Data Processing Agreement
Version 1.0 · Last updated · 3 May 2026
This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the Terms of Service, Master Services Agreement, Order Form, or other applicable agreement (the “Agreement”) governing the Customer’s use of the Services provided by Uploaded Minds, Inc (“Uploaded Minds, Inc” or “Processor”) and the entity identified as Customer in the Agreement (“Customer” or “Controller”).
This DPA sets out the terms on which Uploaded Minds, Inc processes Personal Data on behalf of the Customer in connection with the Services, and satisfies the requirements of Article 28 of the GDPR and equivalent provisions of other Applicable Data Protection Laws.
In the event of conflict between this DPA and the Agreement, this DPA shall prevail with respect to data protection matters.
Acceptance
By creating a workspace, signing up for an account, clicking “Continue,” or otherwise accessing or using the Services, the Customer agrees to this DPA. The individual completing registration represents and warrants that they have authority to bind the Customer to this DPA. If an individual accepts this DPA on behalf of a company, organisation, or other legal entity, that individual represents and warrants that they have authority to bind that entity.
Effective Date: the date on which the Customer first creates a workspace, accepts the Terms of Service, or otherwise starts using the Services.
Section 1Definitions
Capitalised terms not defined in this DPA have the meaning given in the Agreement. In this DPA:
“Applicable Data Protection Law” means all applicable laws relating to the processing of Personal Data, including the GDPR, the UK GDPR, the CCPA/CPRA, the Swiss FADP, and any other applicable data protection legislation.
“Controller, Processor, Data Subject, Personal Data, Processing, Personal Data Breach” have the meanings given in the GDPR (or equivalent meanings under other Applicable Data Protection Laws).
“Customer” means the company, organisation, or other legal entity on whose behalf an account or workspace is created. If no such entity is identified, Customer means the individual who creates the account.
“End User Data” means Personal Data of End Users collected through the Services, including voice recordings, transcripts, behavioural data, email addresses, and interview metadata.
“GDPR” means Regulation (EU) 2016/679.
“SCCs” means the Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914.
“Sub-processor” means any third party engaged by Uploaded Minds, Inc to process Personal Data on behalf of the Customer.
Section 2Roles of the parties
2.1Customer as Controller
The Customer is the Controller of End User Data for the purposes of service delivery. The Customer determines the purposes and means of processing to the extent that Uploaded Minds, Inc processes End User Data to deliver the Services.
2.2Uploaded Minds, Inc as Processor
Uploaded Minds, Inc is the Processor of End User Data when processing such data on behalf of, and under the documented instructions of, the Customer for the purpose of providing the Services.
2.3Uploaded Minds, Inc as Independent Controller — Model Training
The parties acknowledge and agree that, with respect to the following processing activities, Uploaded Minds, Inc acts as an independent data controller (not a joint controller with the Customer):
- training, fine-tuning, validating, and improving Uploaded Minds, Inc’s proprietary AI models using anonymised and aggregated data;
- improving the quality, accuracy, and performance of the Services;
- developing new products, features, and services (including synthetic audience replicas);
- conducting internal research, benchmarking, and safety testing; and
- generating anonymised, aggregated statistical analyses and industry benchmarks.
For these purposes, Uploaded Minds, Inc relies on its own lawful bases: consent obtained directly from End Users via the End User Terms and the interview consent mechanism, and, for irreversibly anonymised data, the exemption under Recital 26 GDPR. The Customer acknowledges that these processing activities are not performed on behalf of the Customer, and the Customer has no right to instruct Uploaded Minds, Inc with respect to such processing.
Section 3Scope of processing
| Item | Description |
|---|---|
| Subject matter | Processing of End User Data in connection with AI-led behavioural research interview services. |
| Duration | Term of the Agreement plus any period required to complete return/deletion obligations. |
| Nature & purpose | Audio recording, transcription, AI-assisted qualitative analysis, behavioural insight generation, delivery of Deliverables to Customer. |
| Types of Personal Data | Email addresses, voice recordings, audio data, transcripts, behavioural insights, interview metadata, consent records, voice characteristics. |
| Data subjects | End Users (interview participants): individuals who are end users or customers of the Customer’s products or services. |
| Special categories | May include incidentally disclosed Art. 9 GDPR data (health, religious beliefs, etc.) voluntarily provided during interviews. Basis: explicit consent (Art. 9(2)(a)). |
Section 4Processor obligations
When processing Personal Data as Processor, Uploaded Minds, Inc shall:
- process Personal Data only on the Customer’s documented instructions, unless required by applicable law (in which case Uploaded Minds, Inc shall inform the Customer in advance, unless prohibited by law);
- ensure that persons authorised to process Personal Data are bound by confidentiality obligations;
- implement appropriate technical and organisational security measures (detailed in Annex C), including encryption in transit and at rest, access controls, and regular security testing;
- comply with the Sub-processor conditions in Section 6;
- assist the Customer, taking into account the nature of processing, in responding to Data Subject rights requests;
- assist the Customer in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIAs, and prior consultation);
- make available information necessary to demonstrate compliance with Article 28 GDPR and allow for audits, subject to Section 9.
