarises the measures. Their full description is HighKnow's architecture and security documentation, which HighKnow makes available to the Customer on request.
6.3 HighKnow may update the measures, provided that the overall level of security is not reduced.
7. Sub-processors (GDPR art. 28(2) and (4))
7.1 General authorisation. The Customer authorises HighKnow to engage the sub-processors listed in Annex 3, which HighKnow also publishes at highknow.ai/subprocessors.
7.2 Notice of changes. HighKnow announces any intended addition or replacement of a sub-processor at least 30 days in advance, on the public sub-processor page and by email to the owners of the Customer's organisation. The notice names the sub-processor, its location, what it will do, which data it will receive, the safeguards that apply and the date the change takes effect.
7.3 Right to object. The Customer may object to the change, on reasonable data protection grounds, by writing to privacy@highknow.ai before the change takes effect. HighKnow will then discuss the objection in good faith and may propose an alternative. If none is agreed, the Customer may terminate the affected service before the change takes effect, and HighKnow refunds, pro rata, the fees paid in advance for the period after termination.
7.4 Flow-down. HighKnow imposes on each sub-processor, by contract, data protection obligations that are no less protective than those in this DPA, in particular sufficient guarantees for appropriate technical and organisational measures (art. 28(4)).
7.5 Responsibility. HighKnow remains fully liable to the Customer for the performance of each sub-processor's obligations.
7.6 The whole chain. On request, HighKnow provides the identity (name, address and contact person) of the sub-processors engaged by its sub-processors, as far as they are known to it, and keeps that information up to date (EDPB Opinion 22/2024, ¶ 32).
8. Assistance with data subjects' rights (GDPR art. 28(3)(e))
8.1 HighKnow assists the Customer, by appropriate technical and organisational measures and as far as possible, in answering requests from data subjects to exercise their rights of access, rectification, erasure, restriction, portability and objection.
8.2 The measures are, first, the service's rights page, from which an owner or admin of the Customer's organisation answers each right: a machine-readable export (JSON) of what a person said and the claims about them, for access and portability; an objection that stops the use of what is stored about the person to ground any output; erasure of a person, cascading to the claims about them and their transcript segments; restriction of a contested claim; and rectification. Where a request cannot be answered there, HighKnow carries it out itself on the Customer's documented instruction, within 10 business days.
8.3 A participant's objection. When the Customer records a participant's objection and names the meetings concerned, HighKnow removes, within 30 days, the transcript of each named meeting except the parts confirmed as spoken by someone else, and the claims that rest only on it; a claim also supported by another meeting keeps that support. Because a far-end speaker is not identified by voice, this removes the representative's and other unconfirmed speakers' words in those meetings too, and clears their summaries. From the moment the objection is recorded, nothing about that person is used to ground a card, an answer or a claim. The Customer must not record the person again (Terms of Service, section 8.2). An objection made during a meeting is handled in the meeting: the user's "Someone objected — stop and delete" control stops the recording and deletes what was captured of that meeting, in two taps; a deletion that cannot reach the service at once is retried until it is done, within 30 days.
8.4 A request HighKnow receives directly about meeting content is forwarded to the Customer without undue delay, and HighKnow tells the requester that the Customer, as controller, will answer. Where the requester is a meeting participant who is not a user, HighKnow points them to the organisation that organised the meeting and forwards the request to that organisation within 7 days. HighKnow does not answer such a request on the merits itself unless the Customer instructs it to.
9. Assistance with security, breaches, DPIAs and prior consultation (GDPR art. 28(3)(f))
9.1 HighKnow assists the Customer in meeting its obligations under arts. 32 to 36 GDPR, taking into account the nature of processing and the information available to HighKnow.
9.2 DPIA and employee representatives. A data protection impact assessment, and any information or consultation of employee representatives, are the Customer's duties as controller and as employer. HighKnow supplies, on request at privacy@highknow.ai, a reference data protection impact assessment for the service, which the Customer completes, and a works-council pack: an information note for Belgium (collective agreement no. 39), a consultation note for a French CSE, a German works agreement template, a consent request template for the Netherlands, and a disclosure of what the service can and cannot do. HighKnow answers the Customer's reasonable questions for its own assessment and for any prior consultation of a supervisory authority.
