Data processing agreement

These standard contractual clauses (the “Clauses”) are agreed between the business that has an account with Telenoa (the “data controller”) and Telenoa, Danish CVR no. 46373731, Denmark (the “data processor”), each a “party” and together the “parties”.

The data controller's name and company number are those on the account. The Clauses are concluded when the data controller accepts Telenoa's terms when creating the account or purchasing, and apply instead of a signature. If the data controller wants a signed copy, we will send one on request to kontakt@telenoa.com.

The parties have agreed the Clauses in order to comply with the GDPR and to ensure the protection of the rights and freedoms of natural persons.

2.1. These Clauses set out the rights and obligations of the data processor when processing personal data on behalf of the data controller.

2.2. The Clauses have been designed to ensure the parties' compliance with Article 28(3) of Regulation (EU) 2016/679 of 27 April 2016 (the GDPR).

2.3. In the context of providing the Telenoa service (shared inbox, the AI assistant Noa and the Noa Voice phone line), the data processor processes personal data on behalf of the data controller in accordance with these Clauses.

2.4. The Clauses take priority over any similar provisions in other agreements between the parties, including Telenoa's terms.

2.5. Four appendices are attached to the Clauses and form an integral part of them. Appendix A contains details about the processing. Appendix B contains the conditions for using sub-processors and the list of approved sub-processors. Appendix C contains the data controller's instructions, the security measures the data processor must implement as a minimum, and how supervision is carried out. Appendix D contains provisions on other matters.

2.6. The Clauses and their appendices shall be retained in writing, including electronically, by both parties.

2.7. These Clauses do not exempt the data processor from obligations to which it is subject under the GDPR or other legislation.

3.1. The data controller is responsible for ensuring that the processing of personal data takes place in compliance with the GDPR (see Article 24), applicable EU or EEA Member State data protection provisions and these Clauses.

3.2. The data controller has the right and obligation to make decisions about the purposes and means of the processing of personal data.

3.3. The data controller is responsible, among other things, for ensuring that there is a legal basis for the processing the data processor is instructed to perform. This includes call recording and text messages if the data controller switches them on. The data controller is also responsible for informing the data subjects about the processing, including that they may be served by an AI and that the call is noted and possibly recorded. The data processor ensures that, at the start of every call, Noa says that she is an AI assistant and that the call is being noted (and recorded, if recording is switched on).

4.1. The data processor shall process personal data only on documented instructions from the data controller, unless required to do so by EU or Member State law to which the processor is subject. These instructions are specified in Appendices A and C. Subsequent instructions may also be given by the data controller during the processing, but they must always be documented and kept in writing, including electronically, together with these Clauses. The choices the data controller makes in the service's settings (e.g. retention period, call recording, text messages and connections) are documented instructions.

4.2. The data processor shall immediately inform the data controller if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions. The data processor may suspend carrying out that instruction until the data controller has confirmed or changed it.

5.1. The data processor shall only grant access to the personal data being processed on behalf of the data controller to persons under its authority who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and only on a need-to-know basis. The list of persons granted access shall be kept under periodic review. On the basis of this review, access may be withdrawn if it is no longer necessary, and the personal data shall then no longer be accessible to those persons.

5.2. At the request of the data controller, the data processor shall be able to demonstrate that the persons concerned are subject to the above confidentiality.

6.1. Article 32 GDPR stipulates that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the data controller and data processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The data controller shall evaluate the risks and implement measures to mitigate them. Depending on their relevance, these may include pseudonymisation and encryption of personal data; the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore availability and access to personal data in a timely manner in the event of a physical or technical incident; and a process for regularly testing, assessing and evaluating the effectiveness of the measures.

6.2. According to Article 32 GDPR, the data processor shall also, independently from the data controller, evaluate the risks to the rights of natural persons inherent in the processing and implement measures to mitigate them. To this end, the data controller shall provide the data processor with all information necessary to identify and evaluate such risks.

