Data Processing Agreement (DPA)

Summary

This Data Processing Agreement governs the processing of personal data by aurenote on behalf of business customers under Art. 9 FADP and Art. 28 GDPR. It applies to all Team, Business and Enterprise plans.

1. Parties

Processor:
Recica Solutions
Sole proprietorship · Owner: Donat Recica
Zollstrasse 6, 8212 Neuhausen am Rheinfall, Schweiz
info@recica-solutions.ch

Controller: You, or the legal entity that uses aurenote under a Team, Business or Enterprise plan.

2. Subject and purpose

The processor processes personal data exclusively for the purpose of providing the aurenote service:

Storage and display of notes, meetings, transcripts and summaries
Automatic transcription and AI-supported summarisation of online meetings
Management of workspace members and their permissions
Provision of audit logs and compliance features

3. Duration

This DPA applies for the term of the main contract (plan) and beyond until all processed data has been fully deleted (at the latest 30 days after the end of the contract).

4. Scope of processing

Data categories

Identification data (names, email addresses, roles)
Content data (notes, transcripts, audio recordings, summaries)
Metadata (creation time, edit history, activity logs)
Technical data (IP addresses, access, audit events)

Data subjects

Workspace members (customer's staff)
External meeting participants (where recording takes place)

5. Obligations of the processor

The processor undertakes to:

process data exclusively according to documented instructions of the controller
bind all staff to confidentiality
implement appropriate technical and organisational measures (see section 6)
support the controller in fulfilling data subjects' rights of access, rectification and deletion
notify data breaches without undue delay (within 72 hours)
allow audits and inspections by the controller upon request

6. Technical and organisational measures (TOM)

The processor implements, among others, the following measures:

Encryption: TLS 1.2 and 1.3 in transit; transcripts, summaries and the access tokens of connected calendars additionally encrypted at field level with AES-256-GCM; backups encrypted with AES-256 (restic)
Access control: two-factor sign-in mandatory for the provider's access and available for all customer accounts; passwords stored only as scrypt hashes; the provider's admin console shows no customer content
Hosting: ISO 27001-certified Infomaniak data centres in Geneva (Switzerland)
Backup: daily, encrypted (restic, AES-256), at Infomaniak's Swiss Backup in Switzerland, 30-day retention
Monitoring: audit logs of all administrative access, automatic anomaly detection

7. Sub-processors

An up-to-date list of all sub-processors is available at Sub-processors.

8. Third-country transfers

Data is primarily processed in Switzerland (Infomaniak, Geneva). Where sub-processors abroad are used (e.g. EU or USA), data transfers take place on the basis of Standard Contractual Clauses (SCC) and additional safeguards where necessary.

9. Liability

The liability of the processor follows the Terms of the main contract and is limited to the annual amount paid by the customer.

10. Termination

Upon termination of the main contract all customer data is deleted within 30 days, unless statutory retention obligations apply. An export is performed beforehand on request.

11. Binding agreement

As a business customer on a Team, Business or Enterprise plan you accept this DPA when you first sign in. If the plan was booked via the Stripe checkout, the DPA has applied since the booking. For individually tailored DPAs (e.g. with negotiation points or company-specific clauses) please contact us.

Request individual DPA →