Legal
Version v1.2 · Effective 15 September 2026 · Download PDF
Draft · pending legal review
This document is not yet in force. It is published for review and will be finalised on legal sign-off.
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Ergonomy Customer Agreement between Ergonomy Limited (company no. 17312959) ("Ergonomy", "Processor") and the Customer ("Controller"). It governs Ergonomy's processing of personal data on the Customer's behalf under UK GDPR and, where applicable, the EU GDPR.
For account and billing data, Ergonomy is the controller (see the Privacy Policy). For personal data processed through the Service on the Customer's behalf, the Customer is the controller and Ergonomy is the processor. This DPA concerns the latter.
Ergonomy processes personal data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law (in which case Ergonomy will inform the Customer, unless the law prohibits it). The Customer's instructions are set out in this DPA, the Ergonomy Customer Agreement, and the Customer's configuration and use of the Service. The Customer's choices of processing region, AI providers, and features, whether made at onboarding, through the Service's settings, or by written instruction, are documented instructions. Actions the Service takes within the permissions and approval settings the Customer has configured are processing on the Customer's documented instructions.
Where the Customer opts in through the Service's consent controls, that opt-in constitutes a documented instruction to process the relevant data for the stated improvement purpose. Absent such opt-in, Ergonomy uses only aggregated and de-identified data to improve the Service, as described in the Customer Agreement.
Ergonomy ensures that persons authorised to process the personal data (its employees and authorised contractors) are committed to confidentiality or are under an appropriate statutory obligation of confidentiality. Support access to a user's account is requested through the Service with a stated reason and period, takes place only with the approval of that user or a Customer administrator, can be declined or ended by them at any time, and is read-only and recorded in an audit log.
Ergonomy implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing (UK GDPR Article 32). These include a separate environment for each Customer, encryption of data in transit and at rest, access controls and least-privilege, approval gates on the actions the Service may take in connected tools, and keeping credentials and integration secrets out of AI model context. Further detail is on our security page and data-residency page.
5.1 General authorisation. The Customer provides a general authorisation for Ergonomy to engage sub-processors to provide the Service. The current sub-processors, with their purpose, location, and engagement basis, are listed on our sub-processor page.
5.2 Hosting and processing region. At onboarding the Customer selects a hosting region for its environment: the United Kingdom, the European Union, or the United States. Ergonomy hosts the Customer's environment, including its database, files and backups, in that region. Separately, the Customer's administrators choose in the Service's settings whether the Customer's AI model requests are kept to providers that process in the United Kingdom, kept to providers that process in the European Union, or may use the full set of default providers, including those that process in the United States. That choice can be changed at any time and applies to requests made after the change. Under the United Kingdom and European Union options, model requests go only to providers able to process in that region, as identified on the sub-processor page. Supporting processing (web search, embeddings for search, meeting transcription, dictation, spoken replies and internal summarisation) uses the providers marked default or feature-gated on the sub-processor page, some of which process in the United States, unless the Customer excludes them under clause 5.3, in which case the features that depend on them are unavailable.
5.3 Which providers are engaged. The Customer's administrators choose in the Service's settings which models, and so which AI model providers, its users may run and which model is the default; a provider whose models are not enabled there is not engaged for the Customer's model requests. The standard configuration enables models from some of those providers; the sub-processor page shows which. Those choices are documented instructions under clause 1. Supporting processing uses the vendors marked default or feature-gated on the sub-processor page; a feature-gated vendor receives data only while the Customer uses the named feature. Where the Service offers a choice of vendor for supporting processing (for example, the voice provider), the administrator makes it in the settings. Otherwise a Customer may exclude a vendor by written instruction to the contact in clause 14; Ergonomy applies an exclusion promptly, and in any event within ten business days, and tells the Customer which features, if any, become unavailable as a result.
5.4 Flow-down. Ergonomy imposes data-protection obligations on each sub-processor that are equivalent to those in this DPA and remains liable for their performance.
