Conveo Data Processing Addendum
Effective date: 21/01/2026 · Version 1.0.0
Incorporation and roles
Incorporation. This Data Processing Addendum (“DPA”) forms part of the agreement under which Conveo provides the Services — the Conveo Terms of Service, a Master Services Agreement, or the Conveo Partner Program Terms, as applicable (the “Agreement”) — between the Conveo entity that is party to the Agreement (“Supplier”) and the customer or partner entity that has entered into the Agreement (“Customer”). The Supplier entity is the one identified in the Agreement, at enrollment, or on the applicable Order Form:
EU & rest of world (default)
Conveo.AI BV
Frankrijklei 5 bus 151/18, 2000 Antwerp, Belgium · RLE (Antwerp) 1008.424.866 · VAT BE1008.424.866
United Kingdom
Conveo.AI UK LTD
Company no. 16650919 · 3rd Floor, 1 Ashley Road, Altrincham, Cheshire WA14 2DT, United Kingdom
United States
Conveo.ai USA LLC
Delaware LLC · EIN 39-3422291 · 1401 Pennsylvania Ave #3073, Suite 105, Wilmington, DE 19806, USA
Effective date. It takes effect upon Customer’s acceptance of the Agreement or first use of the Services, whichever is earlier — no signature is required.
Precedence. Where the parties have executed a separate signed DPA, that signed DPA prevails over this document.
Customer role. For the Services, Customer acts as Controller.
Supplier role. For the Services, Supplier acts as Processor.
Sub-processor role. If and to the extent Customer acts as a Processor on behalf of its own customer, Supplier acts as Customer’s Sub-processor.
Limited controller role. Exceptionally, Supplier acts as Controller during the participant data-collection process for its independent obligations, disclosing the transfer of the controller role to participants after an interview completes.
Scope and duration. This DPA covers the obligations of Art. 28 GDPR and sets out the parties’ respective rights and obligations in respect of the Processing of Personal Data for the purpose of executing the Agreement. It has the same term as the Agreement (including renewals) and terminates upon the later of the Agreement’s termination or the moment Supplier no longer processes Personal Data on behalf of Customer.
1. Definitions
“Affiliates” — any entity, present or future, that controls, is controlled by, or is under common control with Customer, directly or indirectly.
“Annex” — the annexes to this DPA, which form an integral part of it.
“Controller” — has the meaning given in Article 4 GDPR.
“Processor” — has the meaning given in Article 4 GDPR.
“Data Subject” — has the meaning given in Article 4 GDPR.
“Personal Data” — has the meaning given in Article 4 GDPR.
“Personal Data Breach” — has the meaning given in Article 4 GDPR.
“Supervisory Authority” — has the meaning given in Article 4 GDPR.
“Processing” — has the meaning given in Article 4 GDPR.
“Data Protection Legislation” — (i) Regulation 2016/679 (GDPR) and (ii) the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
“International Transfer” — a transfer of Personal Data to a country outside the EEA or to an international organization, or any access to Personal Data from such location.
“Transfer Impact Assessment (TIA)” — an assessment of the laws and practices of the third country relevant to the International Transfer as required by the SCCs and EDPB guidance.
“Third Party” — any person or entity which is not a party to the Agreement; Sub-processors are Third Parties subject to the additional requirements of Section 5.
“Services” — the services provided by Supplier to Customer under the Agreement.
“Sub-processor” — any third party engaged by Supplier (including Supplier’s affiliates) that Processes Personal Data on behalf of Supplier in connection with the Services.
“Sub-processor List” — Supplier’s public list of current Sub-processors at trust.conveo.ai/subprocessors (or a successor URL notified to Customer).
“Change of Sub-processor” — an addition or replacement of a Sub-processor or a material change in the Processing activities of an existing Sub-processor.
Currency. Unless expressly stated otherwise, all amounts under this DPA are in Euro (EUR).
2. General provisions
2.1 Purpose of Processing. The purpose of the Processing of Personal Data is determined by Customer (or, where Customer acts as processor, by Customer’s own customer as controller) and is carried out with the resources provided by Supplier in its capacity of Processor or Sub-processor.
2.2 Controller responsibility. The Processing takes place under the responsibility of the Controller concerned. Supplier has no control over the purpose and means of the Processing.
