Legal
Version v1.5 · Effective 12 October 2026 · Download PDF
Draft · pending legal review
This document is not yet in force. It is published for review and will be finalised on legal sign-off.
This Data Processing Agreement ("DPA") forms part of the Ergonomy Customer Agreement between Ergonomy Limited (company no. 17312959) ("Ergonomy") and the Customer. It governs personal data processed through the David Service on the Customer's behalf. "Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR, in each case as amended. Terms such as controller, processor, personal data and personal data breach have the meanings given by that law.
Where the Customer determines the purposes and means of processing, it is the controller and Ergonomy is its processor. Where the Customer acts as a processor for another controller, Ergonomy acts as its sub-processor, and references to the Customer's instructions and rights are read accordingly. The Customer must have authority to appoint Ergonomy and to relay the relevant controller's lawful instructions.
Individual customers acting for business purposes may be controllers or processors. A customer acting solely for personal or household purposes is not required by this DPA to assume statutory controller obligations from which the law exempts them. Ergonomy remains responsible for its own obligations. The safeguards in this DPA apply contractually to personal data handled on that customer's behalf, so far as relevant, and do not restrict the customer's rights as a data subject. Actual controller and processor roles depend on the processing, not solely on these labels.
For account administration and billing data, Ergonomy acts as controller as described in its Privacy Policy. Any other processing for Ergonomy's own purposes must be separately identified in that policy with its purposes, lawful basis and applicable rights. Nothing in this DPA authorises undisclosed independent use of Customer personal data.
1.1 Ergonomy processes personal data only on the Customer's documented lawful instructions, including instructions concerning international transfers, unless processing is required by applicable law. Where legally permitted, Ergonomy informs the Customer of that requirement before processing. Instructions are set out in this DPA, the Customer Agreement and the Customer's authorised configuration and use of the Service, including provider, region and feature choices and written instructions.
1.2 An action correctly performed within the scope of permissions and approval settings configured by the Customer is carried out on its instruction. The existence of a permission does not authorise processing outside that instruction, override this DPA or remove Ergonomy's security, notification or other statutory obligations.
1.3 Ergonomy will immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law and will suspend the affected processing where necessary until the instruction is clarified or lawfully amended. The Customer is responsible, to the extent applicable to its role, for lawful instructions, required privacy information, lawful bases and any additional conditions for sensitive data.
2.1 Customer-specific feedback and improvements are processed only to provide and improve the Service for that Customer within its documented instructions. Any optional additional processing must be separately described, including its purpose, data, recipients and retention period, and enabled by an authorised person. A Customer instruction is not, by itself, consent from every individual whose personal data is involved.
2.2 Ergonomy will not use Customer Data to train AI models, and its AI model providers are bound by their terms not to use Customer Data supplied for the Service to train their models. Supporting providers (search, embeddings, classification and speech) are configured or contracted not to train on Customer Data where the provider offers that control; the sub-processor page shows each provider's status. This DPA does not authorise model training through an improvement opt-in. Any proposed change to the no-training commitment requires a separate express agreement and a valid legal basis, subject to applicable rights and the Customer Agreement.
2.3 For general service analytics and improvement, Ergonomy may use information that is genuinely anonymous so individuals are not identifiable by means reasonably likely to be used. Pseudonymised or merely de-identified data remains subject to this DPA while it is personal data. Processing undertaken to produce anonymous information must itself have a lawful basis and fall within authorised processing.
2.4 If Ergonomy determines an independent product-research purpose involving personal data, it must separately establish and disclose its role, legal basis, safeguards and rights. A processor instruction or an administrator's opt-in does not automatically make that processing lawful. Any identifiable individual usage research remains subject to the separate opt-in requirements in the Customer Agreement.
2.5 Optional monitoring. Where an authorised administrator enables the monitoring described in clause 10.2 of the Customer Agreement, that is a documented instruction to process identifiable usage information and conversation content for the purposes stated there, for the Customer's benefit. Ergonomy processes it as processor, limits access to personnel who need it, logs that access, retains identifiable material drawn from it for no longer than 90 days after review unless an incident or dispute requires longer, and applies general learning only in anonymous form under clause 2.3. Withdrawal stops further processing from that point. The Customer remains responsible for informing its users and for its lawful basis; Ergonomy provides a description of the monitoring for that purpose.