Section 5Customer obligations
The Customer shall:
- ensure it has a lawful basis for processing and disclosing End User Data to Uploaded Minds, Inc;
- ensure that all communications to End Users regarding the Services accurately reflect Uploaded Minds, Inc’s actual data practices and do not make representations about data retention, deletion, or use that conflict with the Agreement, this DPA, or the Privacy Notice;
- notify Uploaded Minds, Inc promptly of any Data Subject requests relating to data processed by Uploaded Minds, Inc; and
- provide complete and accurate processing instructions.
Section 6Sub-processors
6.1General authorisation
The Customer grants Uploaded Minds, Inc general written authorisation to engage Sub-processors. The current list is set out in Annex B. Each Sub-processor is engaged under a written agreement imposing data protection obligations no less protective than this DPA.
6.2Notification of changes
Uploaded Minds, Inc shall notify the Customer of any intended addition or replacement of a Sub-processor. Notification shall include the name, location, and processing activities of the new Sub-processor.
Section 7International data transfers
Certain Sub-processors are located in the United States. The Customer authorises such transfers, subject to the following safeguards:
- EU SCCs: The 2021 SCCs (Module Two: Controller to Processor) are incorporated by reference. The Customer is the data exporter; Uploaded Minds, Inc is the data importer.
- UK Addendum: For UK transfers, the UK International Data Transfer Addendum to the EU SCCs applies.
- Swiss Addendum: For Swiss transfers, the SCCs apply with modifications required by the Swiss FADP.
- Data Privacy Framework: Where a Sub-processor is certified under the EU-US Data Privacy Framework, such certification may serve as a supplementary mechanism.
Section 8Data subject rights
Uploaded Minds, Inc obtains consent directly from End Users via the End User Terms and the interview consent mechanism. Data Subject rights requests may be directed to either party.
- If Uploaded Minds, Inc receives a request, it shall respond in its capacity as independent controller (for model training data) and promptly notify the Customer to the extent the request relates to the Customer’s processing.
- If the Customer receives a request, it shall promptly notify Uploaded Minds, Inc. Uploaded Minds, Inc shall assist the Customer in responding within the timeframes required by law.
Data that has been irreversibly anonymised and incorporated into aggregated datasets or trained models cannot be extracted or deleted, as it no longer constitutes Personal Data.
Section 10Personal data breach
Uploaded Minds, Inc shall notify the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach. The notification shall include:
- (a) the nature of the breach (categories and approximate number of affected Data Subjects and records);
- (b) the contact details of Uploaded Minds, Inc’s point of contact;
- (c) the likely consequences; and
- (d) measures taken or proposed to address and mitigate the breach.
Uploaded Minds, Inc shall cooperate with the Customer in investigating and mitigating the breach. Notification does not constitute an acknowledgment of fault.
Section 11Retention and deletion
11.1During the Agreement
Uploaded Minds, Inc retains Personal Data for as long as necessary to provide the Services.
11.2Upon termination
Upon termination, the Customer may request:
- (a) return of Personal Data in a commonly used, machine-readable format (e.g., CSV); or
- (b) deletion of Personal Data, with written certification.
Uploaded Minds, Inc shall complete the return or deletion within thirty (30) days.
11.3Exceptions
The deletion obligation does not apply to:
- (a) data that has been irreversibly anonymised and incorporated into Aggregated Data or Derived Models;
- (b) data required to be retained by applicable law;
- (c) consent records retained for compliance purposes; and
- (d) data processed by Uploaded Minds, Inc as independent controller under Section 2.3.
Section 12Liability
Each party’s liability under this DPA is subject to the limitations in the Agreement. Nothing in this DPA limits either party’s liability to Data Subjects under Applicable Data Protection Law.
Section 13Term
This DPA enters into force on the effective date of the Agreement and remains in effect for as long as Uploaded Minds, Inc processes Personal Data on behalf of the Customer.
