Data Processing Addendum

Terms not defined here have the meaning given to them in the GDPR. In this Addendum:

GDPR

Regulation (EU) 2016/679.

Data Protection Law

The GDPR, the Italian Personal Data Protection Code (Legislative Decree 196/2003) and the other rules applicable to the processing.

Contract

The Dettami Terms of Service accepted by the Customer, with the documents they refer to.

Service

Dettami — the Mac and Windows app, the website, the portal and the online service — as described in the Contract.

Customer Personal Data

The personal data Litchi processes on behalf of the Customer in providing the Service, described in Annex 1.

Members

The people who belong to the Customer's organisation in Dettami.

Sub-processor

Another processor engaged by Litchi to carry out processing of Customer Personal Data.

Breach

A personal data breach (Article 4(12) GDPR) affecting Customer Personal Data.

Standard Contractual Clauses

The standard clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

EEA

The European Economic Area.

1. This Addendum governs the processing of Customer Personal Data that Litchi carries out on behalf of the Customer in providing the Service.
2. The Customer is the controller; Litchi is the processor under Article 28 GDPR.
3. The following are outside this Addendum, because Litchi does not process them on behalf of the Customer:
   • the data that stays on Members' computers (Macs or Windows PCs) — audio, the text of dictations, history, personal glossary and snippets, AI keys, unsynced notes — which Litchi does not receive;
   • the text the app sends to AI providers chosen by Members with their own keys: it leaves the computer and goes straight to the provider, under the contract between the Member (or the Customer) and that provider, which is not a Litchi Sub-processor;
   • the notes a Member lets an AI connector they authorised read (for example Claude or ChatGPT): that service receives them on the Member's instruction, under the contract between the Member (or the Customer) and that service, which is not a Litchi Sub-processor;
   • the data Litchi processes as an independent controller, described in the Privacy Policy: the management of each person's account, billing and payments, and technical logs for the security of the Service.

1. Litchi processes Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to countries outside the EEA, unless required to do so by Union or Italian law; in that case it informs the Customer before processing, unless the law prohibits it.
2. The Customer's instructions are the Contract, this Addendum and the choices the Customer and its admins make in the Service (for example, turning on per-person usage detail). Further instructions are given in writing and must be compatible with the Service.
3. Litchi immediately informs the Customer if, in its opinion, an instruction infringes Data Protection Law.
4. Litchi processes Customer Personal Data only to provide the Service. It does not use it for its own purposes, does not sell it and does not use it to train artificial intelligence models.

1. The Customer warrants that the processing of Customer Personal Data has a valid legal basis and that data subjects are informed as required by Articles 13 and 14 GDPR.
2. Where Members are its employees or contractors, the Customer complies with employment law. In Italy, before turning on per-person usage detail, it complies with Article 4 of Law no. 300 of 20 May 1970 (the Workers' Statute) and informs workers. Per-person detail is off by default and only a Customer admin can turn it on.
3. The Customer ensures that whoever records meetings with the Notetaker informs the participants and, where the law requires it, obtains their consent.
4. The Service is not designed for special categories of data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10). If Members enter such data in the shared glossary, snippets or notes, the Customer verifies its legal basis.
5. The Customer manages its team's access: who is an admin, who joins, who leaves.

Litchi ensures that the people authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they access it only to the extent needed to provide the Service, give support or comply with the law.

Litchi implements the technical and organisational measures appropriate to the risk required by Article 32 GDPR, described in Annex 2. It may update them over time, provided the overall level of protection does not decrease.

1. The Customer gives Litchi a general written authorisation to engage Sub-processors. Those in use are listed in Annex 3.
2. Litchi informs the Customer of any addition or replacement of a Sub-processor with at least 15 days' notice, by email to admins or in the portal.
3. Within that period the Customer may object on reasonable grounds relating to data protection. The parties look for a solution in good faith; if they cannot find one, the Customer may terminate the Contract before the change takes effect, without penalty and with a refund of the part of the subscription already paid and not used.
4. Litchi imposes on each Sub-processor, by contract, the same data protection obligations as in this Addendum, in particular sufficient guarantees of appropriate technical and organisational measures (Article 28(4) GDPR).
5. Litchi remains fully liable to the Customer for the performance of its Sub-processors' obligations.

Litchi stores Customer Personal Data on servers in the European Union (Germany). Where processing involves a transfer to a country outside the EEA — for example to a Sub-processor based in the United States — Litchi carries it out only with the safeguards of Chapter V GDPR, such as the Standard Contractual Clauses, and on request provides the Customer with information about those safeguards.

1. Data subject rights. Taking into account the nature of the processing, Litchi assists the Customer with appropriate technical and organisational measures to respond to requests to exercise rights (Chapter III GDPR). The Service already lets each person export their data and delete their account from the portal, and lets admins manage Members. If a request reaches Litchi directly, Litchi forwards it to the Customer without undue delay and does not respond on the merits without the Customer's instructions.
2. Security, impact assessments and consultations. Litchi assists the Customer, with the information available to it, with the obligations under Articles 32–36 GDPR: security of processing, breach notification, data protection impact assessment and prior consultation with the supervisory authority.