Ergonomy ensures that employees and authorised contractors processing personal data are committed to confidentiality or an appropriate statutory duty. Access is limited to what is necessary for authorised work. Support access to a user's account is requested through the Service with a stated reason and period, requires approval by that user or a Customer administrator, may be declined or ended by them, and is read-only and recorded in an audit log. Other operational access remains subject to this DPA and the Customer Agreement.
4.1 Ergonomy implements appropriate technical and organisational measures under Article 32, taking account of the state of the art, implementation costs, the processing and the risks to individuals. These include a separate environment for each Customer, encryption in transit and at rest, access controls and least privilege, approval gates for actions in connected tools, and keeping credentials and integration secrets out of AI model context. Further detail is on our security page and data-residency page.
4.2 Measures must also address ongoing confidentiality, integrity, availability and resilience, restoration following an incident, and regular testing and evaluation. Ergonomy will provide the Customer with a current description of relevant measures on request, including backup and recovery arrangements, access management and incident response. Updates must not materially reduce the overall protection of Customer personal data during the agreed processing period.
5.1 General authorisation. The Customer provides general written authorisation for the sub-processors identified on Ergonomy's sub-processor page, subject to this clause and its documented exclusions. The page identifies each sub-processor, its purpose, the data it receives, its processing location and its engagement basis, and is available before processing and on request; the transfer safeguards relied on for each are available on request under clause 11. Payment providers acting for Ergonomy's own controller purposes are identified as such.
5.2 Hosting and processing regions. The Customer's environment, including its database, files and backups, is hosted in the United Kingdom unless the Customer's order specifies the European Union or the United States. Separately, administrators select in the Service's settings whether AI model requests are processed in the United Kingdom, in the European Union, or through the full set of enabled providers. Changes apply to subsequent requests. The hosting region and the AI-processing setting are distinct.
5.3 Supporting processing and exclusions. Web search, embeddings, classification, transcription, dictation, spoken replies and internal summarisation use the supporting providers identified as default or feature-gated on the sub-processor page. Some may process in the United States even where a regional AI-model option is selected; these exceptions are disclosed there before the relevant processing is enabled. A feature-gated provider receives data only for the enabled feature. Administrators choose providers in settings where available; otherwise the Customer may exclude a provider by written instruction under clause 14. Ergonomy applies exclusions promptly and within ten business days and identifies affected features. If continued processing would breach an existing restriction or applicable law, it pauses immediately rather than continuing during that implementation period.
5.4 Enabled models and automatic switching. Administrators choose the enabled models and providers and the default model. Providers whose models are not enabled are not engaged for model requests. Any automatic model switching, including switching triggered by a low credit balance under the Customer Agreement, must respect enabled model and provider permissions, processing-region settings, vendor exclusions and this DPA. A low balance does not authorise another provider or processing location. If no eligible model can perform a task within these restrictions, the affected processing pauses. Existing permissions and approval controls remain in force after a switch.
5.5 Flow-down obligations. Ergonomy enters into binding written agreements imposing equivalent data-protection obligations on sub-processors and remains responsible to the Customer for their performance as required by Applicable Data Protection Law. Sub-processor processing remains limited to authorised purposes and the safeguards in this DPA.
5.6 Changes to sub-processors. Ergonomy gives at least 30 days' notice of a new or replacement sub-processor before it receives Customer personal data, stating its identity, purpose and location. Notice is given by adding the change to the change log on the sub-processor page and by email to the Customer's administrators and other contacts who have subscribed to updates as described there. Subscribing is open to any administrator or contact the Customer chooses. Where a sub-processor must be replaced urgently to protect the security, availability or lawful operation of the Service, Ergonomy may give shorter notice, as soon as reasonably practicable, and the objection period then runs from that notice. A provider listed on the sub-processor page that the Customer's administrators enable in the Service is engaged on the Customer's instruction under clause 1.1 and needs no further notice.