6.3. The data processor shall assist the data controller in complying with Article 32 by, among other things, providing information about the technical and organisational measures already implemented (see Appendix C.2) and any other information necessary for the data controller's compliance.

6.4. If, in the data controller's assessment, mitigating the identified risks requires further measures than those already implemented by the data processor, the data controller shall specify these additional measures in Appendix C.

7.1. The data processor shall meet the requirements specified in Article 28(2) and (4) GDPR in order to engage another processor (a sub-processor).

7.2. The data processor has the data controller's general authorisation for the engagement of sub-processors. The data processor shall inform the data controller in writing of any intended changes concerning the addition or replacement of sub-processors at least 30 days in advance, thereby giving the data controller the opportunity to object to such changes prior to the engagement of the sub-processor(s) concerned. The list of sub-processors already authorised by the data controller is in Appendix B.

7.3. Where the data processor engages a sub-processor for carrying out specific processing activities on behalf of the data controller, the same data protection obligations as set out in these Clauses shall be imposed on that sub-processor by way of a contract or other legal act under EU or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing meets the requirements of these Clauses and the GDPR. The data processor is therefore responsible for requiring that the sub-processor at least complies with the obligations to which the data processor is subject under these Clauses and the GDPR.

7.4. A copy of a sub-processor agreement and subsequent amendments shall, at the data controller's request, be submitted to the data controller, thereby giving it the opportunity to ensure that the same data protection obligations are imposed on the sub-processor. Clauses on business-related issues that do not affect the legal data protection content of the sub-processor agreement shall not require submission to the data controller.

7.5. If the sub-processor does not fulfil its data protection obligations, the data processor shall remain fully liable to the data controller for the performance of the sub-processor's obligations. This does not affect the rights of the data subjects under the GDPR – in particular Articles 79 and 82 – against the data controller and the data processor, including the sub-processor.

8.1. Any transfer of personal data to third countries or international organisations by the data processor shall only occur on the basis of documented instructions from the data controller and shall always take place in compliance with Chapter V GDPR.

8.2. In case transfers to third countries or international organisations, which the data processor has not been instructed to perform by the data controller, are required under EU or Member State law to which the data processor is subject, the data processor shall inform the data controller of that legal requirement prior to processing, unless that law prohibits such information on important grounds of public interest.

8.3. Without documented instructions from the data controller, the data processor therefore cannot within the framework of these Clauses transfer personal data to a data controller or a data processor in a third country or in an international organisation, transfer the processing of personal data to a sub-processor in a third country, or have the personal data processed in a third country.

8.4. The data controller's instructions regarding the transfer of personal data to a third country, including the transfer tool under Chapter V GDPR, are set out in Appendix C.6.

8.5. These Clauses shall not be confused with standard data protection clauses within the meaning of Article 46(2)(c) and (d) GDPR, and they cannot be relied upon as a transfer tool under Chapter V GDPR.

9.1. Taking into account the nature of the processing, the data processor shall assist the data controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the data controller's obligation to respond to requests for exercising the data subjects' rights laid down in Chapter III GDPR. This entails that the data processor shall, insofar as possible, assist the data controller in ensuring compliance with:

• the right to be informed when collecting personal data from the data subject
• the right to be informed when personal data have not been obtained from the data subject
• the right of access by the data subject
• the right to rectification
• the right to erasure (“the right to be forgotten”)
• the right to restriction of processing
• the notification obligation regarding rectification or erasure of personal data or restriction of processing
• the right to data portability
• the right to object
• the right not to be subject to a decision based solely on automated processing, including profiling

9.2. In addition to the data processor's obligation to assist under Clause 6.3, the data processor shall furthermore, taking into account the nature of the processing and the information available to it, assist the data controller with: (a) the data controller's obligation to notify a personal data breach to the competent supervisory authority, the Danish Data Protection Agency (Datatilsynet), without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; (b) the obligation to communicate a personal data breach to the data subject without undue delay where it is likely to result in a high risk to their rights and freedoms; (c) the obligation to carry out a data protection impact assessment prior to the processing; and (d) the obligation to consult Datatilsynet prior to processing where an impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the data controller to mitigate the risk.

