1. Parties and roles
This data processing agreement belongs to the agreement between the organisation that uses BrainPen Meet (the controller, "the organisation") and O&R Solutions B.V., Swammerdamstraat 1, 2516 GJ Den Haag, Chamber of Commerce 66375940 (the processor, "we"). It gives effect to Article 28 of the GDPR.
This page summarises the terms. The organisation can request a signed version at info@brainpen.ai. Where this summary and the signed version differ, the signed version prevails.
2. Subject, nature and purpose
We process personal data to provide BrainPen Meet: recording, transcribing and translating conversations live, drafting reports, forms and tasks with AI, and storing templates and documents and making them searchable. We process the data for as long as the agreement runs, and afterwards only to return or delete it.
| Item | Content |
|---|---|
| Data subjects | Staff and users of the organisation, and the people they talk to, such as clients, patients, relatives, customers and other participants in conversations |
| Types of data | Identification and contact details, audio and video of conversations, transcripts, translations, reports, forms, tasks, documents, and usage and audit data |
| Special categories | Conversations can contain health data and other special categories of personal data, and the Dutch citizen service number (BSN). The organisation ensures a valid legal basis. |
3. What we commit to as processor
- We process the data only on the organisation's documented instructions, including for transfers outside the EU. If we believe an instruction breaks the law, we say so straight away.
- Everyone at our company who works with the data is bound by confidentiality.
- We take appropriate technical and organisational measures under Article 32 GDPR, including encrypted connections, access per organisation and role, two-step verification, an audit log that can only be added to, and hosting in the Netherlands.
- We never use the data for our own purposes and never to train AI models.
- We help the organisation with requests from data subjects, such as access, rectification, erasure and portability. The organisation can do much of this itself in the app, such as exporting and deleting.
- We help the organisation with a data protection impact assessment (DPIA) and with prior consultation of the supervisory authority, using the information we have.
- We keep a record of the processing we carry out for the organisation.
4. Sub-processors
The organisation gives general authorisation for the sub-processors below. We impose the same obligations on them as in this agreement and remain responsible for their work.
| Sub-processor | Task | Location |
|---|---|---|
| Worldstream | Hosting of servers, database and storage | The Netherlands |
| Mistral AI | Transcription, AI reports and forms, text recognition and search in documents | European Union (France) |
| Soniox | Live speech recognition, live translation and spoken translation | European Union (EU servers) |
| Google (Firebase) | Push notifications in the app, Sign in with Google | United States and EU |
| Apple | Push notifications and incoming calls on iPhone, Sign in with Apple | United States and EU |
| Stripe | Online payments, if the organisation pays that way | Ireland and United States |
| Hostinger | Sending e-mail, such as sign-in codes and invitations | Germany |
Conversation content is stored in the Netherlands and processed by AI in the EU. Push notifications contain no conversation content. Transfers to the United States rely on the EU-US Data Privacy Framework or the standard contractual clauses.
We announce a new or replacement sub-processor at least 30 days in advance. Within that period, the organisation can object on reasonable grounds. If we cannot resolve it together, the organisation may end the agreement for the part the change affects.
5. Data breaches
If we discover a security breach affecting the organisation's personal data, we report it without undue delay, and no later than 24 hours after we discovered it, to the contact person the organisation has named.
We share what we know about the nature of the breach, the data and people affected, the likely consequences and the measures we are taking, and add to it as we learn more. This lets the organisation notify the supervisory authority within 72 hours and inform the people affected where needed.
6. Verification and audit
We give the organisation all the information needed to show that we meet these commitments. Once a year, or after a data breach, the organisation may have an audit carried out by an independent expert bound by confidentiality, with at least 30 days' notice. We cooperate with it. The organisation bears the cost, unless the audit shows we do not meet these commitments.
7. End of the agreement
Before the end, the organisation can export all its data itself in a common format. We then delete the workspace with all its conversations, documents and files after a 30-day cooling-off period. Data in backups disappears when those backups are overwritten on the fixed schedule.
We only keep what the law requires us to keep, such as invoice records. On request, we confirm in writing that the data has been deleted.
8. Liability and term
Liability follows the main agreement or our terms of use, except where the GDPR provides otherwise. This data processing agreement runs for as long as we process personal data for the organisation. It is governed by Dutch law.
9. Contact
Questions about this agreement, or a signed version: info@brainpen.ai.