5.7 Objections. The Customer may object in writing on reasonable data-protection grounds within the notice period. The parties will discuss the objection in good faith, and Ergonomy may propose a reasonable alternative, such as a configuration of the Service that does not use the sub-processor for the Customer. If the objection is not resolved within 30 days of being made, the Customer may terminate the affected Service by written notice, without the notice period in clause 18.2 of the Customer Agreement or any early-termination charge. Ergonomy will refund prepaid subscription fees attributable to the period after termination and unused purchased credits attributable to the terminated Service; if the whole subscription ends, all unused purchased credits are refunded. These refunds override conflicting non-refund or forfeiture terms. Termination under this clause is the Customer's remedy for an unresolved objection.
5.8 Retention by AI providers. No AI provider engaged for the Customer may use Customer Data to train its models or for any purpose other than returning the response, detecting abuse and misuse, meeting its legal obligations and short-term caching that speeds up later requests. Ergonomy prefers providers that keep nothing once a response is returned. Some providers keep requests and responses for a limited period, up to 30 days, for those purposes, may review content their safety systems flag during that period, and then delete it. The sub-processor page states each provider's retention. Data a provider has de-identified or aggregated, so that it identifies neither the Customer nor any individual and is not re-identified, is outside this clause. Engaging a provider on terms that permit longer retention or any other use is a change notified under clause 5.6. If a provider changes its terms without that notice being possible, Ergonomy updates the sub-processor page and notifies subscribers promptly after becoming aware, and stops sending that provider Customer Data if the new terms permit training.
Taking account of the nature of processing, Ergonomy assists the Customer by appropriate technical and organisational measures, insofar as possible, in responding to data-subject requests. Requests relating to processing for which the Customer is controller are promptly forwarded to it, and Ergonomy does not respond substantively except on instruction or as legally required. Requests concerning Ergonomy's own controller processing are handled by Ergonomy. Requests from personal or household customers are handled according to the actual roles and applicable rights, rather than automatically redirected to the requester as controller.
7.1 Ergonomy assists the Customer with obligations concerning security, breach notification, data protection impact assessments and prior consultation, taking account of the processing and the information available to Ergonomy. On request, Ergonomy provides a description of how the Service processes users' content, including the knowledge it derives from that content and any optional monitoring enabled under clause 2.5, to support the Customer's data protection impact assessment.
7.2 A personal data breach has the meaning in Applicable Data Protection Law: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. It includes relevant incidents affecting Customer personal data at Ergonomy or its sub-processors. An incident is not excluded merely because the Service used a configured permission or approval.
7.3 Ergonomy notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, and in any event within 48 hours. Notification does not await a final investigation or a determination of fault. It includes, as available, the nature of the breach, the affected data and individuals and their approximate numbers, the likely consequences, the response and mitigation measures, and a contact for further information. Missing information is supplied in phases without undue further delay.
7.4 Ergonomy promptly investigates, contains and remedies the breach, preserves relevant evidence and records, and provides reasonable cooperation for the Customer's response. Notification and assistance do not constitute an admission of liability; responsibility is assessed separately under applicable law and the agreements. Ergonomy does not notify individuals or regulators on the Customer's behalf without instruction unless legally required and, where permitted, informs the Customer before doing so.
8.1 Dormant period. When a trial ends or the Customer Agreement terminates or expires, the environment is suspended and retained for 90 days, unless earlier return or deletion is instructed. During that period, processing is limited to secure storage and backup, security and integrity measures, instructed export or deletion, lawful retention and restoration requested by the Customer. Ordinary AI requests, automations and feature processing stop, and AI and feature providers receive no new Customer personal data. Existing provider-held copies remain subject to the applicable deletion duties.
8.2 Customer choice. The Customer may instruct return or deletion at any time by contacting Ergonomy under clause 14. Return does not authorise indefinite retention of remaining copies. The Customer may request a defined extension to the dormant period; any extension and related terms are recorded in writing. If the Service resumes during the dormant period, the environment is restored subject to the then-applicable subscription arrangements. Credits are handled under clause 15.3(g) of the Customer Agreement; retention of the environment does not by itself create free service access.