9.3 Personal data breach. HighKnow notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it (art. 33(2)), by email to the owners and admins of the organisation. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, with a contact point (art. 33(3)). Where not all the information is available at once, HighKnow provides it in phases without further undue delay (art. 33(4)). HighKnow documents every breach in its internal breach register.
9.4 HighKnow does not notify a supervisory authority or data subjects of a breach of Customer Personal Data on the Customer's behalf unless the Customer instructs it to.
10. International transfers
10.1 All customer data is stored exclusively in the EU, except the correspondence described in section 10.3. Request processing is performed in the EU, or where network routing requires otherwise, under GDPR Chapter V safeguards. Inference runs in the EU. HighKnow does not transfer Customer Personal Data outside the European Economic Area except as stated in this section or on the Customer's documented instruction.
10.2 The network platform (Cloudflare, Annex 3) may route a request through a point of presence outside the EU. It never stores Customer Personal Data there. That transit is covered by the standard contractual clauses in Cloudflare's data processing addendum and by the EU–US Data Privacy Framework.
10.3 The mailboxes contact@highknow.ai and privacy@highknow.ai are hosted by Google Workspace (Google Cloud EMEA Limited, Ireland, Annex 3). They hold correspondence, including requests from data subjects, and their storage is not limited to the EU: the edition HighKnow uses (Google Workspace Business Starter) offers no data-region policy, so what someone writes to those addresses may be stored and processed in any country where Google or its sub-processors have facilities, the United States included. Transfers to the United States are covered by the EU–US Data Privacy Framework, under which Google LLC is certified, and other transfers by the standard contractual clauses in Google Cloud's data processing addendum. No other Customer Personal Data reaches Google Workspace.
10.4 The transcription sub-processor (Soniox, Annex 3) processes the audio stream in its EU regional deployment. Limited processing for security, support and legal compliance may take place outside the EU, under the standard contractual clauses (Module 3) incorporated in its data processing agreement.
10.5 If the EU–US Data Privacy Framework ceases to apply, the standard contractual clauses remain the safeguard for these transfers.
10.6 The database sub-processor (Neon, contracted with Databricks, Inc., Annex 3) stores the data in Frankfurt. Databricks is a United States company, so any access to the data from outside the European Economic Area, for operating or supporting the service, is a transfer, covered by the standard contractual clauses incorporated in Databricks' data processing addendum.
11. Deletion and return at the end of the service (GDPR art. 28(3)(g))
11.1 At the end of the provision of services, and whenever the Customer switches provider, the Customer may have its Customer Personal Data returned as the organisation export, which an owner of the Customer's organisation, and no other role, downloads from the plan page as a versioned JSON Lines archive of the data listed in the Terms of Service, section 6.6, and retrieve it for at least 30 days after the transitional period that section sets.
11.2 After that period, HighKnow deletes the Customer Personal Data, unless EU or Member State law requires its storage. Deletion from backups follows within the backup window: 6 hours of point-in-time recovery of the database, and 7 days for each nightly copy of the database, which is encrypted before it leaves the job that makes it, kept in the EU, and deleted by the storage provider once its 7 days have passed, usually within a day. When HighKnow restores the database from a backup, it re-applies every deletion made after that backup was taken, from a record kept outside the database that holds identifiers only and keeps each of them for 15 days, so that deleted data does not return. The live meeting room's state, which holds a meeting's transcript while the meeting runs, remains after the room wipes or purges it, for up to 30 days in the provider's recovery log, which HighKnow's application does not read and from which HighKnow never restores a meeting room to a point before its wipe or purge. After those periods no copy remains. HighKnow confirms the deletion in writing on request.
11.3 HighKnow keeps the record of this DPA's acceptance (the version, the language, the person and the time) after the deletion, as evidence of the contract, for as long as a claim under the contract can be brought.
11.4 Audio is never written to durable storage by HighKnow, so there is no audio to return or delete.
12. Information and audits (GDPR art. 28(3)(h))
12.1 HighKnow makes available to the Customer all information necessary to demonstrate compliance with art. 28, including its architecture and security documentation and its records of processing as processor.
