DATA PROCESSING ADDENDUM
Last updated: October 20, 2026
DATA PROCESSING ADDENDUM
Decided, Inc. · Last updated: October 20, 2026 · https://decided.com/legal/dpa
This Data Processing Addendum (the "DPA") forms part of the Master Subscription Agreement (the "MSA") between Decided, Inc. ("Decided") and Customer. It applies whenever Decided processes Customer Personal Data on Customer's behalf. Capitalized terms not defined here have the meanings given in the MSA.
1. Definitions.
"Applicable Data Protection Law" means all laws that apply to the processing of Customer Personal Data under the Agreement, including: (a) Regulation (EU) 2016/679 (the "GDPR"); (b) the GDPR as it forms part of the law of the United Kingdom, and the UK Data Protection Act 2018 (together, the "UK GDPR"); (c) the Swiss Federal Act on Data Protection (the "FADP"); and (d) US federal and state privacy laws ("US Privacy Laws"), including the California Consumer Privacy Act, as amended (the "CCPA").
"Customer Personal Data" means personal data contained in Customer Data that Decided processes on behalf of Customer.
"Restricted Transfer" means a transfer of Customer Personal Data subject to the GDPR, UK GDPR, or FADP to a country, or a recipient, not covered by an adequacy decision or equivalent recognition under that law.
"SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data, including Customer Personal Data, in systems controlled by Decided or its Subprocessors. It does not include unsuccessful attempts that do not compromise security, such as pings, port scans, or failed login attempts.
"Subprocessor" means a third party that Decided engages to process Customer Personal Data. Decided personnel, meaning its employees and individual contractors who work under Decided's direction and are bound by confidentiality obligations, are not Subprocessors.
"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.
"Controller", "processor", "data subject", "personal data", "processing", and "supervisory authority" have the meanings given in the GDPR. "Business", "service provider", "contractor", "sell", "share", and "business purpose" have the meanings given in US Privacy Laws.
2. Roles and Scope.
2.1 Roles. Customer is the controller (or "business") of Customer Personal Data, and Decided is its processor (or "service provider" or "contractor"). If Customer acts as a processor for its Affiliates, Decided acts as Customer's subprocessor, and Customer is responsible for passing on its Affiliates' instructions.
2.2 Details. Annex 1 describes the processing.
2.3 Customer's responsibilities. Customer is responsible for: (a) having a lawful basis for the processing; (b) giving Participants the notice described in MSA Section 4.1 and obtaining any consents that law requires; (c) ensuring its instructions comply with Applicable Data Protection Law; and (d) the accuracy of the Org Chart Data it provides.
2.4 Decided's own data. Decided processes Usage Data and the business contact details of Customer's personnel for account management, billing, and security as a controller, under its Privacy Policy. Decided is also the controller of records showing that each Participant accepted the Participant Terms and was shown the recording notice, such as the Participant's user ID, the date and time, and the version accepted. These records contain no Interview Content. Decided keeps them for 3 years after the Agreement ends, uses them only to establish, exercise, or defend legal claims, and shares them with Customer on request. This DPA does not apply to that processing.
3. Processing Instructions.
3.1 Instructions. Decided will process Customer Personal Data only on Customer's documented instructions, including with regard to transfers of Customer Personal Data to a third country. The Agreement, Customer's configuration of the Service, and other written instructions agreed by the Parties are Customer's complete instructions. They include processing to provide, maintain, secure, and support the Service, and to create Aggregated Data under MSA Section 6.4. Decided does not process Customer Personal Data for its own purposes. Once created, Aggregated Data contains no Customer Personal Data.
3.2 Unlawful instructions. Decided will immediately tell Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
3.3 Legally required processing. If law requires Decided to process Customer Personal Data in another way, Decided will tell Customer before doing so, unless the law prohibits it.
4. US Privacy Laws.
To the extent US Privacy Laws apply, Decided will:
(a) not sell or share Customer Personal Data;
(b) not retain, use, or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes described in Annex 1, or as US Privacy Laws otherwise permit for service providers;
(c) not retain, use, or disclose Customer Personal Data outside the direct business relationship between the Parties;
(d) not combine Customer Personal Data with personal information it receives from other sources, except as US Privacy Laws permit;
(e) comply with US Privacy Laws and provide the same level of privacy protection that US Privacy Laws require of businesses; and
(f) notify Customer within five business days after determining that it can no longer meet these obligations.