Section 14General
Governing law
This DPA is governed by the law specified in the Agreement, without prejudice to mandatory provisions of Applicable Data Protection Law. The SCCs are governed as specified in Section 7.
Amendments
Uploaded Minds, Inc may update this DPA to reflect changes in law or processing practices, with at least thirty (30) days’ notice for material changes. Notice may be provided by email, through the Services, or by posting an updated version of this DPA on the dipio.ai website. Continued use of the Services after the effective date of an updated DPA constitutes acceptance of the updated terms.
Severability
If any provision is held invalid, it shall be modified to the minimum extent necessary.
Entire agreement
This DPA, together with the Agreement, constitutes the complete agreement regarding data processing.
Online acceptance
This DPA is accepted online via clickwrap. By creating a workspace, signing up for an account, clicking “Continue,” or otherwise accessing or using the Services, the Customer agrees to this DPA, and the individual completing registration represents and warrants that they have authority to bind the Customer. No physical signature is required.
Section AAnnex A · Processing description (SCCs Annex I)
A.1Parties
| Data Exporter (Controller) | Data Importer (Processor) | |
|---|---|---|
| Name | As provided during account registration, workspace creation, Order Form, or account settings. | Uploaded Minds, Inc |
| Address | As provided by Customer, if applicable. | Uploaded Minds, Inc 131 Continental Dr, Suite 305 Newark, DE 19713 United States |
| Contact | Account owner, workspace admin, billing contact, or other contact provided by Customer. | privacy@dipio.ai |
| Role | Controller | Processor / Independent Controller (Sec. 2.3) |
A.2Processing details
| Item | Description |
|---|---|
| Data subjects | End Users (interview participants) invited by the Customer. |
| Personal Data | Email, name (if provided), voice recordings, transcripts, behavioural insights, metadata, consent records, voice characteristics. |
| Sensitive data | Incidentally disclosed Art. 9 data. Basis: explicit consent (Art. 9(2)(a)). |
| Frequency | Continuous (each interview conducted). |
| Processing nature | Recording, storage, transcription, AI analysis, report generation, data access provision. |
| Purpose | Delivery of behavioural research services to the Customer or provision of other agreed services. |
| Retention | Duration of Agreement + 30 days for deletion. Anonymised data: indefinite. |
Section BAnnex B · Sub-processors (SCCs Annex III)
| Sub-processor | Processing activity | Location | Transfer mechanism |
|---|---|---|---|
| ElevenLabs, Inc. | AI voice agent: interview recording, storage, transcription. | USA | SCCs (Module 3) / EU-US DPF |
| OpenAI, LLC | LLM API: transcript analysis, insight generation. | USA | SCCs (Module 3) / EU-US DPF |
| Anthropic, PBC | LLM API: transcript analysis, insight generation. | USA | SCCs (Module 3) / EU-US DPF |
| Airtable, Inc. | Data storage, project management, transcript organisation. | USA | SCCs (Module 3) / EU-US DPF |
Incorporation
The Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021 (the “2021 SCCs”) are hereby incorporated in their entirety by reference. The full text is available in the Official Journal of the European Union (OJ L 199, 7.6.2021, p. 31–61) and at: eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Applicable module
Module Two (Controller to Processor) applies to all transfers of Personal Data from the Customer (Controller / Data Exporter) to Uploaded Minds, Inc (Processor / Data Importer) for the purpose of providing the Services under the Agreement.
Where Uploaded Minds, Inc engages Sub-processors located outside the EEA in countries without an adequacy decision, Module Three (Processor to Processor) of the 2021 SCCs shall apply to such onward transfers, with Uploaded Minds, Inc as data exporter and the Sub-processor as data importer.
Section CAnnex C · Technical & organisational measures (SCCs Annex II)
| Measure | Description |
|---|---|
| Encryption | Use secure encryption when data is being transferred, and strong encryption to protect data when it is stored. |
| Access controls | Role-based access; least privilege; MFA for admin access. |
| Confidentiality | Personnel bound by contractual confidentiality. Access limited to authorised staff. |
| Pseudonymisation | Direct identifiers removed for model training; data aggregated across projects. |
| Availability | Redundant cloud infrastructure; regular backups. |
| Incident response | Documented procedures; breach notification within 48 hours. |
| Sub-processor diligence | Security assessment prior to engagement; binding DPAs. |
| Data minimisation | Only necessary Personal Data collected and processed. |
| Testing | Regular review and testing of security measures. |