**Version 2026-10-21 — in force from 21 October 2026.**

# 1 Parties and application

This Data Processing Agreement (“DPA”) forms part of the agreement for Escalio services between:

- **Customer:** the organization or business customer, with its legal name, address and designated contact recorded in the accepted order or DPA acceptance record.
- **Escalio:** **Vladimir Kozak**, trading as Escalio, **Goethestrasse 2/1, 79576 Weil am Rhein, Germany**. Data protection contact: **support@escalio.org**.

This DPA applies when Escalio processes personal data on Customer’s behalf in providing the service (“Customer Personal Data”). It includes the annexes and is intended to meet Article 28 of Regulation (EU) 2016/679 (“GDPR”).

“Controller”, “processor”, “personal data”, “processing”, “personal data breach” and “supervisory authority” have their GDPR meanings. A “subprocessor” is a processor engaged by Escalio to process Customer Personal Data on Customer’s behalf.

Customer normally acts as controller and Escalio as processor. If Customer acts as processor for another controller, Escalio acts as its subprocessor and Customer must have authority to appoint Escalio and communicate the controller’s instructions. Contract labels do not override the parties’ actual roles.

Personal data processed by Escalio for its independently determined account-administration, billing, legal-compliance and own-support purposes is described in the Privacy Notice. This distinction does not permit reuse of ticket content, internal notes or other Customer Personal Data for unrelated purposes.

# 2 Instructions and responsibilities

Customer determines the purposes of processing and is responsible for the lawfulness of its collection, instructions, notices and disclosures. Customer must instruct only processing for which it has the necessary rights and lawful basis. Escalio remains responsible for its own obligations as processor.

The agreement, this DPA, accepted orders, authorized settings and actions, and verified written requests constitute Customer’s documented instructions. They include operating selected channels, imports, automations, exports and AI features within the agreed scope. Customer’s instructions do not authorize access to other customers’ data.

Escalio will process Customer Personal Data only on documented instructions, including instructions concerning international transfers, unless Union or Member State law to which Escalio is subject requires otherwise. In that case Escalio will inform Customer of the legal requirement before processing unless that law prohibits the information on important grounds of public interest.

Escalio will immediately inform Customer if, in its opinion, an instruction infringes GDPR or other applicable Union or Member State data protection provisions. Escalio may suspend the affected instruction while the parties resolve the issue, and will explain the suspension. It will not use this provision to avoid a lawful return, deletion or rights request.

Escalio will not sell Customer Personal Data, use it for advertising, or use it to train a general-purpose model on its own initiative. Ordinary processing of an AI request is distinct from optional setup-improvement activities described in section 5.

# 3 Authorized personnel and security

Escalio will ensure that people authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate instructions. Access will be limited to what their service, security, support or legal responsibilities require and removed when no longer required.

Escalio will implement and maintain appropriate technical and organizational measures under Article 32 GDPR, taking account of the nature and risks of processing, available technology and implementation costs. The agreed measures are described in Annex 2.

Escalio may update those measures as technology and threats change, provided the overall protection of Customer Personal Data is not materially reduced. A material reduction requires prior agreement or suspension of the affected processing. Neither hosting in the EU nor the measures in Annex 2 constitute a certification.

# 4 Subprocessors

Customer gives general written authorization for the subprocessors specifically identified in the completed Annex 3, only for the functions and processing described there. A provider’s mere technical availability in Escalio is not blanket authorization for it to receive Customer Personal Data.

Escalio will notify Customer’s designated contact at least 30 days before adding or replacing a subprocessor that will receive Customer Personal Data. Notice will identify the entity, function, processing location and applicable transfer safeguards. Customer may object on reasonable data protection grounds within that period.

The parties will seek a reasonable solution, such as an available alternative or disabling the affected optional function. Escalio will not send Customer Personal Data to the proposed subprocessor while a timely objection remains unresolved. If no reasonable solution is available, Customer may terminate the affected service before the change, and receive a refund of unused prepaid fees for it. Existing processing must still be handled under this DPA.

