Data Processing Agreement

Effective date: 13 July 2026  ·  This DPA forms part of the Terms of Service.

1. Parties and roles

Controller: the Customer (the organisation or professional entering into the Terms of Service).

Processor: Column Seven (8 The Green, Ste B, Dover DE 19901, USA), operating the TeamOffice platform.

This DPA prevails over the Terms of Service for all data-protection matters.

2. Subject matter, duration, nature and purpose

• Subject matter: processing of Workspace Content — files, documents, drafts, deliberations, voice captures and transcripts, conversation history, collaborator details, and connected-app data.
• Duration: term of the Customer's subscription.
• Nature and purpose: storage, retrieval, display, AI-assisted analysis and generation, transcription, export, and integration actions — solely as initiated by the Customer in the app.
• Categories of data subjects: the Customer's personnel and collaborators; the Customer's clients; other individuals appearing in workspace materials.
• Categories of personal data: identity and contact data; matter-related information of any kind contained in documents. Workspace Content may include special-category data (Art. 9 GDPR), which is processed only as embedded in Customer content and never extracted or used independently.

3. Processor obligations (GDPR Art. 28(3)(a)–(h))

1. Documented instructions only. The Customer's in-app actions constitute the instructions. The Processor and its approved sub-processors do not use Workspace Content to train their own models, for product analytics on content, or for any independent purpose. This commitment does not govern providers the Customer selects using its own API keys.
2. Confidentiality. Processor personnel with access to Workspace Content are bound by confidentiality. Access is restricted to what service operation strictly requires. There is no routine human access to Workspace Content.
3. Security (Art. 32). See Annex II for technical and organisational measures.
4. Sub-processors. General written authorisation is given in advance (see Annex III). The Processor will notify the Customer at least 30 days before adding a material new sub-processor. The Customer may object; if the objection is unresolved within 30 days, the Customer may terminate without penalty.
   
   Customer-selected provider carve-out: an OpenRouter API key is required for AI features. Optional API keys for other supported providers may also be connected. Providers accessed using the Customer's own keys are the Customer's vendors, not the Processor's sub-processors, and are governed by the Customer's agreements with them.
5. Data-subject rights assistance. In-app search, export (full account export), and deletion let the Customer handle requests directly. Requests received directly by Processor are forwarded to the Customer promptly.
6. Breach notification. Processor will notify the Customer without undue delay, targeting 72 hours from awareness of a personal data breach, including the known scope and remediation status.
7. Deletion or return. Full self-service export is available at any time. Workspace Content is deleted within 30 days of account termination. Backups purge on a rolling 30-day cycle.
8. Audit. Processor will provide documentation (this DPA, security annex, sub-processor list) on request. On-site or technical audits may be arranged by agreement. A completed security questionnaire is available on request.

4. AI-specific terms

• The Processor and its approved sub-processors do not use Workspace Content to train their own models.
• Prompts and content are sent to AI providers to fulfil the Customer's request. Providers engaged under the Processor's own service agreements are subject to those agreements, including applicable restrictions on training.
• Customer-selected providers: requests routed using the required OpenRouter key or an optional direct-provider key are subject to that provider's own terms and policies, including data collection, retention, and model training. Those practices are controlled by the provider and are outside this DPA. The Customer is responsible for reviewing the provider's policies and determining whether they meet its obligations.
• AI output is generated content, not professional advice. The Customer is responsible for professional review (cross-reference Terms §2).

5. International transfers

Where Workspace Content is processed outside the EU/UK, the Processor relies on the Standard Contractual Clauses (EU Commission Decision 2021/914, Module 2) incorporated by reference, and the UK Addendum for UK customers. Sub-processors are bound to equivalent safeguards (see Annex III).

6. Liability

Each party's liability under this DPA is subject to the same aggregate cap as set out in the Terms of Service §10. This DPA does not increase aggregate liability. Nothing in this DPA excludes liability that cannot be excluded by applicable law.

7. Annexes

To request a countersignable PDF or a completed security questionnaire, contact privacy@teamoffice.ai.