8.3 Export. During the term and the dormant period, Ergonomy supplies a requested export within ten business days: a machine-readable database export (a PostgreSQL dump, or JSON and CSV per table) covering conversations, workspaces and their structure, pages, datasets, meetings and transcripts, and organisational knowledge including worldview content, together with every file in its original format. Skills and automations created in the Customer's environment, and its worldview content, are included as readable definitions (text files a person or another system can read, such as Markdown, YAML or JSON). Delivery is encrypted, by a time-limited secure download or to storage the Customer nominates. The export on termination (requested once notice of termination is given by either party, or during the dormant period) is provided at no charge. Other exports during the term may incur a reasonable charge agreed in advance, without restricting mandatory rights. Ergonomy reminds the Customer of this right when notice of termination is given and again 14 days before scheduled deletion.
8.4 Deletion timetable. Following an instruction to delete, or the end of the dormant period, Ergonomy deletes the live environment (database, files, search index, working copies and the worldview repository) within 30 days and instructs relevant sub-processors to delete their copies without undue delay. Residual copies expire on fixed cycles: environment backups are kept for 30 days and previous versions of stored files for 90 days, so every residual copy is gone within 90 days after live deletion. Deletion is confirmed in writing on request.
8.5 Residual copies. Pending expiry, backups are protected, isolated from ordinary use and processed only for permitted recovery or legal retention. If a backup is restored, prior deletion instructions are reapplied before ordinary processing resumes. Legally required retention is limited to the relevant data and period, with access restricted; Ergonomy explains the basis and period where legally permitted. The Customer's choice of return or deletion remains subject only to lawful retention requirements.
8.6 If Ergonomy stops trading. If Ergonomy decides to cease trading or otherwise to stop providing the Service, it gives the notice in clause 18.3 of the Customer Agreement, supplies the export under clause 8.3 at no charge before the Service stops, and does not delete the Customer's environment until that export has been supplied or the Customer has declined it in writing. Ergonomy keeps a documented export procedure that can be carried out for every customer within that notice period. If Ergonomy enters administration or liquidation, it will ask the administrator or liquidator to supply the export on the same basis before the Service stops, and will give them that procedure.
Ergonomy makes available the information needed to demonstrate compliance with this DPA and allows and contributes to audits, including inspections, by the Customer or an auditor it mandates, subject to reasonable confidentiality and security safeguards that do not defeat statutory audit rights. Ergonomy first provides relevant documentation and independent reports where they exist; an inspection takes place where those do not reasonably answer the Customer's question. Unless a supervisory authority requires otherwise or an audit follows a personal data breach affecting the Customer, an inspection takes place no more than once in any twelve months, on at least 30 days' written notice, during business hours, at the Customer's cost, and without access to other customers' data or to information unrelated to the processing of Customer personal data. Ergonomy cooperates with competent supervisory authorities and promptly addresses identified deficiencies.
10.1 Subject matter and duration. Processing of Customer personal data for the Service during the Customer Agreement and the limited retention, return and deletion under clause 8. The Customer retains the rights to instruct, to obtain assistance and compliance information, to object to sub-processor changes and to choose return or deletion as described in this DPA.
10.2 Nature and purpose. Receiving, hosting, storing, retrieving, searching, organising, analysing, generating, transmitting and deleting data to automate tasks, capture knowledge and support decisions through the Customer's tools and channels; providing authorised recording, transcription, support and customer-specific improvements. General model training is excluded under clause 2.
10.3 Data subjects. Customers and individual account holders; their personnel and end users; people appearing in connected systems or content, including clients, contacts and correspondents; and meeting participants. Categories depend on the features and data the Customer chooses to use.
10.4 Data types. Identity and contact data; communications, documents and business or personal records; account, role, permission and usage data processed on the Customer's behalf, including administrator usage statistics; recordings, audio, transcripts and screenshots; generated content and derived organisational knowledge containing personal data; and, where enrolled, the voice templates described in clause 10.6. This description does not convert Ergonomy's independent account and billing processing into processor processing.
10.5 Sensitive data. The Service may encounter special-category or criminal-offence data in Customer content. The Customer, where subject to controller or processor duties, must establish the relevant lawful basis, additional conditions and safeguards before instructing such processing. Ergonomy complies with its own obligations and does not obtain unrestricted permission to process sensitive data merely because it is uploaded.
