DPA — Data Processing Agreement

Who this is for

This document summarizes the terms of the Data Processing Agreement (DPA) that Enrosa offers to business customers acting as controllers towards their own participants.

Summary of terms (Art. 28 GDPR)

Enrosa acts as a processor for data handled on behalf of the customer: room metadata, generated captions and AI-generated minutes.

Retention: captions at most 24 hours after the event's last session ends; AI-generated minutes 30 days after the last session ends, then deleted by the daily cleanup within the following 24 hours; captions and minutes deleted at once if the customer deletes the event; room metadata 30 days after the last session ends.

Processing happens only on the customer's documented instructions, with confidentiality obligations for staff involved. The customer, as controller, informs speakers and participants that the event is automatically transcribed, translated and summarized by AI.

Enrosa applies appropriate technical and organizational security measures and notifies the customer of any personal data breach without undue delay.

Sub-processors: the up-to-date list is published on the Sub-processors page (for the minutes: OpenRouter with the listed model providers and Microsoft Azure, with zero data retention, and Cloudflare for the PDF); new sub-processors are notified in advance.

How to request it

To sign the full DPA, write to ciao@enrosa.live with your company name (to follow as the service provider).