9.3. The parties have defined in Appendix C.3 the technical and organisational measures by which the data processor assists the data controller, and the scope and extent of the assistance.

10.1. In case of a personal data breach, the data processor shall notify the data controller without undue delay after having become aware of it.

10.2. The data processor's notification to the data controller shall, if possible, take place within 48 hours after the data processor has become aware of the breach, to enable the data controller to comply with its obligation to notify the breach to the competent supervisory authority, cf. Article 33 GDPR.

10.3. In accordance with Clause 9.2 (a), the data processor shall assist the data controller in notifying the breach to the competent supervisory authority, meaning that the data processor shall assist in obtaining the information listed in Article 33(3): (a) the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned; (b) the likely consequences of the breach; (c) the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

10.4. The information the data processor shall provide is set out in Appendix C.3.

11.1. On termination of the provision of personal data processing services, the data processor shall delete all personal data processed on behalf of the data controller and certify to the data controller that it has done so, unless EU or Member State law requires storage of the personal data. Before termination, the data controller can export its data itself (Appendix C.4).

12.1. The data processor shall make available to the data controller all information necessary to demonstrate compliance with Article 28 GDPR and these Clauses and allow for and contribute to audits, including inspections, conducted by the data controller or another auditor mandated by the data controller.

12.2. Procedures applicable to the data controller's audits, including inspections, of the data processor and sub-processors are specified in Appendices C.7 and C.8.

12.3. The data processor shall be required to provide the supervisory authorities, which pursuant to applicable legislation have access to the data controller's or data processor's facilities, or representatives acting on behalf of such supervisory authorities, with access to the data processor's physical facilities on presentation of appropriate identification.

13.1. The parties may agree other clauses concerning the provision of the personal data processing service specifying e.g. liability, as long as they do not contradict directly or indirectly the Clauses or prejudice the fundamental rights or freedoms of the data subject under the GDPR. Such clauses are in Appendix D.

14.1. The Clauses take effect when the data controller accepts Telenoa's terms (see section 1).

14.2. Both parties shall be entitled to require the Clauses renegotiated if changes to the law or inexpediency of the Clauses should give rise to such renegotiation.

14.3. The Clauses apply for the duration of the provision of personal data processing services. For the duration of the provision, the Clauses cannot be terminated unless other clauses governing the provision of personal data processing services have been agreed between the parties.

14.4. If the provision of personal data processing services is terminated and the personal data are deleted pursuant to Clause 11.1 and Appendix C.4, the Clauses may be terminated by written notice by either party.

15.1. The parties may contact each other using the contacts below. The parties shall be under obligation continuously to inform each other of changes to contacts.

• Data controller: the account administrator(s) at the email address on the account
• Data processor: Telenoa, kontakt@telenoa.com

A.1. The purpose of the data processor's processing of personal data on behalf of the data controller is to provide the Telenoa service to the data controller: to receive, collect, sort and answer the data controller's enquiries from customers and others, to answer the data controller's phone with the AI assistant Noa, and to send text messages and emails on the data controller's behalf.

A.2. The processing primarily concerns (the nature of the processing): storage, structuring, search, display and deletion of enquiries; automatic sorting, summarising and reply drafts with AI; speech to text, text to speech and AI replies during phone calls; recording of calls when the data controller switches it on; sending text messages and emails; extracting lasting notes about a contact with AI; and transfer to the connections (other systems) that the data controller switches on itself.