Before a subprocessor receives Customer Personal Data, Escalio will bind it to written data protection obligations that provide the protections required by Article 28, including appropriate security. Escalio remains responsible to Customer for the subprocessor’s performance of those obligations.

Customer-connected services are not automatically Escalio’s subprocessors. Their role depends on who appoints them, the applicable agreements and their actual processing. Customer authorizes only the transfers it instructs through those integrations; Escalio must still comply with its own processing and transfer obligations.

# 5 AI and optional setup improvement

For an enabled AI feature, processing may include the user’s message, conversation history, relevant ticket text and internal notes, and information retrieved through authorized tools. Only approved providers in Annex 3 may receive that data. Customer is responsible for deciding which AI functions and connectors its users may use and what data is appropriate for them.

The workspace-setup assistant is a separate function. When available, typed setup messages and relevant setup context are processed by Escalio’s configured setup provider even if the organization’s general AI setting is off. Provider fallback must remain within the authorized provider register and compatible safeguards; it cannot silently introduce an unauthorized provider or transfer.

Escalio does not claim that every AI request stays in the EEA or that all providers have zero retention. The actual provider, region, contractual use restrictions and retention arrangements must be recorded before the affected processing is authorized.

An owner or administrator can separately opt to share their own setup conversation for improving setup instructions and evaluating behavior. This choice is off by default. Acceptance of this DPA does not grant that permission. The separate notice must explain the purpose, people and providers involved, withdrawal and retention.

That choice cannot by itself establish a lawful basis for using another person’s data for Escalio’s own improvement purposes. Customer Personal Data must not be repurposed under this DPA. Any proposed processing for Escalio’s independent improvement purposes requires a separate, lawful and transparent arrangement, including a role assessment and any necessary customer authorization or individual consent.

# 6 Assistance with individuals’ rights

Taking account of the nature of processing, Escalio will assist Customer through appropriate technical and organizational measures to respond to requests for access, correction, erasure, restriction, portability, objection and other applicable rights.

Escalio will promptly forward a request concerning Customer Personal Data to Customer and will not decide it independently unless authorized or legally required. Escalio may verify routing and identity as necessary without disclosing another person’s information.

The service includes contact export and erasure functions, retention settings and organization export and deletion. These tools have documented scope limits. A contact search or ZIP export is not a representation that every occurrence of a person’s data in free text, a separate AI thread or an external system has been found. Escalio will reasonably assist with the additional searches, redactions, restrictions or return needed to fulfill a valid request.

Customer should notify Escalio in time to meet applicable deadlines. Escalio will provide assistance without undue delay and explain any practical constraint. Routine statutory assistance is included; exceptional work outside ordinary service scope may be priced by prior agreement, without obstructing the parties’ legal duties.

# 7 Security incidents and further assistance

Escalio will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It will use the designated incident contact or, if none is recorded, the organization’s owner contact.

The notice will include, as information becomes available, the nature of the breach, affected categories and approximate numbers of individuals and records, likely consequences, measures taken or proposed, and a contact for further information. Escalio may provide information in stages; it will not delay the initial notice until a full investigation is complete.

Escalio will take reasonable measures to contain and remedy the breach, preserve relevant evidence and cooperate with Customer. Notification does not determine liability. Customer is responsible for notifications it must make to individuals or authorities, with Escalio’s assistance, unless law places a separate duty directly on Escalio.

Taking account of the processing and information available, Escalio will assist Customer with its obligations under Articles 32 to 36 GDPR, including security, breach assessment and notification, data protection impact assessments and prior consultation with a supervisory authority.

# 8 Evidence and audits

Escalio will provide information reasonably necessary to demonstrate compliance with this DPA and Article 28 and will allow and contribute to audits and inspections by Customer or an independent auditor appointed by Customer.

The parties will first consider relevant documentation and remote review. Audits should use reasonable notice, confidentiality protections and proportionate safeguards for other customers and service security. Ordinarily one routine audit in a 12-month period is sufficient, but this does not limit additional justified audits after an incident, a material compliance concern or a supervisory authority’s request.

