Data processing agreement

Draft 0.1 · October 28, 2026

This agreement governs the processing of personal data that skyseat carries out on behalf of the Customer when providing the service, in accordance with Art. 28 of the General Data Protection Regulation (GDPR) and Art. 33 of Spanish Organic Law 3/2018 (LOPDGDD). It forms part of the terms of service and is accepted along with them.

1. Parties

Controller	The Customer: the business or professional that subscribes to skyseat, identified in its account.
Processor	[COMPANY NAME], tax ID [TAX ID], [REGISTERED ADDRESS]. Contact: [PRIVACY EMAIL].

If the Customer is an agency that uses skyseat for its own clients, the agency acts as their processor and skyseat as its subprocessor; the agency undertakes to pass these same terms on in its contracts.

2. Subject matter and duration

skyseat will process the data described in Annex I only to provide the subscribed service and for the duration of the contract. When it ends, section 10 applies.

3. Customer instructions

skyseat processes the data only on the Customer’s documented instructions. Documented instructions are this agreement, the dashboard configuration (rules, permissions, autonomy level, connected accounts, company handbook) and what the Customer’s authorized people assign to its AI employees, which is recorded in the Activity log.

If skyseat considers that an instruction infringes the GDPR or other data protection law, it will inform the Customer immediately. If a law requires skyseat to process the data in another way, it will tell the Customer beforehand unless that law prohibits it.

4. Confidentiality

People working for skyseat who have access to the data are bound by confidentiality, including after their relationship ends. They only access it when needed to provide the service, resolve an issue the Customer asks about or comply with the law.

5. Security

skyseat applies the technical and organizational measures in Annex II, appropriate to the risk (GDPR Art. 32), and reviews them periodically. It may improve them as long as they do not reduce the level of protection.

6. Subprocessors

• The Customer gives general authorization for skyseat to use the subprocessors in Annex III, published and kept up to date at subprocessors.
• skyseat will give at least 30 days’ notice of any new or changed subprocessor. The Customer may object on reasonable data protection grounds; if no solution is found, it may terminate the contract without penalty before the change applies.
• skyseat imposes on each subprocessor, by contract, data protection obligations equivalent to these and is liable to the Customer for their compliance.

7. International transfers

The data is hosted in the European Union. Some subprocessors (Annex III) process it in the United States: it is only transferred with a safeguard under Chapter V of the GDPR (the adequacy decision for the EU‑U.S. Data Privacy Framework or the standard contractual clauses of Decision 2021/914) and only what is needed for the task.

8. Assistance to the Customer

• Data subject rights: the dashboard lets the Customer view, export, correct and delete data (data downloads, deletion of calls, accounts and the company). If a data subject contacts skyseat, we will pass the request on to the Customer without delay and without answering it ourselves.
• Impact assessments and prior consultations (GDPR Arts. 35 and 36): we will provide the reasonable information we have.
• Information and audits: we will make available the information needed to demonstrate that we comply with this agreement and allow reasonable audits, with 30 days’ notice, at most once a year except in case of a breach or a request from an authority, and without access to other customers’ data.

9. Security breaches

skyseat will notify the Customer, without undue delay and in any case within 48 hours of becoming aware of it, of any security breach affecting its data, with the information under GDPR Art. 33(3) available at that time (what happened, data and people affected, likely consequences and measures taken), and will help it notify the authority and those affected if necessary. Notifying the Customer does not constitute an admission of fault.

10. When the contract ends

Before it ends, the Customer can download its data from the dashboard (company ZIP). When the cancellation takes effect (30 days after it is requested, unless withdrawn), skyseat deletes the Customer’s data: employees and their computers, tasks, memory, rules, connected accounts, phone and log. Backups are deleted within the following 14 days. Only what a law requires to be kept will be retained, blocked.

11. Customer obligations

• Have a legal basis for the processing it assigns and have informed the data subjects, including that some tasks are done by an AI and, on the phone, that the call is recorded.
• Not assign special categories of data (GDPR Art. 9), criminal data or data of minors without prior written agreement with skyseat.
• Configure permissions, accounts and autonomy levels proportionately and supervise its AI employees.
• If the AI employees work with data about the Customer’s staff, respect their digital rights (LOPDGDD, Arts. 87 to 91) and not use them to monitor staff beyond what is proportionate.

12. Liability

The liability regime of the terms of service applies, without prejudice to GDPR Art. 82 with respect to data subjects.

Annex I · Description of the processing

Nature and purpose	Hosting and running the Customer’s AI employees (their cloud computer, their tasks and their memory); sending the AI model what is needed for each task; handling and making calls and transcribing them; storing the keys for connected accounts; logging activity; sending notifications; backups and support.
Categories of data subjects	The Customer’s users; the Customer’s staff, customers, suppliers and contacts; people who call or receive calls from its AI employees; people whose data appears in the documents, emails and systems the Customer gives access to.
Types of data	Identification and contact data (name, email, phone, address); content of emails, messages, documents and tasks; business data (orders, invoices, quotes); voice during calls, their transcripts and summaries; screenshots of the employee’s computer; credentials for connected accounts (encrypted); activity log.
Special categories	Not expected. Only with prior written agreement.
Frequency	Continuous, for the duration of the contract.
Retention	For the duration of the contract, unless the Customer deletes it earlier. Calls: 90 days by default. IP addresses: 6 months. Backups: 14 days.

Annex II · Security measures

• Location: the platform and the AI employees’ computers in Hetzner data centers in the EU (Germany and Finland).
• Encryption: all connections over HTTPS (TLS); keys and passwords for connected accounts encrypted with AES‑256‑GCM and the key stored outside the database; mobile notifications end-to-end encrypted (RFC 8291).
• Access: user passwords stored as scrypt hashes; sessions with an HttpOnly cookie that expire; roles per company (Admin, Manager, View only); each company only sees its own data.
• Servers: firewall, administrative access only with an SSH key and from an authorized origin, no passwords.
• Log: what people and AI employees do is recorded in a log that cannot be modified, with date, time and origin.
• Control of AI employees: autonomy levels, human approval of what matters, spending and operation caps, and the ability to take control of their computer.
• Passwords and codes: they never go through the conversation or the Activity log; verification codes are used once and not stored.
• Backups: daily database backup, kept for 14 days.
• Minimization: IP addresses deleted after 6 months; expired sessions and links purged; ElevenLabs deletes each call as soon as the platform has saved it.
• Deployments: no change reaches production without review and approval by a person; if it fails, it automatically rolls back to the previous version.
• [Complete with legal counsel: business continuity plan, staff training, periodic review of measures]

Annex III · Subprocessors

The current list, with what each one does, where and with what safeguard, is at subprocessors.

Other documents: Privacy policy · Terms of service · Subprocessors · Legal notice · Cookie policy · All