A.3. The processing includes the following types of personal data about data subjects:

• Enquiries: name, email, phone number, subject, message, custom fields, attachments, the sender's IP address and the page a form was sent from
• Emails: content, sender, recipients and attachments in the email accounts the data controller connects, and the replies sent
• Calls: the caller's phone number, time and duration, a transcript of the conversation, what Noa noted (e.g. message, booking, name) and the outcome. The audio is processed while the call is live and is only stored if the data controller has switched “Record calls” on
• Recordings: the recording of the conversation (both parties) when recording is switched on
• Text messages: the recipient's phone number, the message text and delivery status. For a review request, also the question the caller was asked and the answer (consent or no)
• Contact notes: lasting notes Noa derives from a contact's calls and emails (e.g. name, preferred language or an earlier appointment). On by default for new companies; the data controller can switch it off and delete the notes
• Knowledge base: texts and documents the data controller gives Noa, which may contain personal data
• The data controller's users: name, email and role of the employees with access, and a log of their actions on enquiries
• Special categories: The service is not intended for special categories of personal data, but they may occur if data subjects write or say them. The data controller must assess this (Appendix C.2)

A.4. The processing includes the following categories of data subjects: the data controller's customers and others who write, call or fill in a form; recipients of text messages and emails from the service; persons mentioned in enquiries or in the knowledge base; and the data controller's employees who use the service.

A.5. The processing may begin once the Clauses have taken effect and lasts as long as the data controller uses the service, until the personal data have been deleted under Appendix C.4.

A.6. What this agreement does not cover. For data about the data controller as a customer and about its users that Telenoa processes for its own purposes (account, login, payment, bookkeeping and support), Telenoa is an independent controller. This is described in Telenoa's privacy policy and is not part of this agreement.

Recording of app usage: Telenoa may record how the data controller's employees use the app (clicks and navigation, with all text and all fields hidden) in order to improve the service. This is done for Telenoa's own purposes, where Telenoa is an independent controller. It is therefore not part of this agreement. The feature is described in Telenoa's privacy policy and can be switched off under Settings → Company → Privacy.

B.1. On commencement of the Clauses, the data controller authorises the engagement of the following sub-processors for the processing described. The data processor may not, without the data controller's written authorisation, engage a sub-processor for a processing activity other than the one described and agreed, or have another sub-processor perform that processing, subject to Clause 7.2. The current list is also at https://www.telenoa.com/en/sub-processors.

Connections the data controller switches on itself (e.g. Google Calendar, Google Sheets, Microsoft Outlook, CRM systems or web shops) are the data controller's own vendors. Data is sent there on the data controller's instructions, and they are not Telenoa's sub-processors.

B.2. The data processor notifies changes to the list by email to the account administrator at least 30 days before a new sub-processor is engaged. If the data controller objects and the parties cannot find a solution, the data controller may terminate the agreement on the service before the change takes effect.

C.1. Subject of the processing/instructions. The data processor processes personal data on behalf of the data controller by providing the service as the data controller has set it up: receiving and storing enquiries and emails; letting Noa sort, summarise and write reply drafts; sending replies sent by the data controller's users (or by autopilot, if switched on); answering calls on Noa Voice, transferring, taking messages and booking appointments; recording calls if switched on; sending the text messages the data controller has switched on; deriving contact notes; syncing with the connections the data controller switches on; and deleting according to the retention period the data controller has chosen.

C.2. Security of processing. The processing includes ordinary personal data about customers and contacts on a larger scale, and special categories may occur if data subjects provide them. The level of security shall reflect this. The data processor is entitled and obliged to decide which technical and organisational measures to implement to establish the necessary level of security. As a minimum, the data processor shall implement the following:

• Encryption in transit: All traffic to the app, the API and the website uses HTTPS (TLS 1.2 or 1.3)
• Encryption of credentials: Passwords and keys for connected email accounts are encrypted with AES-256-GCM before storage. User passwords are only stored as a hash (scrypt)
• Login: Password login requires a one-time code sent by email
• Access control: Roles (Administrator and Employee) control access at the data controller, and each company's data is kept separate in the database
• Network: The database cannot be reached from the internet; only the app on the same server connects to it. Administrative access to the server is by SSH key only
• Storage: The app server and database are at Contabo in Germany, and the telephony server is at DigitalOcean in Amsterdam. Files and recordings are in Cloudflare R2 under EU jurisdiction. Reading websites and documents (Crawl4AI and Docling) runs on our own server
• Recovery: The database is backed up every night. One copy is kept on our server, and an encrypted copy is sent off the server to Cloudflare R2 in the EU. Encrypted backups, including those off the server, are deleted after 14 days. Each backup is checked before it is kept
• Logging: Actions on enquiries are logged in an activity log. Errors are logged in our own error log without user, cookies or request content
• AI vendors: AI models we use via OpenRouter are only called through providers without data retention. They neither store nor train on the data (zero data retention). Anthropic (Claude) neither stores nor trains on your data (zero data retention agreement). Google's Gemini API (paid tier) does not train on the data, but may keep it for a short period to detect abuse
• Staff: Telenoa is run by one person. If others get access to personal data, it is only under confidentiality and on a need-to-know basis