Scheduling, scope and any agreed reasonable costs must not make the audit right ineffective or prevent urgent or legally required action. Escalio will not be required to disclose another customer’s personal data, passwords or secret keys. Where possible it will provide alternative evidence that meets the audit purpose.

No SOC 2 report, ISO certificate or independent penetration-test report is promised unless it actually exists and is expressly identified.

# 9 Processing locations and transfers

The primary hosted application, database and file storage are in AWS Stockholm, Sweden. This does not mean that every integration, email delivery, provider support activity or AI processing occurs only in the EEA.

Escalio will not transfer Customer Personal Data outside the EEA, or permit access constituting such a transfer, except on documented instructions and with a valid Chapter V GDPR mechanism. The completed Annex 3 must identify applicable locations and safeguards.

Where required, the parties or relevant recipient will execute the applicable European Commission transfer clauses with the correct module, parties, annexes and choices, and assess the transfer and supplementary measures. A reference to “SCCs” alone is not a completed transfer agreement. These Article 28 terms are not themselves the Commission’s international-transfer SCCs.

If a safeguard becomes invalid or ineffective, Escalio will work with Customer to establish a lawful alternative and suspend the affected transfer where necessary. Mandatory transfer clauses take precedence over conflicting provisions of this DPA or the Terms.

# 10 Return and deletion

At the end of the relevant processing services, Customer chooses return or deletion of Customer Personal Data, unless Union or Member State law requires continued storage. Return includes reasonable assistance for data outside standard self-service exports. After a return, Escalio will delete remaining copies subject to the limited recovery and legal-retention arrangements in Annex 4.

The standard organization-closure flow allows owners 30 days to export data or cancel closure before erasure starts. Customer may instead give a verified instruction for earlier deletion. Escalio will confirm the scope and carry it out without undue delay; it will not insist on a 30-day cancellation period against a valid earlier instruction.

During a permitted recovery-retention period, copies remain protected, are not used for ordinary service or independent purposes and are removed under Annex 4. If recovery restores deleted data, applicable deletion and restriction instructions must be reapplied before the data is made available for ordinary use. Escalio will record and verify this step.

Any legally required continued storage will be limited to the data and purpose required by law, with access restricted and Customer informed where permitted. Escalio will provide written confirmation of completed deletion on request, identifying any remaining permitted copies and their basis and expiry criteria.

Customer remains responsible for copies in systems it controls. Escalio’s deletion duties extend to its own subprocessors and are not satisfied merely by telling Customer to contact them.

# 11 Duration and precedence

This DPA continues for as long as Escalio or its subprocessors hold Customer Personal Data on Customer’s behalf, including protected recovery copies. Duties that by their nature survive termination continue.

Changes to this DPA require the parties’ agreement, except the expressly authorized subprocessor procedure and security improvements that do not reduce protection. No commercial limitation restricts individuals’ statutory rights or supervisory authorities’ powers. The Terms govern other commercial matters where they do not conflict with this DPA or mandatory law.

# Annex 1 Processing description

| Item | Agreed scope |
| --- | --- |
| Subject matter | Hosting and operating Customer’s support workspace and the selected supporting functions. |
| Duration | The service period and the limited return, deletion and recovery period in Annex 4. |
| Nature of processing | Collection and receipt, recording, storage, organization, retrieval, consultation, transmission, analysis within authorized features, export, restriction and erasure. |
| Purposes | Managing support requests and customer communication; operating portals and chat; administering Customer’s staff access; authorized integrations, imports, automations, reporting, AI assistance and workspace setup. |
| Individuals | Customer’s end customers, contacts, prospective customers, staff, contractors and people whose information appears in Customer’s authorized communications. |
| Data categories | Names and contact details; organization and staff-role information; portal and channel identifiers; public wallet addresses where used; ticket text, internal notes and attachments; custom fields, tags, feedback and history; AI messages and tool results; integration and authentication metadata; related activity and security records. |
| Special categories | Not intentionally part of the standard service. Customer must arrange appropriate safeguards before intentionally submitting Article 9 or Article 10 data. If such data arrives unexpectedly, it remains protected and Customer should instruct its restriction or deletion. |
| Frequency | Ongoing while the service and selected functions are used; event-driven for messages, integrations, exports and deletion. |
| Customer instructions and contacts | Accepted agreement, authorized configuration and verified requests; legal name, address, authorized representative and a representative email recorded with acceptance; Customer may designate separate privacy/incident contacts through support. |
| Escalio contact | Vladimir Kozak, address above; support@escalio.org. |