5.5 Changes. Before a new or replacement sub-processor processes Customer personal data, Ergonomy gives notice by adding it to the change log on the sub-processor page and by email to the Customer contacts who have subscribed to sub-processor notifications. The Customer may object on reasonable data-protection grounds within 30 days of the notice. The parties will discuss the objection in good faith; if it cannot be resolved, the Customer may terminate the affected part of the Service on notice, without any early-termination charge.
Taking into account the nature of the processing, Ergonomy assists the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights. Where an end user of the Customer contacts Ergonomy directly, Ergonomy will route the request to the Customer as controller.
Ergonomy assists the Customer in ensuring compliance with its obligations relating to security of processing, notification of personal data breaches, data protection impact assessments, and prior consultation with the supervisory authority. Ergonomy notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data. For the purposes of this clause, a personal data breach means a breach of Ergonomy's security measures leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer personal data in Ergonomy's possession or control. An action the Service takes within the permissions and approval settings the Customer has configured is not a breach by Ergonomy; where such an action causes personal data to reach someone it should not have, Ergonomy tells the Customer what it knows and assists the Customer under this clause. On request, Ergonomy provides a description of how the Service processes users' content, including the knowledge it derives from that content, to support the Customer's data protection impact assessment.
8.1 Dormant period. When the Customer's trial ends or the Customer Agreement terminates or expires, Ergonomy suspends the Customer's environment and holds it intact, read-only, for 90 days (the "dormant period"). No processing other than storage and backup takes place during the dormant period, and no AI provider or feature vendor receives Customer personal data. If the Customer resumes the Service within the dormant period, the environment is restored as it was.
8.2 Customer control. The Customer may at any time, by written instruction to the contact in clause 14, require earlier deletion or ask Ergonomy to extend the dormant period. An extension is a documented instruction to retain the data for the period requested.
8.3 Export. During the term, and throughout the dormant period, the Customer may request an export of its environment by written request to the contact in clause 14. Ergonomy provides it within ten business days as a machine-readable copy: a database export (a PostgreSQL dump, or JSON and CSV per table) covering conversations, workspaces, pages, datasets, meetings and transcripts, and organisational knowledge, together with every file in its original format, delivered encrypted by a time-limited secure download link or to cloud storage the Customer nominates. One export is included; further exports may incur a reasonable charge agreed in advance. Ergonomy reminds the Customer of this right when either party gives notice of termination.
8.4 Deletion. Fourteen days before the dormant period ends, Ergonomy emails the Customer's account contacts to say that deletion is due and to repeat the export offer. At the end of the dormant period Ergonomy deletes all Customer personal data and existing copies, unless the Customer has instructed otherwise under clause 8.2 or retention is required by law, and confirms deletion in writing on request. Copies held in backups are deleted when those backups expire on their normal cycle.
Ergonomy makes available to the Customer information necessary to demonstrate compliance with the obligations in this DPA and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable confidentiality and security safeguards.
Hosting, storage, and the Customer's database stay in the region selected under clause 5.2. AI model requests stay in that region where the Customer has selected the United Kingdom or European Union option under clause 5.2. Under the full-provider option, and for the search, embedding, and US-based speech providers on the sub-processor page, processing takes place in the United States, so it involves a transfer of personal data outside the UK and EEA. Each such transfer relies on an appropriate transfer mechanism in the sub-processor's data-processing terms: the EU Standard Contractual Clauses with the UK Addendum, the UK International Data Transfer Agreement (IDTA), or an adequacy decision. A Customer that requires processing to stay in the UK or the EU instructs Ergonomy under clause 5.3, and Ergonomy configures the Customer's environment accordingly. The sub-processor page states the data location for every vendor, and the data-residency page explains what is sent to an AI provider and what never is.
The following are not sub-processors of Ergonomy. They process personal data under the Customer's own arrangements with them, and the Customer is responsible for those arrangements:
Each party's liability arising under or in connection with this DPA is subject to the exclusions and limitations of liability in the Customer Agreement, except to the extent the law does not permit them to apply.
For questions about this DPA, to give a provider or region instruction under clause 5, or to exercise controller rights, contact us at legal@meetdavid.ai.