10.6 Speaker recognition. Where the Customer's users record meetings, the Service separates speakers within a transcript. A user may additionally enrol a speaker by name, which creates a voice template (a numerical summary of voice characteristics) held in the Customer's environment and used to recognise that speaker in that user's later recordings. Recognising an individual across recordings from a voice template is biometric processing and may be special-category processing under Article 9 where the legal definition is met; separating speakers within one transcript is not. Enrolment is available only to users the Customer permits to record meetings, and a user's enrolment is the Customer's documented instruction. Before its users enrol speakers, the Customer is responsible for informing the individuals concerned, for an Article 6 lawful basis and, where required, an Article 9 condition, and for any impact assessment; Ergonomy assists under clause 7.1.
10.7 Biometric safeguards. Voice templates are held only in the Customer's environment, are matched only against recordings made by the user who enrolled them, are never sent to an AI model provider, and are not used for any other purpose. A user may delete an enrolled speaker at any time, which deletes the template; templates are also deleted when that user is deleted and when the environment is deleted under clause 8. Templates are not otherwise time-limited. Speaker recognition is not offered to consumer accounts.
11.1 Hosting follows clause 5.2; AI requests follow the separately selected AI-processing setting; supporting processing follows clause 5.3. The sub-processor page identifies the applicable processing locations, including relevant overseas access, support, logging and onward processing. Regional hosting alone is not a guarantee that all processing occurs in that region.
11.2 Ergonomy makes restricted transfers only on documented instructions and with a valid mechanism under the applicable UK or EU rules. Depending on the transfer, this may be an applicable adequacy decision, the EU Standard Contractual Clauses using the appropriate module, those clauses with the UK Addendum, or the UK International Data Transfer Agreement. The instrument relied on must be validly executed and cover the actual parties, data and processing; a generic reference to a provider's terms is not sufficient.
11.3 Ergonomy undertakes and documents required transfer assessments, applies necessary supplementary safeguards and makes relevant information available to the Customer on request. It reviews material changes and suspends or replaces a transfer if lawful safeguards can no longer be maintained. Any adequacy decision or certification relied on must cover the recipient and processing concerned.
11.4 A Customer requiring all relevant processing to remain within the UK or the EU must give the instruction under clause 5 before the affected processing begins. Ergonomy will confirm the scope and configuration and disable any incompatible features. Model switching, low balances and payment arrangements do not override those instructions.
Connected tools and channels selected and separately contracted by the Customer, its identity providers and its appointed support partners may process data under the Customer's own arrangements. David accesses connected tools only within granted permissions. For third-party sign-in, it receives the identity assertion (identifier, verified email, name and avatar) and issues its own session. A support partner granted delegated access acts within the Customer's authorisation.
These parties are not treated as Ergonomy sub-processors merely because the Customer connects or authorises them. Classification depends on the actual processing: where Ergonomy engages a provider to process Customer personal data on its behalf, clause 5 applies regardless of its description as an integration, identity provider or partner. This clause does not exclude Ergonomy's obligations concerning its own disclosures or security.
13.1 Liability between the parties is subject to the Customer Agreement's applicable exclusions and limits only to the extent permitted by law. Nothing restricts data subjects' statutory rights, supervisory-authority powers or liability that cannot lawfully be excluded or limited. Ergonomy's obligations concerning sub-processors remain as set out in clause 5 and applicable law.
13.2 If this DPA conflicts with the Customer Agreement on the processing or protection of personal data, this DPA prevails. Mandatory transfer instruments prevail to the extent required by their terms. Clause 5.7 expressly prevails over conflicting cancellation, notice, refund and credit-forfeiture provisions.
13.3 This DPA continues while Ergonomy or its sub-processors retain Customer personal data, including after cancellation, non-payment, low-balance restriction or suspension. Confidentiality, security, assistance and deletion duties continue for that period. Contract updates follow the Customer Agreement's acceptance process and do not retrospectively authorise processing outside existing instructions.
For questions, documented instructions, provider or region exclusions, rights requests or privacy incident communications, contact legal@meetdavid.ai or Ergonomy Limited, 102 Crawford Street, London, England, W1H 2HR. The Customer must keep its designated account and privacy contact details current. Ergonomy sends notices under this DPA to that contact and copies them to any further contacts the Customer names.