Data Processing Agreement (DPA)

This Data Processing Agreement (the "Agreement") is entered into between

Controller (the customer):

__________________________ (name)
__________________________ (company reg. no.)
__________________________ (address)
__________________________ (contact / email)

(hereinafter the "Controller")

and

Processor:

Oscar Hangaard
Vilkestrupvej 1
4623 Lille Skensved
Denmark
Contact: kontakt@zolva.io

(hereinafter the "Processor" or "Zolva")

Together, the "Parties".

Effective date: ______________ (to be completed on signature)
Template version last updated: 8 June 2026

1. Background and purpose

The Controller has entered into an agreement with the Processor regarding the provision of Zolva — a personal AI assistant for email, calendar, and reminders ("the Main Agreement"). In connection with the provision of the service, the Processor processes personal data on behalf of the Controller.

The purpose of the Agreement is to establish the obligations of the Processor under Article 28 of Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and under Danish data protection law.

The Agreement takes precedence over conflicting provisions in the Main Agreement or any other agreements between the Parties, insofar as the processing of personal data is concerned.

2. Definitions

The terms "personal data", "processing", "controller", "processor", "data subjects", "personal data breach" etc. have the same meaning as in Article 4 of the GDPR.

3. Subject, duration, and nature of processing

The subject, duration, nature, purpose, categories of data subjects and types of personal data are set out in Annex A.

4. Controller's rights and obligations

The Controller is responsible vis-à-vis data subjects for the Processor's processing of personal data and determines the purposes and means. The Controller has the right and obligation to set out the instructions according to which the Processor may carry out processing.

The Controller warrants that there is a lawful basis for processing under Article 6 of the GDPR (and Article 9, where relevant), and that data subjects have been informed in accordance with Articles 13–14 of the GDPR.

5. Processor acts on instructions

The Processor shall process personal data only on documented instructions from the Controller — including with regard to transfers to third countries — unless required to do so by EU law or Danish law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Instructions from the Controller are given through (i) use of the Service in accordance with the documentation, (ii) settings chosen by the Controller in the app or through administrative interfaces, and (iii) written requests to kontakt@zolva.io.

The Processor shall immediately inform the Controller if, in the Processor's opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions.

6. Confidentiality

The Processor shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to data is limited to personnel whose function requires it.

7. Security of processing

The Processor shall take all measures required pursuant to Article 32 of the GDPR, taking into account the state of the art, the costs of implementation, and the risks to the data subjects. The measures implemented by the Processor are described in Annex C.

The Processor shall continuously inform the Controller of material changes to the measures. The Controller cannot claim lack of knowledge of changes if the Processor has communicated them through the usual channels.

8. Use of sub-processors

The Processor may use the sub-processors listed in Annex B. The Controller hereby gives the Processor general prior authorization to use them.

When adding or replacing sub-processors, the Processor shall notify the Controller in writing at least 30 days before the change takes effect, stating the sub-processor's name, role, and location. During this period, the Controller may object in writing on reasonable grounds related to data protection.

If the Parties cannot agree on a new sub-processor, the Controller is entitled to terminate the Main Agreement effective as of the date the change takes effect, without further payment obligation beyond services already delivered.

The Processor shall impose on every sub-processor the same data protection obligations as set out in the Agreement, and the Processor remains fully liable to the Controller for the sub-processors' performance.

9. Transfers to third countries

If the Processor — itself or through a sub-processor — transfers personal data to a third country or an international organization, it shall do so only on a valid transfer basis under Chapter V of the GDPR, including:

• an adequacy decision under Article 45 (e.g. EU-US Data Privacy Framework, where the sub-processor is certified), or
• the European Commission's Standard Contractual Clauses ("SCCs") under Article 46(2), with any necessary supplementary measures.

The applicable transfer basis per sub-processor is set out in Annex B.

10. Assistance to the Controller

Taking into account the nature of processing, the Processor shall assist the Controller — insofar as possible — by appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to requests for exercising the data subjects' rights under Chapter III of the GDPR (access, rectification, erasure, restriction, objection, portability).

The Processor shall also make available the information necessary for the Controller's compliance with obligations under Articles 32–36 of the GDPR — including security, breaches, impact assessments, and prior consultation — and shall assist to a reasonable extent.

Assistance materially exceeding the normal operation of the Service may be billed at the Processor's standard hourly rate.

11. Personal data breach

The Processor shall notify the Controller without undue delay — and no later than 48 hours after becoming aware — of a personal data breach. The notification is sent to the contact address provided by the Controller and contains at least:

• the nature of the breach,
• the categories and approximate number of data subjects and records affected,
• the likely consequences,
• the measures taken or proposed by the Processor to address the breach and mitigate harm, and
• contact details of a person the Controller can contact for more information.

The obligation to report the breach to the Danish Data Protection Agency and to notify data subjects lies with the Controller.

12. Deletion or return of data

Upon termination of the Main Agreement, the Processor shall delete all personal data processed on behalf of the Controller — or return it at the Controller's choice — unless retention is required by EU or Danish law.

Deletion covers backup copies in accordance with the Processor's normal backup deletion routine (typically within 35 days after deletion from production systems).

The Controller may request deletion in writing to kontakt@zolva.io.

13. Audit and inspection

Upon written request from the Controller with reasonable notice and no more often than once per year — unless there is a specific suspicion of non-compliance — the Processor shall make the following available:

• Documentation of the Processor's technical and organizational measures.
• Relevant audit and security certifications from sub-processors (e.g. SOC 2 reports from Supabase and Anthropic, where available).

The Controller may, at its own cost and with 30 days' written notice, appoint an independent, mutually approved auditor to conduct an audit to the extent necessary to document the Processor's compliance with the Agreement. The auditor shall sign a confidentiality undertaking. The audit must not unduly affect the Processor's operations.

