Data Processing Agreement (DPA)
Auftragsverarbeitungsvertrag gem. Art. 28 DSGVO · Last updated: 13.08.2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Glomastco Ltd (the "Processor") and the customer (the "Controller") and governs the processing of personal data on the Controller's behalf.
1. Subject and duration
The Processor processes personal data solely to provide the contractually agreed services, for the duration of the underlying contract.
2. Nature and purpose of processing
Reading, summarising, translating and drafting replies to messages/e-mails submitted by the Controller, and storing the results to provide the service.
3. Categories of data subjects and data
- Data subjects: the Controller's contacts, customers and correspondents.
- Data: contents of messages, sender/recipient addresses, and any personal data contained therein.
4. Obligations of the Processor
- Process data only on documented instructions of the Controller.
- Ensure confidentiality of personnel authorised to process data.
- Implement appropriate technical and organisational measures (Art. 32 GDPR).
- Assist the Controller with data subject requests and breach notifications.
- Delete or return personal data after the end of the service, on request.
5. Sub-processors
The Processor engages the following sub-processors. The Controller is informed of any intended changes.
- AI model provider(s) — for generating summaries and replies.
- Hosting / infrastructure provider — for operating the service.
A current sub-processor list is available on request at hello@smartreplyassistant.com.
6. Technical and organisational measures (Art. 32)
- Encryption in transit (TLS) and at rest for stored message content.
- Access controls, least-privilege, audit logging.
- Data minimisation; optional local-only caching mode (no server-side storage).
7. Data location and transfers
Processing takes place within the EU/EEA where available; international transfers are safeguarded by Standard Contractual Clauses where applicable.
8. Deletion and audit
The Controller may request export or deletion of data at any time. The Processor supports audits as required by Art. 28(3)(h) GDPR.
Glomastco Ltd · Elia Christodoulou 46, 8510 Kouklia, Paphos, Cyprus · hello@smartreplyassistant.com · VAT: CY10430024W