Data Processing Agreement (GDPR/DPA) — UwCopiloot

1. Roles

1. The client is the data controller.
2. UwCopiloot acts as processor where personal data is processed.

2. Purposes

UwCopiloot processes personal data solely for:

• scans
• analyses
• automation
• Workbench functionality
• reporting
• support
• implementations

3. Categories of data

Possible data includes:

• name
• email
• phone number
• calendar information
• CRM data
• documents
• operational business information
• communication data

4. Security

UwCopiloot implements appropriate measures including:

• access control
• roles and permissions
• logging
• encryption where appropriate
• restricted access
• secure cloud environments

5. Sub-processors

UwCopiloot may use sub-processors including:

• OpenAI
• Supabase
• HubSpot
• Google
• Microsoft
• MongoDB Atlas
• Render
• Vercel

6. Data breaches

1. UwCopiloot reports data breaches without undue delay.
2. The parties cooperate on statutory notification obligations.

7. Retention

Personal data is not retained longer than necessary.

8. Data subject rights

UwCopiloot supports the client with GDPR data subject requests.