Data Processing Agreement
Last updated: 23-Oct-2026
This Data Processing Agreement ("DPA") forms part of the Terms and Conditions ("Terms") between DoLoop GmbH, Französische Straße 47, 10117 Berlin, Germany ("DoLoop," "we," "us") and the customer that has accepted the Terms for business purposes ("Customer," "you"). It sets out the contract required by Article 28(3) of the General Data Protection Regulation (EU) 2016/679 ("GDPR") for personal data that DoLoop processes on the Customer's behalf. Terms defined in the GDPR have the same meaning in this DPA.
1. Scope and Roles
1.1 Customer as controller. The Customer is the controller of personal data contained in Customer Data: the content that the Customer and its users upload, enter, connect or generate in the Service, such as documents, chat content, notes, research briefings, recordings and the details of people named in them. DoLoop processes this personal data as the Customer's processor.
1.2 DoLoop as controller. DoLoop is the controller of the account, authentication and billing data of the Customer's users, of security logs and of Usage Data, which it processes as described in its Privacy Policy. This DPA does not apply to that processing.
1.3 Details. The subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
2. Conclusion and Precedence
2.1 This DPA is concluded when the Customer accepts the Terms for business purposes. No signature is required. A copy signed by DoLoop is available on request at info@doloop.cc.
2.2 If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.
3. Instructions
3.1 DoLoop processes the personal data only on the Customer's documented instructions, including with regard to transfers to third countries, unless Union or Member State law requires otherwise. In that case DoLoop informs the Customer of the legal requirement before processing, unless that law prohibits it.
3.2 The Terms, this DPA, and the Customer's use and configuration of the Service are the Customer's complete instructions. Further instructions must be given in text form. DoLoop may decline an instruction that goes beyond the functions of the Service.
3.3 DoLoop informs the Customer without undue delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law.
3.4 Web research and URL import. When a user requests market or competitive research, the Service sends the research query, including any briefing the user writes, to the web research provider listed under Independent Providers in the Sub-processor List. When a user imports a URL as a document, the Service sends the URL to the same provider, which retrieves the page. That provider processes the query, the URL and the retrieved page as an independent controller under its own terms. By using these features, the Customer instructs DoLoop to make this disclosure.
3.5 The Customer is responsible for the lawfulness of the personal data it brings into the Service, including its legal basis and the information it gives to data subjects.
4. Confidentiality
DoLoop ensures that every person it authorises to process the personal data is committed to confidentiality or is under an appropriate statutory obligation of confidentiality.
5. Security
DoLoop implements the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. DoLoop may change these measures as technology develops, provided the level of protection is not reduced.
6. Sub-processors
6.1 Authorisation. The Customer gives DoLoop general written authorisation to engage sub-processors. The sub-processors engaged at any time are those in the Sub-processor List (Annex 3).
6.2 Changes. DoLoop informs the Customer by email at least fourteen (14) days before a new sub-processor begins processing the Customer's personal data. Within that period the Customer may object on reasonable data protection grounds. The parties will then try in good faith to find a solution. If none is found, the Customer may terminate the affected Subscription with effect from the change, and DoLoop refunds prepaid fees for the unused term pro rata. Where an urgent replacement is needed to keep the Service secure or available, DoLoop informs the Customer without undue delay, and the Customer has the same right to object from that notice.
6.3 Obligations. DoLoop binds each sub-processor by contract to data protection obligations equivalent to those in this DPA, in particular sufficient guarantees of appropriate technical and organisational measures. DoLoop remains liable to the Customer for its sub-processors' performance of those obligations.
7. Transfers Outside the EEA
Where a sub-processor processes personal data outside the European Economic Area, the transfer is safeguarded by an adequacy decision, the EU–U.S. Data Privacy Framework where the sub-processor is certified, or the EU Standard Contractual Clauses in DoLoop's agreement with that sub-processor. A copy of the applicable safeguards is available on request at info@doloop.cc.
8. Assistance
8.1 Data subject requests. The Service lets the Customer access, correct, export and delete personal data. Where those functions are not sufficient, DoLoop assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. DoLoop forwards to the Customer without undue delay any such request it receives that relates to Customer Data and does not respond to it on its own.
8.2 Other obligations. Taking into account the nature of the processing and the information available to it, DoLoop assists the Customer in meeting its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).
9. Personal Data Breaches
9.1 DoLoop notifies the Customer without undue delay, and no later than forty-eight (48) hours after becoming aware of it, of any personal data breach affecting the Customer's personal data.
9.2 The notification describes, as far as known at the time, the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not yet available is provided as soon as it is.
9.3 DoLoop takes without undue delay the measures needed to contain the breach and mitigate its possible adverse effects.
10. Deletion and Return
10.1 During the term. Customer Data that the Customer deletes in the Service is removed from DoLoop's active systems within thirty (30) days.
10.2 At the end of the Service. Before the end of its Subscription the Customer can export its account data in the Service. On request, DoLoop also provides a copy of the Customer's Customer Data, including chat messages and files, in a common machine-readable format. After the end of the Service, or when the Customer deletes its account, DoLoop deletes the Customer's personal data from its active systems within thirty (30) days, unless Union or Member State law requires its storage.