Costs of audits shall be borne by the Controller, unless the audit reveals material non-compliance by the Processor, in which case the Processor shall bear reasonable costs.

14. Liability

The Parties' liability under the Agreement is subject to the limitation of liability set out in the Main Agreement, provided that limitations do not apply to liability that cannot be waived under mandatory law — including fines imposed on a Party by a supervisory authority where the other Party's breach materially contributed to the fine.

Each Party is liable for its own breach of the GDPR and shall be liable to the data subjects in accordance with Article 82 of the GDPR.

15. Duration and termination

The Agreement enters into force on the Effective Date and remains in force for as long as the Processor processes personal data on behalf of the Controller under the Main Agreement. Provisions that by their nature should survive termination — including those on deletion, confidentiality, and limitation of liability — remain in effect.

The Agreement cannot be terminated separately from the Main Agreement. If the Main Agreement is terminated, the Agreement terminates concurrently and the Processor deletes data in accordance with Clause 12.

16. Amendments

The Processor may amend the Agreement to the extent necessary to reflect (i) changes in legislation, (ii) guidance from supervisory authorities, or (iii) changes in the technical setup of the Service. Material changes shall be notified in writing with at least 30 days' notice. If the Controller cannot accept changes that materially weaken the Controller's rights, the Controller may terminate the Main Agreement effective as of the date the change takes effect.

Other amendments require written agreement between the Parties.

17. Governing law and venue

The Agreement is governed by Danish law. Disputes shall be heard by the Court of Roskilde (Retten i Roskilde) as the court of first instance, unless otherwise required by mandatory law.

Signatures

For the Controller:

Name: __________________________

Title: __________________________

Date: ______________

Signature: __________________________

For the Processor (Zolva):

Name: Oscar Hangaard

Title: Owner

Date: ______________

Signature: __________________________

Annex A — Subject and nature of processing

A.1 Purpose

Provision of the Zolva Service — a personal AI assistant for email, calendar, and reminders — to the Controller's employees and users.

A.2 Nature and scope of processing

• Storage and organization of user data and work preferences.
• Retrieval of email and calendar data from Google/Microsoft via OAuth tokens provided by the data subject.
• Generation of AI-based replies, drafts, and summaries via a sub-processor (Anthropic).
• Delivery of push notifications.
• Temporary storage of chat history and notes.

A.3 Categories of data subjects

• The Controller's employees and authorized users who have created a Zolva account.
• Third parties whose personal data appears in the data subjects' emails or calendar events (senders, meeting participants, etc.).

A.4 Types of personal data

• Ordinary personal data: name, email address, profile picture (if provided by Google/Microsoft), user ID, phone number (only if provided by the user).
• Content data: subjects, senders, recipients, and body text of emails; titles, times, locations, and attendees of calendar events.
• User Content: chat messages, notes, reminders, AI-generated drafts.
• Technical metadata: OAuth refresh tokens (encrypted), push tokens, app settings, log data (IP address, timestamps, error traces).

Processing of special categories of personal data (Art. 9 GDPR) is not the purpose of the Service. If such information inadvertently appears in email or calendar content, it is processed at the same security level as other data, but the Controller is encouraged to minimize this through its own internal practices.

A.5 Duration of processing

Data is processed for as long as the user's account is active, and deleted upon account deletion or termination of the Main Agreement, cf. Clause 12.

• Email and calendar content is typically cached for up to 7 days in the Processor's production, but deleted immediately upon explicit user action (e.g. "Delete my profile").
• Chat messages and facts stored in "memory" are retained until the user deletes them or the account is deleted.
• Prompts and replies sent to Anthropic are retained by Anthropic for up to 30 days for abuse monitoring, after which they are deleted. They are not used for model training.

Annex B — Sub-processors

As of the Effective Date, the Processor uses the following sub-processors:

The current list of sub-processors is published at zolva.io/privacy-en. Changes are notified in accordance with Clause 8.

Annex C — Technical and organizational security measures

The Processor has implemented the following measures pursuant to Article 32 of the GDPR, taking into account the state of the art, the cost of implementation, the nature of processing, and the risks to the data subjects:

C.1 Confidentiality and integrity

• Encryption in transit: all traffic between the app, the Processor's edge functions, and sub-processors uses TLS 1.2 or higher.
• Encryption at rest: personal data is stored encrypted at rest in Supabase (AES-256) and in the user's local storage (iOS Keychain / Android Keystore).
• Access control:
  • Row Level Security (RLS) at the database layer: each user can only access their own rows.
  • JWT-based authentication (ES256).
  • OAuth 2.0 for third-party integrations; access tokens are only stored locally on the device.
  • Per-user rate limiting on AI endpoints.
• Secrets (API keys, service role keys) are stored exclusively in the Supabase environment and rotated as needed. No secrets in client code or git history.

C.2 Availability and resilience

• Backups are performed daily by Supabase with 7-day point-in-time recovery.
• Edge functions and the database are hosted on redundant infrastructure with automatic failover.

C.3 Organizational measures

• Only authorized personnel (as of the Effective Date: the owner alone) have production access.
• Confidentiality obligation cf. Clause 6.
• Development procedures and infrastructure changes are version controlled in git. Production deploys occur via controlled scripts.

C.4 Regular testing and evaluation

• Dependencies are updated and vulnerability scanned (npm audit, gitleaks) at every major release.
• Security controls are reviewed at least annually and upon material changes to the Service.

C.5 Deletion and data minimization

• Data for users without an active account is deleted as described in Clause 12 and Annex A.5.
• Logs are anonymized or deleted after 30 days.
• The Service does not collect advertising IDs, geolocation, or contacts.