Data processing agreement

• The controller: the business that creates an environment on ai-ai-ai.ai (hereinafter “the customer”), with the details provided at sign-up.
• The processor: AI-Studio, trading name of Contento GCV, company number BE 0715.660.258, with its registered office at Oude Leuvensestraat 77 box 3, 3300 Tienen, Belgium (hereinafter “AI-Studio”). Contact: hello@ai-studio.be.

This agreement forms part of the terms and conditions and is accepted at sign-up. In the event of conflict regarding the processing of personal data, this data processing agreement prevails.

AI-Studio processes personal data solely to deliver the aiaiai service: storing and analysing recordings of work processes, asking and processing follow-up questions (in the browser or by phone), and building procedures, a knowledge base and automation scores per process, including export.

The processing lasts for as long as the agreement is in force, and thereafter until the data has been deleted in accordance with article 10.

Data subjects: employees and other users of the customer, and people who can be seen or heard in recordings.

Personal data:

• identification and account data (name, email address, role, department);
• video and audio recordings (image, screen, voice) and whatever appears in them;
• answers to follow-up questions, typed or spoken, and phone conversations with Hannah;
• procedures, knowledge base items and validations in which an employee may be mentioned;
• consent times per recording and audit logs.

The service is not intended for special categories of personal data. Sensitive data that happens to appear on screen is not carried over into the output. The customer avoids such data being recorded knowingly.

• The customer determines the purpose and means of the processing and ensures a valid legal basis.
• The customer informs its employees in advance about the use of aiaiai and about their rights.
• The customer sets the retention period for raw videos (30 days by default, adjustable from 1 to 365 days).
• The customer does not use the service to assess or monitor individual employees.

• AI-Studio processes the personal data only on the documented instructions of the customer, as set out in this agreement and in the settings the customer chooses in the service, unless a legal obligation requires otherwise. In that case, it informs the customer in advance, unless the law prohibits this.
• AI-Studio immediately informs the customer if, in its opinion, an instruction infringes the GDPR.
• Persons at AI-Studio who have access to the data are bound by confidentiality.
• AI-Studio does not produce scores, rankings or analyses per employee; analyses are carried out per process only.
• AI-Studio does not use the customer's data for its own purposes. [To be checked: confirm that customer data is not used to train AI models, including by sub-processors.]

AI-Studio takes appropriate technical and organisational measures, including:

• strict separation of each customer environment in the database with row level security;
• hosting of the application on a dedicated server in the EU, and of the database and file storage at Supabase in the Frankfurt region (EU);
• explicit consent per recording, with the time logged;
• the option for an employee to delete a recording as long as the analysis has not started;
• automatic deletion of raw videos after the set retention period;
• temporary, short-lived download links for recordings;
• an audit log of exports, deletions and validations;
• [to be completed: additional measures, such as encryption, backup policy and access management at AI-Studio].

The customer gives AI-Studio general authorisation to engage the following sub-processors:

AI-Studio imposes on each sub-processor at least the same obligations as in this agreement and remains liable to the customer for their compliance. AI-Studio notifies administrators in advance of changes to the list of sub-processors; the customer may raise a reasoned objection within [period to be completed].

Where a sub-processor processes personal data outside the European Economic Area, AI-Studio ensures appropriate safeguards within the meaning of Chapter V of the GDPR. [To be completed: the safeguard applied for each sub-processor.]

• AI-Studio assists the customer, as far as reasonably possible, in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection). Administrators can export and delete all company data themselves. Requests that AI-Studio receives directly are forwarded to the customer.
• AI-Studio notifies the customer of a personal data breach without undue delay, and at the latest within [period to be completed] after becoming aware of it, with the information the customer needs for any notification to the supervisory authority or the data subjects.
• AI-Studio provides reasonable assistance with a data protection impact assessment and with a prior consultation of the supervisory authority.

Raw videos are deleted automatically after the retention period set by the customer. The structured output (procedures, knowledge base) is retained for as long as the customer does not delete it.

At the end of the agreement or when an administrator deletes the company, all of the customer's personal data is erased, unless the law requires it to be retained. Beforehand, the customer can export all company data. [To be completed: period for permanent deletion, including from backups.]

On request, AI-Studio makes available to the customer all information necessary to demonstrate compliance with this agreement, and cooperates with audits by the customer or by an auditor appointed by it who is bound by confidentiality. [To be completed: conditions such as notice period, frequency and costs.]

The liability of the parties is governed by the terms and conditions, without prejudice to the mandatory provisions of the GDPR. This agreement remains in force for as long as AI-Studio processes personal data on behalf of the customer.

This agreement is governed by Belgian law. Disputes fall under the exclusive jurisdiction of the courts of the judicial district of Leuven.