Customer may take reasonable and appropriate steps, through the process in Section 12, to ensure that Decided uses Customer Personal Data consistently with Customer's obligations, and to stop and remediate any unauthorized use. Customer will inform Decided of any consumer request that Decided must comply with and provide the information Decided needs to do so. Decided certifies that it understands and will comply with this Section 4.
5. Personnel.
Decided will ensure that everyone it authorizes to process Customer Personal Data is bound by confidentiality obligations and has access only as needed to perform the Agreement. Decided personnel with access to Customer Personal Data are located in the United States, the United Kingdom, Italy, and the Netherlands.
6. Security.
Decided will implement the technical and organizational measures described in Annex 2. Decided may update these measures, but will not materially reduce the overall protection of Customer Personal Data.
7. Subprocessors.
7.1 Authorization. Customer gives Decided general authorization to engage Subprocessors. Annex 3 lists the current Subprocessors.
7.2 Obligations. Decided will bind each Subprocessor by a written agreement with data protection obligations at least as protective as this DPA, to the extent they apply to the services the Subprocessor provides. Decided remains responsible for each Subprocessor's performance.
7.3 Changes. Decided will notify Customer by email at least 30 days before a new Subprocessor begins processing Customer Personal Data. Decided updates Annex 3 through this notice process; the update does not require an amendment to this DPA.
7.4 Objections. Customer may object to a new Subprocessor on reasonable data protection grounds by written notice before the end of the notice period. The Parties will discuss Customer's concerns in good faith. If they cannot resolve them within 30 days after Customer's objection, Customer may terminate the affected Order Form by written notice and receive a refund of prepaid Fees for the remainder of the Subscription Term.
8. Data Subject Requests.
8.1 Assistance. Taking into account the nature of the processing, Decided will help Customer respond to requests from data subjects to exercise their rights. This help includes exporting data and deleting specific Interviews or all data about a Participant under MSA Section 6.6. Where a request concerns data Customer cannot access through the Service, such as audio recordings or pre-final transcripts, Decided will assist Customer in responding and, at Customer's request, will provide that data directly to the data subject.
8.2 Requests sent to Decided. If Decided receives a request directly from a data subject, it will promptly forward it to Customer. Decided will not respond itself except to direct the data subject to Customer or as Customer instructs under Section 8.1, unless law requires otherwise.
9. Security Incidents.
9.1 Notice. Decided will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident.
9.2 Information. The notice will describe, to the extent known: the nature of the Security Incident; the categories and approximate number of data subjects and records affected; its likely consequences; the measures taken or proposed; and a contact point. Decided will provide updates as more information becomes available.
9.3 Response. Decided will take reasonable steps to contain, investigate, and mitigate the Security Incident.
9.4 Customer notifications. Customer, as controller, decides whether to notify supervisory authorities and individuals. Decided will provide reasonable assistance. Unless law requires it, Decided will not notify supervisory authorities or individuals about a Security Incident affecting Customer Personal Data, or name Customer in any public statement about it, without Customer's approval.
9.5 No admission. Decided's notice of a Security Incident is not an admission of fault or liability.
10. Impact Assessments.
Taking into account the nature of the processing and the information available to it, Decided will provide reasonable assistance with Customer's obligations under Articles 32 to 36 of the GDPR and their equivalents under other Applicable Data Protection Law, including data protection impact assessments and prior consultations with supervisory authorities, by providing the information in Annexes 1 and 2 and other information Customer reasonably requests.
11. Retention, Return, and Deletion.
Decided retains, returns, and deletes Customer Personal Data as described in MSA Sections 6.6 and 6.7:
(a) audio recordings are deleted within 90 days after the Interview;
(b) other Customer Personal Data is retained for the Subscription Term;
(c) Customer may delete specific Interviews, or all data about a Participant, in the Service at any time, and deleted data is removed from active systems within 30 days;
(d) after the Agreement ends, including after a Pilot that does not convert (MSA Section 6.7), Customer may export its Org Chart Data, Final Responses, and Outputs for 30 days, and Decided deletes Customer Personal Data within 30 days after that period;
(e) copies in backups expire within 30 days of deletion and remain protected until they do; and
(f) on request, Decided confirms deletion in writing.
If law requires Decided to retain any Customer Personal Data, this DPA continues to protect it for as long as Decided retains it.