C.3. Assistance to the data controller. The data processor assists by providing these functions in the service: export of all enquiries about a given contact (by email address), deletion of individual enquiries, a full data export for administrators and a retention period the data controller chooses. Contact notes can be deleted in the service. What cannot be done in the service (e.g. deleting the text message log for a given person) is carried out by the data processor on written request to kontakt@telenoa.com. In case of a personal data breach, the data processor provides, as far as possible, the information listed in Clause 10.3. Reasonable assistance is free of charge.

C.4. Storage period/erasure procedures. Enquiries are deleted automatically according to the retention period the data controller chooses under Settings → Company (6, 12, 24, 36 or 60 months without activity, or no automatic deletion; the default for new companies is 24 months). Only closed enquiries that are not starred and have no future reminder are deleted, together with their emails, notes and attachments. Contact notes follow the same retention period. Call recordings are deleted automatically after 30 days. The telephony provider's copy is deleted as soon as our copy is confirmed saved, and at the latest after 30 days. The text message log and answers to review requests are deleted automatically after 12 months, on termination or on request, whichever comes first. On termination of the service, the data processor deletes the personal data no later than 60 days after termination, and copies in backups, including the encrypted copies off the server, are deleted within 14 days after that.

C.5. Processing location. Processing of the personal data under the Clauses cannot be performed at other locations than the following without the data controller's prior written authorisation: the data processor's server at Contabo in Germany; the telephony server at DigitalOcean in Amsterdam; Cloudflare R2 in the EU; and at the sub-processors listed in Appendix B, at the locations stated.

C.6. Instructions on transfer of personal data to third countries. The data controller instructs the data processor to transfer personal data to the US sub-processors listed in Appendix B to the extent necessary for the processing described. The transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the vendor is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR). Without documented instructions, the data processor may not make other transfers.

C.7. Procedures for the data controller's audits, including inspections. On request, at most once a year, the data processor gives the data controller a written statement on how it complies with the GDPR and these Clauses. The data controller may challenge the statement and may, when it deems it necessary, carry out an inspection with reasonable notice. The data controller bears its own costs of an inspection. The data processor sets aside the time needed.

C.8. Procedures for audits of sub-processors. The data processor reviews the sub-processors' data processing agreements and the documentation they make available (e.g. certifications and audit reports) when they are engaged and once a year after that. The data controller may be informed of the result.

• Liability: The parties' liability to each other follows Telenoa's terms, including the limitation of liability. This does not limit data subjects' rights under the GDPR
• Costs: Reasonable assistance under Clause 9 and Appendix C.3 is free of charge. Extensive assistance beyond that may be invoiced by agreement
• Language: The Clauses exist in Danish and English. In case of discrepancy, the Danish version applies
• Changes: Changes to Appendices A to C resulting from changes to the service are notified in the same way as changes of sub-processors (Appendix B.2)
• Version: This version is dated 24 October 2026. Changed from 3 October 2026: Telenoa is referred to only by name and CVR number, Clause 3.3 mentions AI disclosure, Appendix A.6 sets out what Telenoa is itself the controller for, Appendix C.2 describes off-server backups and the AI vendors precisely, and Appendix C.4 now says the text message log is deleted after 12 months and when the telephony provider's copy of recordings is deleted