12.2 HighKnow allows for and contributes to audits, including inspections, by the Customer or an auditor the Customer mandates and who is bound by confidentiality. An audit is announced at least 30 days in advance, takes place no more than once in any twelve months unless a supervisory authority requires it or a breach justifies it, is limited to the processing under this DPA, and is carried out at the Customer's cost. HighKnow may first propose to answer the audit's questions in writing, with documents.
13. Purpose limitation and the service's standing constraints
The service has no inference of any person's emotional state, and HighKnow never builds one. The service has no voiceprint-based identification of any speaker, and HighKnow never builds one. The service has no monitoring or evaluation of a user's performance for a third party, and HighKnow never builds one. HighKnow does not process Customer Personal Data for any of these purposes. These constraints are part of the service's design, as the Instructions for Use state, and part of this DPA.
14. No-training warranty
HighKnow warrants that it does not use Customer Personal Data or any other meeting content of the Customer to train or improve models, for prompt tuning, for evaluation sets, or for any asset shared across customers, and that it will not do so. This is a warranty and not a policy: changing it requires a new version of this DPA accepted by the Customer under section 16, and it survives the end of the contract for any data HighKnow still holds.
15. Liability
Each party's liability under this DPA is governed by the liability section of the Terms of Service: total liability is capped at the fees paid in the 12 months before the event giving rise to the claim, and liability for fraud, gross negligence and intentional fault is never excluded (Belgian Civil Code, art. 5.89). This is without prejudice to the rights of data subjects under art. 82 GDPR.
16. Term and changes
16.1 This DPA applies for as long as HighKnow processes Customer Personal Data and ends when section 11 has been performed.
16.2 Every version of this DPA carries its version and date. HighKnow informs the owners of the Customer's organisation of a material change by email, and in the service, at least 30 days before it applies. A change of wording that changes no right or obligation only changes the version.
16.3 A Customer that does not accept a material change may terminate the contract before the change applies, and HighKnow refunds, pro rata, the fees paid in advance for the period after termination. A change of sub-processor follows section 7. The service records which version an owner accepted, and when.
17. Governing law and this version
17.1 This DPA is governed by Belgian law. The courts of Brussels have exclusive jurisdiction, as in the Terms of Service.
17.2 HighKnow publishes this version as its own. Release 1.1 (27 October 2026) stated how a participant's objection is carried out in sections 8.2 and 8.3, named Neon's contracting entity and the standard contractual clauses in section 10.6 and Annex 3, aligned the return of data in section 11.1 with section 6.6 of the Terms of Service, and named the logged, revocable share and the refused question about a member in Annex 2. Release 1.2 then named the host of the mailboxes in section 10.3 and Annex 3, and the provider's recovery log of the live meeting room in section 11.2 and Annex 2. Release 1.3 states in section 11.2 and Annex 2 that HighKnow's application does not read that recovery log and that HighKnow never restores a meeting room from it to a point before its wipe or purge, and corrects section 10.1 and Annex 1, which said all customer data is stored exclusively in the EU, to except the correspondence in the mailboxes of section 10.3. It applies from its publication, without the notice of section 16.2, because HighKnow had no customer other than its own test organisations when it published it. Release 1.4 states in section 11.2 and Annex 2 the backup window of the nightly copy of the database, 7 days beside the 6 hours of point-in-time recovery, and that a restore re-applies the deletions made after the backup it restores, and names in Annex 3 the sub-processor that runs the job making that copy and the one that keeps it. It applies from its publication, without the notice of section 16.2, for the same reason. Release 1.5, published the same day, states in Annex 3 that Google Cloud (Vertex AI) processes inference within the EU, through its europe-west1 and europe-west4 endpoints, where release 1.4 named Belgium and the Netherlands: for the Gemini models Tenure uses, Google commits those endpoints to the EU, not to one country. It applies from its publication, without the notice of section 16.2, for the same reason. HighKnow publishes any later change as a new version under section 16.