12. Audits and Information.
12.1 Information. Decided will make available the information reasonably necessary to demonstrate its compliance with this DPA, including, subject to confidentiality: (a) answers to one reasonable security questionnaire every 12 months; (b) a summary of its most recent penetration test; and (c) once available, its SOC 2 Type II report.
12.2 Audits. If that information is not sufficient to demonstrate compliance, or if a supervisory authority requires it, after a Security Incident, or if there are indications of non-compliance, Customer may audit Decided's compliance with this DPA, itself or through an independent auditor bound by confidentiality who is not a Decided competitor. Customer will give at least 30 days' written notice, conduct the audit during business hours without unreasonably disrupting Decided's operations, and bear its own costs. Audits are limited to once every 12 months, except where a supervisory authority requires it, after a Security Incident, or if there are indications of non-compliance. Audits will not give Customer access to other customers' data. The Parties will prefer remote audits where practical.
12.3 SCCs. Customer's audit rights under the SCCs are exercised through this Section 12.
13. International Transfers.
13.1 Locations. Decided stores Customer Personal Data in the United States. Decided personnel located in the United Kingdom, Italy, and the Netherlands may access it, and Subprocessors process it in the locations listed in Annex 3.
13.2 EEA. For Restricted Transfers from the European Economic Area, the SCCs are incorporated into this DPA as follows: (a) Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor; (b) Clause 7 (docking clause) applies; (c) under Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 7.3; (d) the optional language in Clause 11 does not apply; (e) under Clause 13, the competent supervisory authority is determined as that Clause provides; (f) under Clause 17, the SCCs are governed by the laws of Ireland; (g) under Clause 18, disputes are resolved by the courts of Ireland; and (h) Annexes I, II, and III of the SCCs are completed by Annexes 1, 2, and 3 of this DPA.
13.3 United Kingdom. For Restricted Transfers from the United Kingdom, the UK Addendum is incorporated into this DPA. Tables 1 to 3 of the UK Addendum are completed with the information in Section 13.2 and Annexes 1 to 3 of this DPA. For Table 4, either Party may end the UK Addendum as set out in its Section 19.
13.4 Switzerland. For Restricted Transfers from Switzerland, the SCCs apply as described in Section 13.2, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; references to the GDPR include the FADP; and the term "member state" does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.
13.5 Onward transfers. Decided will ensure that any onward transfer of Customer Personal Data subject to the GDPR, UK GDPR, or FADP, including access by Subprocessors in a country without an adequacy decision, is protected by appropriate safeguards under Applicable Data Protection Law.
13.6 Alternative mechanisms. If a transfer mechanism in this Section becomes invalid, the Parties will cooperate in good faith to put an appropriate alternative in place.
14. Liability.
Each Party's liability arising out of or relating to this DPA is subject to MSA Section 14, except to the extent the SCCs require otherwise.
15. Precedence and Term.
15.1 Precedence. If there is a conflict, the SCCs (where they apply) prevail over this DPA. Special Terms in an Order Form that expressly identify a provision of this DPA prevail over that provision. Otherwise, this DPA prevails over the rest of the Agreement for the processing of Customer Personal Data (MSA Section 17.9).
15.2 Term. This DPA remains in effect for as long as Decided processes Customer Personal Data.
ANNEX 1 — DESCRIPTION OF PROCESSING
A. Parties
| Role | Party | Contact |
|---|---|---|
| Data exporter (controller, or processor under Section 2.1) | Customer, as named in the Order Form, and each Customer Affiliate whose Customer Personal Data is transferred and on whose behalf Customer enters into this DPA | The contacts in the Order Form |
| Data importer (processor) | Decided, Inc., 447 Broadway, 2nd Floor #1512, New York, NY 10013, United States | contact@decided.com |
Activities relevant to the transfer: Customer's use of the Service under the Agreement.
