01, Introduction

What this document is

This Data Processing Agreement (“DPA”) forms part of the service agreement between Dabster Labs (the “Processor”) and the client (the “Controller”). It governs the processing of personal data in connection with automation services provided by Dabster Labs, in accordance with Article 28 of the EU General Data Protection Regulation (GDPR).

02, Definitions

The legal terms

“Personal Data”, “Processing”, “Data Subject”, “Controller”, and “Processor” have the meanings given in the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

03, Scope of Processing

What we process, and why

Dabster Labs processes personal data solely on behalf of the Controller, for the purpose of delivering the automation services described in the Statement of Work.

Subject matter: automation, integration, and workflow services as defined in the Statement of Work.

Duration: the term of the service agreement, plus any post-termination retention required by law (see section 11).

Nature and purpose: automated processing of business data, integration between Controller’s systems, generation of reports, and ongoing service support.

Categories of Data Subjects: Controller’s employees, customers, prospects, and contacts as relevant to the automated workflows.

Categories of Personal Data: contact details (name, email, phone, role, company), CRM records, communication metadata, business documents, and any other data the Controller routes through the automation.

04, Obligations of the Processor

What we commit to

• Process personal data only on documented instructions from the Controller, except where required by EU or Member State law (in which case we will inform the Controller of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest).
• Ensure that persons authorized to process the data are bound by appropriate confidentiality obligations.
• Implement appropriate technical and organizational measures (encrypted transmission, access controls, least-privilege permissions, audit logging) to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.
• Assist the Controller, taking into account the nature of the processing, in fulfilling its obligation to respond to Data Subject requests (access, rectification, erasure, restriction, portability, objection).
• Assist the Controller in ensuring compliance with Articles 32-36 GDPR (security, breach notification, impact assessments, prior consultation).
• At the Controller’s choice, delete or return all personal data at the end of the service, and delete existing copies, unless EU or Member State law requires storage.
• Make available to the Controller all information necessary to demonstrate compliance with Article 28 obligations.
• Allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, with reasonable advance notice and at a frequency that does not unduly disrupt operations.
• Immediately inform the Controller if, in our opinion, an instruction infringes GDPR or other applicable data protection law.

05, Sub-Processors

Who else may be involved

The Controller hereby grants Dabster Labs general written authorization to engage sub-processors for the purposes set out in section 03, subject to the conditions below. Our current sub-processors include:

• Infrastructure provider (Germany, EU), the servers that run our own systems
• Website hosting provider (EU), hosting of this website
• Workflow automation engine (Germany, EU), self-hosted on our own infrastructure
• ElevenLabs (United States), voice assistant infrastructure, invoked only after Data Subject consent for voice. ElevenLabs, Inc. is an active certified participant in the EU-U.S. Data Privacy Framework, so the transfer is covered by the European Commission’s adequacy decision of 10 July 2023 under Article 45 GDPR. Its data processing addendum additionally incorporates the Standard Contractual Clauses of Commission Decision (EU) 2021/914 under Article 46(2)(c) as a fallback.

We will inform the Controller of any intended changes to this list (addition or replacement of sub-processors) with at least 30 days’ notice, giving the Controller the opportunity to object. If the Controller objects on reasonable data protection grounds, the parties will discuss in good faith, and if no resolution is reached, the Controller may terminate the affected service component.

All sub-processors are bound by written agreements imposing data protection obligations equivalent to those in this DPA.

06, International Transfers

Data across borders

Most processing occurs within the EU/EEA. Where personal data is transferred outside the EEA, currently only to ElevenLabs (United States) for the optional voice assistant, Dabster Labs ensures one of the following safeguards under GDPR Chapter V is in place:

• The European Commission’s adequacy decision of 10 July 2023 for the EU-U.S. Data Privacy Framework (Article 45 GDPR), which applies to ElevenLabs, Inc. as an active certified participant; or
• Standard Contractual Clauses (SCCs) under Article 46(2)(c); or
• For voice assistant data only: explicit consent from the Data Subject under Article 49(1)(a), captured before any transfer occurs.

07, Security Measures

How we protect data

In accordance with Article 32 GDPR, we implement the following technical and organizational measures:

• Encryption of data in transit (TLS 1.2+) and at rest where supported by the underlying infrastructure
• Role-based access controls, least-privilege permissions, and multi-factor authentication for administrative access
• Regular security reviews, dependency updates, and patch management
• Audit logging of administrative actions on Controller data
• Documented incident response procedures (see section 08)
• Background checks and confidentiality agreements for all personnel with access to Controller data
• Regular backup and verified restoration procedures

08, Data Breach Notification

If something goes wrong

In the event of a personal data breach affecting Controller data, Dabster Labs will:

• Notify the Controller without undue delay, and in any event within 48 hours of becoming aware of the breach.
• Provide the Controller with all available information needed to fulfill the Controller’s notification obligations under GDPR Articles 33 and 34, including: nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and measures taken or proposed.
• Cooperate fully with the Controller in investigating, mitigating, and remedying the breach.

Dabster Labs notifies its supervisory authority directly only where the breach affects data for which Dabster Labs is the Controller (e.g., its own employee or marketing data).

09, Data Subject Rights

Helping with requests

Where a Data Subject contacts Dabster Labs directly with a request to exercise their GDPR rights against the Controller’s data, we will forward the request to the Controller without undue delay and assist the Controller in responding within the deadlines required by GDPR (typically 30 days under Article 12(3)).

10, Audits and Inspections

Verifying compliance

The Controller has the right to audit Dabster Labs’ compliance with this DPA, either directly or through a third-party auditor. We will:

• Provide the Controller with copies of relevant security certifications, policies, and audit reports upon request.
• Permit on-site or remote inspections with at least 14 days’ written notice, to be conducted during normal business hours and in a manner that does not unduly disrupt operations.
• Cooperate fully with such inspections and provide reasonable access to relevant systems and personnel.

The Controller bears its own costs for audits unless an audit identifies material non-compliance, in which case Dabster Labs bears reasonable costs of remediation and re-audit.

11, Termination

When the engagement ends

Upon termination of the service agreement, the Controller will choose, in writing, whether Dabster Labs should return all personal data to the Controller or delete it. Dabster Labs will then return or delete the data, and all existing copies, within 30 days of receiving the instruction, except where EU or Member State law requires longer retention. Backups containing the data are overwritten in the normal backup-rotation cycle (typically within 90 days).

12, Contact

Data Protection Contact

Dabster Labs does not meet the thresholds for mandatory DPO appointment under Article 37 GDPR. The contact below handles all data protection inquiries.

For DPA-related inquiries: info@dabsterlabs-ai.cy

Dabster Labs, Nicosia, Cyprus