10.3 Backups and sub-processors. Database backups are kept for thirty (30) days, so deleted data is removed from backups no later than thirty (30) days after its deletion from active systems. Copies held by sub-processors are deleted in line with their retention periods described in the Sub-processor List.
11. Information and Audits
11.1 DoLoop makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, in particular this DPA, its annexes and, on request, further documentation of its measures.
11.2 DoLoop allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates who is bound to confidentiality and is not a competitor of DoLoop. The Customer gives at least thirty (30) days' notice, and audits take place during business hours without disrupting operations. Audits are limited to one per twelve (12) months, unless a personal data breach or a supervisory authority's request gives reason for another. Each party bears its own costs.
12. Term, Liability and Law
12.1 This DPA applies for as long as DoLoop processes personal data on the Customer's behalf.
12.2 Liability is governed by the Terms. Article 82 GDPR remains unaffected.
12.3 This DPA is governed by the laws of the Federal Republic of Germany. The place of jurisdiction is Berlin, Germany.
Annex 1: Details of Processing
| Item | Description |
|---|---|
| Subject matter and purpose | Provision of the DoLoop Service under the Terms: developing, validating and executing business strategies with AI guidance, including document processing, transcription, research, collaboration and notifications |
| Nature of processing | Storage, organisation, retrieval, analysis by AI models, conversion, transcription, transmission to the Customer's users and to sub-processors, customer-instructed disclosure to the independent provider under §3.4, and deletion |
| Duration | The term of the Terms, plus the deletion periods in Section 10 |
| Types of personal data | Whatever personal data the Customer brings into Customer Data. Typically: names, contact and professional details, statements and opinions in documents, chats and notes, and voice and image in recordings |
| Categories of data subjects | The Customer's users, employees, customers and prospects, business partners, and other people named in Customer Data |
| Special categories | The Service is not designed for special categories of personal data (Article 9 GDPR) or data on criminal convictions (Article 10 GDPR). The Customer decides whether to bring such data into the Service and is responsible for its legal basis |
Annex 2: Technical and Organisational Measures
Hosting and physical security
- The Service's application servers, database, file storage and cache are hosted in Frankfurt, Germany, with providers that maintain independently audited security programmes. DoLoop operates no data centres or on-premises servers of its own.
Access to the Service
- Users sign in through a managed authentication service; sessions use signed, expiring tokens.
- Access to each account's data is checked on every request against that account's members and their roles (account owner, admin and member; venture admin, editor and viewer).
Support access by DoLoop staff
- Only named administrators can access a customer's workspace for support. Access requires multi-factor authentication and a stated reason, expires after at most fifteen minutes, and is recorded in the audit log together with any changes made.
- Staff accounts at infrastructure and service providers are protected by multi-factor authentication.
Separation
- Production, staging and development run in separate environments with separate databases, file storage, caches, workflow namespaces and credentials.
- Production personal data is not used in staging or development environments. Data copied from production for testing is anonymised first.
Transmission
- All connections are encrypted with TLS; browsers are required to use HTTPS (HSTS).
- File storage is private; files are delivered through signed, time-limited links.
Encryption at rest
- Stored files are encrypted with AES-256; the database is encrypted at rest by the database provider.
- Credentials for connected third-party accounts are additionally encrypted by the application.
Input control and logging
- Security- and privacy-relevant actions, such as sign-ins, exports, deletions and support access, are recorded in an audit log with actor, time and request details.
Availability and integrity
- Uploaded files are scanned for malware before they become available.
- Requests are rate-limited; uptime is monitored continuously.
- The database is backed up daily by the database provider; backups are kept for thirty days.
Secure development and operations
- Every change goes through a reviewed pull request with automated tests and static security analysis; static analysis also runs weekly across the code base.
- Dependencies receive automated security alerts and updates.
- Secrets are held in a dedicated secrets manager, never in code. Infrastructure is defined as code and changed only through reviewed, manually confirmed runs.
Incident response
- DoLoop maintains a procedure to revoke and rotate credentials after a suspected compromise, and notifies customers of personal data breaches as set out in Section 9.
Deletion
- Deleted accounts and ventures are purged from active systems within thirty days. Data exports are deleted automatically after one day; temporary conversion files within one day.
Organisation
- Everyone with access to personal data is bound to confidentiality in writing.
- Every sub-processor is bound by a data processing agreement; DoLoop keeps a register of its providers and reviews it at least every six months.
Annex 3: Sub-processors
The sub-processors authorised under Section 6 are those in the Sub-processor List, which is incorporated into this DPA by reference.
Contact
DoLoop GmbH
Französische Straße 47
10117 Berlin
Germany
Represented by the managing directors: Olaf Lenzmann, Oliver Eckart
Commercial register: Amtsgericht Charlottenburg, HRB 291197 B
Email: info@doloop.cc
This Data Processing Agreement is effective as of 23-Oct-2026.