B. Processing
| Item | Description |
|---|---|
| Data subjects | (1) Participants; (2) Authorized Users; (3) other Customer personnel listed in Org Chart Data, such as managers; (4) other individuals whom Participants mention in Interviews, such as colleagues |
| Org Chart Data | Information about Customer's personnel, such as name, work email address, title, team, and manager |
| Calendar Data | Availability (free/busy) information and the calendar invitations the Service creates. Not the titles, descriptions, attendees, or content of other calendar events |
| Interview Content | Voice recordings; transcripts; Final Responses, which contain Participants' views and information about their work, priorities, blockers, decisions, and colleagues |
| Outputs | Leadership Briefs and decision-graph content, which may attribute statements to Participants |
| Account data | Authorized Users' names, email addresses, roles, single sign-on identifiers, and access logs, processed as processor to provide the Service. Decided's own use of account and usage information is covered by Section 2.4 |
| Sensitive data | The Service is not designed to process special categories of personal data, and Customer will not ask Participants to provide them (MSA Section 4.4). Participants may still volunteer such information. Voice recordings are used only to create transcripts. The Service does not identify individuals by their voice or infer emotions. Safeguards: access controls, encryption, deletion of audio within 90 days, and Customer access limited to Final Responses |
| Frequency | Continuous during the Pilot Period and the Subscription Term |
| Nature of processing | Collection, recording, transcription, storage, analysis, structuring, retrieval, disclosure to Authorized Users and, during Interviews, to other Participants, and deletion |
| Purpose (business purposes) | Providing the Service: scheduling Interviews; conducting Interviews through the AI Interviewer; transcription; analysis; generating Outputs; support; and security. Creating Aggregated Data under MSA Section 6.4 |
| Retention | As described in Section 11 |
| Transfers to Subprocessors | As listed in Annex 3, for the same subject matter, nature, and duration as above |
C. Competent supervisory authority
For transfers under the SCCs, the supervisory authority determined under Clause 13 of the SCCs: (a) if Customer is established in an EU member state, the supervisory authority of that member state; (b) if Customer is not established in the EU but has appointed a representative under Article 27 of the GDPR, the supervisory authority of the member state where the representative is established; and (c) otherwise, the supervisory authority of the member state where the Participants whose Customer Personal Data is transferred are located. For transfers under the UK Addendum, the UK Information Commissioner's Office. For transfers under the FADP, the Swiss Federal Data Protection and Information Commissioner.
ANNEX 2 — TECHNICAL AND ORGANIZATIONAL MEASURES
| Area | Measures |
|---|---|
| Encryption | Customer Data is encrypted in transit and at rest |
| Personnel access | Multi-factor authentication and access logging for Decided personnel; access limited to personnel who need it; role-based access controls |
| Customer access | Single sign-on through Google and Microsoft; role-based access in the Service |
| Data minimization | Customer sees only Final Responses, not audio recordings, pre-final transcripts, or edits. Calendar access is limited to availability and invitations. Audio recordings are deleted within 90 days after the Interview |
| AI processing | No training or fine-tuning of AI models on Customer Data or Aggregated Data. No emotion inference or identification of individuals by voice. AI providers are used only on terms that do not permit them to train their models on Customer Data |
| Hosting and location | Hosted on Cloudflare. Customer Data is stored in the United States |
| Separation of customers | Customer Data is never shared with or used for another customer, except as Aggregated Data |
| Security testing | Regular penetration testing by an independent security firm |
| Personnel | Everyone with access is bound by confidentiality obligations and receives security training. Personnel do not use third-party AI tools on Customer Data |
| Devices | Laptops used to access Customer Data have full-disk encryption and run Cloudflare WARP endpoint controls |
| Subprocessors | Bound by written data protection terms (Section 7) |
| Backups | Automated, encrypted backups on Cloudflare, retained for up to 30 days |
| Incident response | Documented incident response process, owned by Decided's Chief Technology Officer, including Customer notification under Section 9 |
| Assurance | SOC 2 Type II audit in progress |
ANNEX 3 — SUBPROCESSORS
Decided updates this list under Section 7.3. Last updated: October 20, 2026.
| Subprocessor | Purpose | Processing location | Customer Personal Data |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, storage, backups, and network; hosting of the AI Interviewer's voice model | Storage: United States. Traffic in transit: Cloudflare data centers worldwide, usually the one nearest the user | All Customer Personal Data |
| OpenAI OpCo, LLC | AI model processing through the OpenAI API | United States | Interview Content, Outputs |
| PostHog, Inc. | Product analytics and session recordings. Interview answers and Outputs are masked and not recorded | United States | Authorized Users' and Participants' identifiers and usage of the Service |
| Heliom Inc. (Missive) | Customer support email | Canada (company); hosted on Amazon Web Services | Personal data included in support requests |
Customer's own Google Workspace or Microsoft 365 services, which Customer connects for single sign-on and calendar scheduling, are not Decided Subprocessors.
Change log
| Date | Change |
|---|---|
| October 20, 2026 | Initial list |