Annex 1 — Description of the processing
A1.1 Nature and purpose
| Purpose | To give the Customer's users, during and after their business meetings, information drawn from the Customer's own meetings and documents, with its source, confidence and age |
|---|---|
| Nature | Receiving the meeting audio as a stream; transcribing it; attributing transcript segments to speakers by channel and by human confirmation; extracting typed claims; storing transcripts, claims and the knowledge base; retrieving from them for cards during meetings and for answers to questions; generating summaries and rollups; sharing within the organisation as members choose; deleting at the end of retention or on request |
| Frequency | Continuous, for as long as the Customer uses the service |
A1.2 Categories of data subjects
- the Customer's users (its members), and colleagues present in a meeting without using the service;
- participants in recorded meetings who are not users: the Customer's customers, prospects, partners and suppliers, and their staff;
- people mentioned in a meeting or a document who are not present;
- people the Customer invites to its organisation, until they sign up.
A1.3 Types of personal data
| Data | What it contains | How long it is kept |
|---|---|---|
| Audio | The meeting's sound, as a stream | Never written to durable storage by HighKnow |
| Transcript segments | What was said, with a speaker label and timestamps | 90 days by default; up to 24 months on the Customer's instruction (section 4.4) |
| Claims | Typed statements extracted from meetings (for example decisions, commitments, objections, open questions, requirements, attributes, relationships, preferences), each with a one- or two-sentence source quote, the speaker where confirmed, a confidence and a date | Kept under decay and supersession; deleted when the meeting or document it came from is deleted, or on a request under section 8 |
| People and organisations | Names, roles and the organisation a person belongs to, as named in meetings or confirmed by a user; contact records a user creates | As long as a claim refers to them, or until erased |
| Calendar data | Meeting time and title, and the domains of attendees' organisations; never attendees' email addresses | As long as the meeting record |
| Documents | Text of the files a member selects from a connected document source, and quotes from it | Until the member removes the file or the connection |
| Cards, answers, summaries and rollups | Generated text with links to the claims and quotes they rest on | As long as their sources |
| Consent and objection records | That a participant was informed, consented, declined or objected, and when | As long as the meeting record; an objection for as long as it stands |
| Invitations | The invitee's email address, the organisation's name and the inviter's display name | Until accepted, revoked or expired |
Special categories (art. 9). The service is not designed to process special categories of personal data, and the documented set of claim types contains no special-category type. Free-form business conversation can nevertheless capture such data incidentally (for example a mention of a medical appointment). The controls are short transcript retention, minimal source quotes, the absence of any special-category claim type, and the Customer's erasure and objection tools.
A1.4 Where the data is
Stored in the European Union, except the correspondence described in section 10.3 (Annex 3). Transit as section 10 describes.
Annex 2 — Technical and organisational measures
A summary. The full description is in HighKnow's architecture and security documentation, available on request.
| Area | Measure |
|---|---|
| Tenant isolation | Every table holding Customer data carries the organisation's identifier, and Postgres row-level security, enabled and forced, binds every query to the organisation set for the transaction; a query with no organisation set is refused (fail closed) |
| Access control | Roles owner, admin and member per organisation; one active organisation per session; a person may never be the subject of a search, and a question about a member of the organisation is refused; transcripts readable only by attendees of the meeting, its creator, and members an attendee names in a logged, revocable share |
| Authentication | Sign-in sessions with revocation; the live meeting connection is opened with a single-use signed ticket, not the session cookie, and is closed within 15 seconds of the session being revoked |
| Encryption | TLS in transit; encryption at rest by the storage providers; third-party integration tokens under envelope encryption with a per-organisation key wrapped by a key-encryption key held as a platform secret |
| Residency | Durable Objects created in the EU jurisdiction; EU-jurisdiction object storage; Postgres in Frankfurt; inference in EU regions; transcription on an EU endpoint whose credential is refused outside the EU |
| Minimisation | Organisation-level attribution by default; person-level claims only after a human confirms the speaker; calendar attendees kept as organisation domains only; minimal source quotes; no voiceprints |
| Retention | Transcripts purged after the configured period (90 days by default); audio never stored; backups for 7 days: a nightly copy of the database, encrypted, kept in the EU for 7 days and deleted by the storage provider usually within a day after, and 6 hours of point-in-time recovery, with every deletion made after a backup re-applied when it is restored, from an identifiers-only record kept 15 days; the live meeting room's state, once wiped or purged, up to 30 days in the provider's recovery log, which HighKnow's application does not read and from which HighKnow never restores a meeting room to a point before its wipe or purge |
| Rights tooling | Erasure of a person cascading to claims and transcript segments; objection flag enforced on every read that grounds output; restriction state for contested claims; rejected facts kept from reappearing |
| Logging | An append-only audit log of administrative actions; document text never written to logs |
| Resilience | Access checks fail closed; meeting dependencies fail open, so a vendor outage marks a gap rather than ending a meeting |
| Abuse limits | Rate limits on connection tickets and other entry points; a spend ceiling per organisation |
| Organisation | One person operates HighKnow today, bound by confidentiality; access to production data is by tenant-scoped service roles, not by an all-tenant credential, except for documented key-rotation procedures |
Known limitation, stated rather than hidden: the key-encryption key is a platform secret without hardware-backed key management; rotation is a documented manual procedure.