# Annex 2 Technical and organizational measures

**Tenant and user boundaries.** The service checks organization membership and roles on the server. Tenant-owned records are scoped to the organization with database row-level controls and restricted application roles. Customer-portal sessions are separately bound to the portal host, organization and verified contact. Customer-facing functions distinguish public messages from internal notes.

**Authentication and credentials.** Passwords are stored as hashes. Session expiry and revocation, sign-in rate limits and multifactor authentication support access protection. Some sensitive administrative actions require fresh verification. MFA availability is not a claim that every user has enabled it. Integration credentials are protected separately and are not exposed through normal exports.

**Transmission and storage.** Public service connections use HTTPS. Primary RDS storage, private S3 storage and relevant recovery copies use encryption. Storage access is restricted; encryption is not a claim of end-to-end encryption or that Escalio can never access content.

**Operations and recovery.** Deployment checks cover tenant boundaries, relevant API behavior and recovery mechanisms. Web and mail tasks have separate permissions. Restricted operational logs and audit records support investigation. Backup recovery is subject to testing and the retention process in Annex 4. The database deployment does not provide a contractual high-availability guarantee.

**Files and integrations.** Access checks apply to files and separate internal and public content. File validation and outbound-request controls reduce risks. File validation is not a claim that every file has been antivirus-scanned.

**People and process.** Authorized access must have a documented business purpose, confidentiality obligations and appropriate instructions. Escalio must maintain rights-request, incident-response, subprocessor-review and deletion procedures sufficient to perform this DPA.

# Annex 3 Subprocessor register

Register reviewed on 20 October 2026. AWS is the primary infrastructure provider. OpenAI and Anthropic are the only Escalio-managed AI providers authorized under this register; Anthropic receives Customer Personal Data only once Escalio enables it. A provider is used for a particular organization only for the applicable feature and instructions; accepting this DPA does not turn on optional AI, connectors or model-training data sharing.

| Provider and standard EEA contracting entity | Processing and data | Location and safeguards |
| --- | --- | --- |
| Amazon Web Services EMEA SARL, Luxembourg | Hosting, PostgreSQL, object storage, recovery, monitoring and configured email; the customer content and related metadata necessary for these services. | Primary regional infrastructure verified in Stockholm, Sweden (`eu-north-1`). Global support, affiliates and email delivery can involve other countries. AWS's GDPR DPA is incorporated into its service terms and supplies transfer clauses where applicable. This is not an EU-only guarantee for every operation. |
| OpenAI Ireland Ltd., Ireland | API inference when the chosen feature uses OpenAI, including authorized setup assistance; relevant prompts, selected support context, tool results and outputs. | Standard API route; no verified European residency or zero-data-retention arrangement. Processing may occur in the US and other locations in the provider's register. The commercial DPA includes international-transfer safeguards. |
| Anthropic Ireland, Limited, Ireland | API inference when the chosen feature uses Anthropic, including authorized setup assistance; relevant prompts, selected support context, tool results and outputs. | Standard API route; no verified European residency or zero-data-retention arrangement. Processing may occur outside the EEA. The commercial terms incorporate a DPA with applicable transfer clauses. |

These legal entities follow the providers' standard terms for a customer established in Germany. Escalio maintains the applicable API or infrastructure account identity, terms version and any specific order or configuration in its supplier record. A change of contracting entity or processing arrangements is assessed under sections 4 and 9. Consumer chat subscriptions are not the API services listed here.