1. Litchi notifies the Customer of any Breach without undue delay and in any case within 48 hours of becoming aware of it.
2. The notification describes, as far as known: the nature of the Breach, the categories and approximate number of data subjects and records concerned, a contact point at Litchi, the likely consequences and the measures taken or proposed to address it and mitigate its effects. Information not available straight away is provided as soon as possible, in phases if necessary.
3. Litchi promptly takes reasonable steps to contain the Breach and cooperates with the Customer so that it can notify the supervisory authority and, where necessary, communicate it to data subjects (Articles 33 and 34 GDPR).

1. This Addendum applies for the whole term of the Contract and, after that, for as long as Litchi processes Customer Personal Data.
2. At the end of the Contract, Litchi deletes Customer Personal Data within 30 days, unless Union or Italian law requires it to be kept.
3. At the Customer's request, made before the end of the Contract or within those 30 days, Litchi returns Customer Personal Data in a structured, commonly used format (export) before deleting it.
4. Copies in backups are not deleted one by one: they are overwritten as backups rotate, within 90 days. Until then they remain protected by the measures in Annex 2 and are not processed for any other purpose.

1. On request, Litchi makes available to the Customer the information and documentation needed to demonstrate compliance with Article 28 GDPR and this Addendum.
2. If these are not sufficient, the Customer may carry out an inspection, directly or through an independent auditor bound by confidentiality, with reasonable notice and at its own expense. The inspection is carried out so as not to disrupt the Service and to protect other customers' data and the security of the systems.
3. For Sub-processors, audits take place in the ways provided for in their contracts, for example through their certifications and audit reports.

Each party is liable for damage caused by processing in accordance with Article 82 GDPR. Litchi, as processor, is liable where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to the Customer's lawful instructions.

1. If this Addendum and the Contract conflict on data protection, this Addendum prevails.
2. The Customer accepts this Addendum together with the Terms of Service when activating the subscription. Whoever accepts it declares that they have authority to do so on behalf of the Customer.
3. Litchi may update this Addendum to bring it into line with Data Protection Law or new features of the Service, giving the Customer at least 30 days' notice and without lowering the level of data protection.
4. Governing law and jurisdiction are as set out in the Contract.
5. This Addendum is published in Italian and English; if they conflict, the Italian version prevails.

Categories of data subjects

• The Customer's Members (for example employees, contractors, partners);
• people invited to join the Customer's team;
• participants in meetings recorded with the Notetaker, where the notes are synced.

Categories of personal data

• identification and contact data: first name, last name, email;
• role in the organisation, invitations and join requests;
• daily usage counts per computer and app category: words, dictations, seconds of dictation, corrections; never the text;
• glossary terms and snippets shared with the team;
• content of synced meeting notes: transcript, summary, participants.

Special categories of data

The Service is not designed to process them. They may appear only if Members enter them in shared content (section 4).

Nature and purpose

Storage, organisation, consultation, making available to Members and deletion of data, in order to provide Dettami: running the team and invitations, showing usage to Members and admins, syncing glossary, snippets and notes, sending service emails.

Duration and frequency

Continuous, for the term of the Contract; afterwards, as set out in section 11.

Retention

Organisation data and usage counts for as long as the organisation and the accounts exist; synced notes until a Member or an admin deletes them; invitations and invite links expire after 14 days; backups overwritten within 90 days.

Place of processing

Servers in the European Union (Germany); transfers outside the EEA only as set out in section 8.

Data minimisation

• Audio and the text of dictations stay on Members' computers: the Service receives only usage counts, never the text.
• In password fields the app sends nothing to the cloud and saves nothing in the history.
• Per-person usage detail is off by default, and only those who choose to appear show up in the leaderboard.

Encryption

• All connections between the app, the website and the servers are encrypted (TLS).
• Passwords are stored with bcrypt.
• Backups on object storage are encrypted.

Access control

• Access tokens that expire after 8 hours; refresh tokens rotated at every use.
• Digitally signed app licence.
• Permissions in the Service that separate each organisation's data and distinguish admins from Members.
• Limits on sign-in attempts and technical logs kept for 30 days, to detect abuse.
• Server access limited to authorised staff, using cryptographic keys.
• Secrets (the Service's keys and passwords) never in the source code.

Availability and recovery

• Rotating database backups: 7 days on the server, 30 days on object storage in Germany, up to 90 days in an off-site copy in the European Union.

Organisation

• Authorised staff bound by confidentiality; access to data only when needed.
• Servers and database in the European Union (Germany).
• Sub-processors selected and contractually bound to the obligations of this Addendum.
• Breach notification to the Customer within 48 hours of discovery.

Not Sub-processors

• Google, when a Member chooses “Sign in with Google”: it is an independent controller for the sign-in.
• AI providers (Google Gemini, Groq, Anthropic, OpenAI) chosen by Members with their own keys: they receive text directly from the computer, under the Member's or the Customer's contract.
• Hugging Face, GitHub and PyPI, from which the app downloads, once on first launch, the speech model and, on a Mac, the Python tools (on Windows only the model, from Hugging Face): they only see the computer's IP address.