Annex 3 — Sub-processors
A3.1 Authorised sub-processors
| Sub-processor | What it does | Customer Personal Data it receives | Where | Safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. (United States) | Application platform: Workers, Durable Objects (the live meeting room), R2 object storage, and AI Gateway, through which prompts built from meeting content reach the inference provider | All meeting content in transit; the live meeting state; the nightly copy of the database, encrypted with a key Cloudflare does not hold, kept 7 days (section 11.2) | Storage and meeting rooms in the EU; request processing at the nearest point of presence (section 10) | Cloudflare's data processing addendum with the standard contractual clauses; EU–US Data Privacy Framework |
| Neon, contracted with Databricks, Inc. (United States), the parent company of Neon, LLC (managed Postgres) | The database: transcripts, claims, the knowledge base, configuration | All stored Customer Personal Data | Frankfurt, Germany (section 10.6) | Databricks' data processing addendum and its Neon schedule, which incorporate the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) for any access from outside the EEA |
| Soniox, Inc. (United States) | Real-time speech-to-text and speaker separation | The meeting audio stream | EU regional deployment: processing stays in the EU, except limited processing for security, support and legal compliance | Soniox's data processing agreement (version 1.3, signed 2026-10-26), which incorporates the standard contractual clauses (Module 3) for that limited processing; no storage of audio or text by default, and Tenure configures none; no training on customer data; SOC 2 Type II and ISO/IEC 27001 |
| Google Cloud (Vertex AI) | Inference (extraction, cards, answers, summaries) and embeddings. Anthropic models are used through Vertex AI, so Google is the processor of record and Anthropic is not a separate sub-processor | Prompts built from meeting content and documents, and the generated output | Processed within the EU (Google's europe-west1 and europe-west4 endpoints) | Google Cloud's data processing terms; caching disabled where it can be configured |
| Scaleway SAS (France) | Transactional email: delivering invitation emails; and the scheduled job that makes the nightly copy of the database (section 11.2) | For an invitation, the invitee's email address, the organisation's name and the inviter's display name; while the nightly job runs, all stored Customer Personal Data, which the job encrypts before any of it leaves the job, and writes to no disk | fr-par (Paris, France) | Scaleway's data processing agreement |
| Google Cloud EMEA Limited (Google Workspace) (Ireland) | Hosts the contact@highknow.ai and privacy@highknow.ai mailboxes only | Only what someone writes to those addresses, for example a data subject's request about meeting content | Any country where Google or its sub-processors have facilities, which can be outside the EU (section 10.3) | Google Cloud's data processing addendum; EU–US Data Privacy Framework (Google LLC) for the United States; standard contractual clauses for other transfers |
| Functional Software, Inc. (Sentry) (United States) | Error and crash reporting for the web app, the desktop app and the Workers | An exception's type and stack trace, the release, the route without its query, and the device, operating system and browser type; never meeting content or an error's message; IP addresses are not stored | EU region (Frankfurt, Germany); organisation settings held by Sentry in the United States | Sentry's data processing addendum: EU–US Data Privacy Framework, and the standard contractual clauses (Modules 2 and 3) should it cease to apply |
Facts not yet confirmed in writing. HighKnow has not yet received written confirmation of two vendor facts, and so does not state them: Google's retention for abuse monitoring, and what Cloudflare AI Gateway logs or caches. HighKnow updates this annex when each is confirmed.