**AI retention and use.** OpenAI's standard API abuse-monitoring retention is up to 30 days, subject to documented exceptions; default API content is not used for training unless the account opts in. Anthropic's standard API inputs and outputs are normally removed within 30 days, with exceptions for law, safety, separately retained features and special agreements; some models require safety retention and review. Its published policy permits longer retention of flagged content (up to two years) and safety classifications (up to seven years). Commercial terms restrict model training on customer content. Escalio must not opt customer content into provider training. No zero-retention promise is made. The 30-day Escalio recovery-copy limit in Annex 4 does not overwrite provider safety or legal-retention exceptions.

**Customer-directed integrations.** Mailboxes, messaging platforms, customer-supplied AI keys, MCP servers and webhooks are assessed by the actual contract and data flow. Services independently appointed by Customer are Customer's recipients; if Escalio appoints a provider to process Customer Personal Data, it must be listed and covered under section 4. Merely entering one's own API key does not decide the legal role. Billing providers and providers used exclusively for Escalio's controller purposes are described in the Privacy Notice.

Provider references: [AWS GDPR DPA](https://docs.aws.amazon.com/whitepapers/latest/navigating-gdpr-compliance/aws-data-processing-addendum-dpa.html), [AWS contracting parties](https://aws.amazon.com/agreement/), [OpenAI DPA](https://openai.com/policies/data-processing-addendum/), [OpenAI data controls](https://developers.openai.com/api/docs/guides/your-data), [Anthropic commercial terms](https://www.anthropic.com/legal/commercial-terms), [Anthropic DPA](https://www.anthropic.com/legal/data-processing-addendum), [Anthropic commercial retention](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data).

# Annex 4 Retention return and deletion

| Category | Processing and deletion arrangement |
| --- | --- |
| Active Customer Content | Kept on Customer’s instructions. Closed-ticket and Deleted-folder retention periods are configurable and off by default; Customer should select periods appropriate to its purposes. |
| Individual erasure | Removes the data covered by the contact-erasure function and queues stored-file cleanup. Additional occurrences, including relevant free text and separate AI threads, require scoped assistance; the function is not a universal search. |
| Organization closure | Normal access closes when closure is requested. Owners have a standard 30-day cancellation/export period; earlier verified deletion can be instructed. Erasure then proceeds in bounded database and object-cleanup steps. |
| Primary database automated recovery | The documented automated recovery window is seven days. Access remains restricted and restoration must preserve deletion instructions. |
| Deleted or replaced file versions | No more than 30 days after a version is replaced or the active object is deleted. A daily cleanup begins at 28 days, preserving active files. This is measured from becoming noncurrent, not the original upload date. |
| Raw incoming email copies | All stored versions of raw email are removed within 30 days of receipt, with daily cleanup beginning at 28 days. The ticket generated from an email follows Customer's active-content settings. |
| Manual release snapshots and other recovery copies | Escalio-managed manual database snapshots and encrypted release recovery artifacts are removed within 30 days of creation; daily cleanup begins at 28 days. Unrecognized, locked, legacy or legally preserved copies require an explicit recorded disposition; they must not be ignored when checking this limit. |
| Legally required and compliance records | Retain only what is necessary for the applicable legal duty or documented compliance purpose, for its applicable period; not an entire customer database as an unrestricted legal archive. |
| External systems | Customer controls its own copies and connected accounts. Escalio instructs deletion in its own subprocessors as required by their binding agreements. |

The daily recovery cleanup runs at 04:00 UTC and starts removing eligible copies at 28 days, leaving time to address a failure before the 30-day limit. Errors, timeout risk and missing runs trigger operator alerts. Recovery of an isolated database and an earlier file version has been tested. An operational failure does not extend the agreed retention period. Any separately held recovery copy must be included in the same deletion instructions and inventory; moving a copy outside the automated cleanup does not exempt it.

**Restoration.** Recovery copies remain access-restricted and are not used for ordinary service. Before a restored system is connected to customers or starts outbound jobs, Escalio reapplies verified deletion, closure, retention and access-revocation instructions recorded after the recovery point. Recovery testing must include this check. If a preservation duty requires longer retention, Escalio records the legal basis, limited data, access restrictions and review/end date and informs Customer unless prohibited by law.