Data Processing Agreement

This Data Processing Agreement ("Agreement") is an integral part of the InsightBoard.io Privacy Policy and governs how personal data provided by Customer (the "Controller") to InsightBoard.io (the "Processor") is processed, secured, and shared.

1. Definitions

• "Agreement" means this Data Processing Agreement.
• "Controller" means the legal entity or individual subscribing to InsightBoard.io services.
• "Processor" means InsightBoard.io, a service operated by Volodymyr Sladkovskyi, an individual entrepreneur registered under the laws of Ukraine, Tax ID / EDRPOU: 3423906052, located at 3 Kadetskyi Hai Street, Kyiv, 03048, Ukraine.
• "Personal Data", "Processing", "Data Subject", etc., have the meanings given in GDPR Article 4.

2. Roles & Responsibilities

3. Subject Matter & Duration

4. Purpose & Legal Basis

5. Sub-processing

6. Security Measures

• 6.1 Processor implements appropriate technical and organizational measures (encryption, access controls, back-ups) to protect Personal Data.
• 6.2 Processor will notify Controller of any personal data breach within 72 hours of discovery.

7. Data Subject Rights

Processor shall assist Controller in responding to data subject requests (access, rectification, erasure, portability) within statutory deadlines.

8. Data Retention, Deletion & Return

Personal Data is retained for the duration of the Customer's subscription as necessary to provide the service. Upon termination, Processor will delete or return all Personal Data in its possession, and will likewise delete or anonymize Personal Data upon Controller's verified request, unless retention is required by law.

9. Liability

Each party's liability is limited in accordance with the Terms of Use and applicable law. Processor is not liable for Controller's misuse of insights, failure to comply with privacy laws, or any consequences arising from actions taken based on processed data.

Controller acknowledges that InsightBoard provides data processing services only and bears no responsibility for business decisions made using the processed data or insights.

10. Governing Law & Jurisdiction

This Agreement is governed by Ukrainian law. Disputes are subject to the exclusive jurisdiction of Kyiv courts.

Annex I — Description of Processing

• A. Categories of data subjects: (i) Controller's sales representatives and workspace users; (ii) Controller's CRM contacts (leads, customers) and other participants in recorded calls and meetings; (iii) recipients of summaries shared by Controller's users.
• B. Categories of personal data: names, email addresses, phone numbers, CRM identifiers and activity records; call recordings (which remain hosted in Controller's CRM); call and meeting transcripts; AI-generated evaluations, scores, summaries and insights; live voice audio during roleplay training sessions, together with a recording of the session stored by the Processor so Controller can review it for coaching; AI-assistant prompts and answers referencing workspace data; team membership and role data.
• C. Special categories of data: not intentionally processed. Controller shall not submit special-category data (GDPR Art. 9). Transcripts may incidentally contain information volunteered by call participants, for which Controller remains responsible under Section 2.2.
• D. Subject matter and duration: as set out in Section 3.
• E. Nature and purpose of processing: speech-to-text transcription; AI classification, evaluation, scoring and summarization of sales conversations; dashboards, benchmarks and coaching analytics; CRM synchronization and write-back; AI roleplay training; AI-assistant answers over workspace data; user-initiated sharing of summaries by email.
• F. Retention: as set out in Section 8 — for the duration of the subscription, then deletion or return.
• G. Sub-processors: as set out in Section 5 and the Sub-processor List.

Annex II — Technical & Organizational Measures

• 1. Encryption: all external traffic encrypted in transit (TLS); data encrypted at rest (AES-256) on the managed database; CRM access tokens additionally encrypted at application level (AES-256-GCM).
• 2. Confidentiality & access control: role-based access within each workspace; all data strictly scoped to the Controller's organization; least-privilege database roles; administrative actions recorded in an append-only internal audit trail.
• 3. Integrity & availability: continuous point-in-time-recovery backups of the primary database; primary data residency in the EU (Frankfurt, Germany) on infrastructure holding SOC 2, ISO 27001 and ISO 27701 attestations; queue-based processing with automatic retry and daily reconciliation for data completeness.
• 4. Application hardening: parameterized database queries throughout; per-IP and per-organization rate limiting; outbound-request safeguards; logging conventions that exclude secrets and credentials.
• 5. Data minimization: audio is buffered only transiently during transcription and then deleted; call recordings are never stored by the Processor (they remain hosted in Controller's CRM); the sole exception is AI roleplay training sessions, whose recordings are stored in an EU-jurisdiction bucket and reachable only through short-lived signed links; card data is never received.
• 6. Incident response: personal data breach notification to Controller within 72 hours of discovery (Section 6.2); measures reviewed regularly and on every change to processing.
• 7. Personnel & sub-processors: production data access restricted to the operator; all sub-processors bound by equivalent data protection obligations via DPAs (Section 5.2).