A3.2 Recipients that are not sub-processors, and why
| Recipient | Why it is not a sub-processor under this DPA |
|---|---|
| Stripe | Stripe receives billing data only (the paying organisation, its billing contact, its address and VAT number, card details entered on Stripe's own page) and the organisation's metered meeting-hours as one aggregate figure. HighKnow is the controller of that data (section 2.3), and Stripe acts as an independent controller for payment processing, fraud prevention and its own legal obligations. No meeting content reaches Stripe. Stripe is named in HighKnow's privacy policy |
| The Customer's own calendar and document providers (for example Google Calendar and Google Drive) | When a member connects them, HighKnow reads from the Customer's account with the member's authorisation. The provider serves the Customer under the Customer's own contract with it; it does not process data on HighKnow's behalf |
| Sign-in protection and sign-in with Google | Used for accounts, where HighKnow is controller (section 2.3) |
A3.3 How changes are notified
- HighKnow publishes the intended change on highknow.ai/subprocessors and emails the owners of every organisation, at least 30 days before the change takes effect.
- The notice carries the information in section 7.2 and the date the change takes effect.
- The Customer may object under section 7.3 until that date.
- This annex is updated, and the DPA's version changes, when the change takes effect.
Annex 4 — Dormant joint-controller arrangement for extraction (GDPR art. 26)
A4.1 Why this annex exists
HighKnow defines the claim types the service can extract, and so which categories of personal data extraction can produce. The Customer chooses which types are active, defaults are minimal, and the choice is recorded as the Customer's instruction (section 4.3). The parties consider that this keeps HighKnow a processor. A supervisory authority or a court could take a different view of that one step. Being found to be joint controllers with no arrangement in place would itself infringe art. 26, which this annex exists to prevent.
A4.2 When it takes effect
This annex is dormant. It takes effect only, and only for the processing in A4.3, from the date on which:
- a supervisory authority or a court finds, in a decision addressed to either party, that the parties are joint controllers for that processing; or
- the parties agree in writing that they are.
Until then it has no effect, and nothing in it is an admission that the parties are joint controllers.
A4.3 The processing it covers
The determination of the documented set of claim types, their meaning and the extraction logic, and the extraction of claims from transcripts and documents using them. All other processing remains governed by the rest of this DPA, with HighKnow as processor.
A4.4 Who does what
| Obligation | Customer | HighKnow |
|---|---|---|
| Lawful basis for extraction | Determines and documents it | — |
| Information to data subjects (arts. 13, 14) | Gives it, through the participant notice and its own notices | Provides a plain description of the claim types and the extraction logic, for those notices |
| Choice of active claim types | Makes it, and is responsible for its choice | Keeps the profiling-adjacent types off by default, keeps no special-category type in the set, documents each type |
| Accuracy and rectification | Answers requests | Provides the tools to correct, restrict and erase claims |
| Data subjects' requests | Is the contact point and answers them | Assists, and forwards any request it receives within 7 days |
| DPIA | Carries it out for its processing | Provides the reference DPIA and the description of extraction |
| Security and breach notification | — | As in sections 6 and 9 of this DPA |
| Purposes of its own | — | Has none, and the warranty in section 14 continues |
A4.5 Contact point and transparency
The Customer is the contact point for data subjects (art. 26(1)). The essence of this arrangement is made available to data subjects by the Customer, with text HighKnow provides (art. 26(2)). A data subject may nonetheless exercise their rights against each party (art. 26(3)); the party who receives a request informs the other without undue delay.
A4.6 Liability between the parties
Each party bears, between the parties, the share of any compensation that corresponds to its responsibility for the damage under A4.4 (art. 82(5)).