2.3 International transfers. In the case of an International Transfer, the parties rely on either (i) an adequacy decision under GDPR Article 45, or (ii) the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914; Module 2 and/or 3 as applicable), together with a documented Transfer Impact Assessment and any supplementary measures required.
2.4 Precedence. In case of conflict between this DPA and the Agreement, the Agreement prevails, except where mandatory Data Protection Legislation or the Standard Contractual Clauses require a higher level of protection — in which case this DPA/the SCCs control for that issue alone.
2.5 Scope and duration. The Agreement and this DPA jointly determine the subject matter and duration of the Processing. The parties guarantee compliance with Data Protection Legislation and this DPA.
3. Rights and obligations of Customer
3.1 Provision of Personal Data. Customer makes the necessary Personal Data available to Supplier in the context of the execution of the Agreement.
3.2 Controller responsibility. Customer (or its own customer, where applicable) is the responsible body within the meaning of Article 4(7) GDPR. Supplier has the right to inform Customer if it is of the opinion that a processing instruction breaches applicable data protection law.
3.3 Data Subject rights. Customer is responsible for safeguarding Data Subjects’ rights. Supplier shall promptly inform Customer if Data Subjects assert their rights against Supplier.
3.4 Supplementary instructions. Customer may issue supplementary instructions concerning the nature, scope and procedure of the Processing at any time, in text form (e.g. email). Remuneration of additional expenses caused by supplementary instructions remains unaffected.
3.5 Errors and irregularities. Customer shall promptly inform Supplier of any errors or irregularities it identifies in connection with the Processing.
3.6 Reporting obligations. Where information obligations toward Third Parties under Articles 33–34 GDPR or other statutory reporting obligations apply to the Controller, the Controller is responsible for fulfilling them.
4. Rights and obligations of the (Sub-)Processor
4.1 Processing limitations. Supplier will only process the Personal Data strictly necessary for the execution of the Agreement and only as stated in this DPA.
4.2 Processing instructions and legal requirements. Supplier will only Process or disclose Personal Data (a) in accordance with this DPA, or (b) where required by EU or Member State law, in which case Supplier shall inform Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.
4.3 Confidentiality. Supplier shall take reasonable steps to ensure that all employees, agents and Sub-processors with access to Personal Data are informed of its confidential nature and are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
4.4 Retention, return and deletion. Supplier processes Personal Data for as long as necessary for the execution of the Agreement, ceases Processing upon its termination or expiry (or the end of the relevant Service, if sooner) and, at Customer’s option, returns or deletes the Personal Data and copies, without prejudice to EU or Member State retention obligations.
4.5 Assistance and cooperation. Supplier shall cooperate as reasonably requested by Customer (i) to enable Customer or its customer to comply with Data Subjects’ exercises of rights, and (ii) for data protection impact assessments and prior consultations of the Supervisory Authority, and will assist in answering requests of the Supervisory Authority.
5. Sub-contracting
5.1 General authorization. Customer provides a general authorization for Supplier to engage Sub-processors in connection with the Services. Supplier’s current Sub-processors are listed on the Sub-processor List.
5.2 Notice of changes. Supplier shall provide at least thirty (30) days’ prior notice of any intended Change of Sub-processor by updating the Sub-processor List and notifying Customer via email to the contact provided for data protection notices. In urgent cases required to maintain service continuity or security, Supplier may appoint a Sub-processor on shorter notice and will notify Customer without undue delay thereafter.
5.3 Right to object. Customer may object in writing to a Change of Sub-processor on reasonable, concrete data-protection grounds within ten (10) days after notice. The parties will discuss in good faith; if no resolution is reached within thirty (30) days, Customer may suspend or, if suspension is not feasible, terminate the affected Service only without penalty, with a refund of prepaid fees for the terminated, unused portion.
5.4 Flow-down. Supplier imposes on each Sub-processor data protection obligations no less protective than this DPA, including confidentiality, security, assistance, and deletion/return.
5.5 Responsibility. Supplier remains fully responsible for each Sub-processor’s performance.
5.6 Due diligence. Supplier conducts appropriate due diligence before engaging a Sub-processor and monitors continued compliance, including through contract review and, where appropriate, independent audit reports.
5.7 International transfers. Where a Sub-processor is located outside the EEA (or accesses Personal Data from a third country), Supplier ensures a valid transfer mechanism under GDPR Chapter V, plus supplementary measures as identified in Supplier’s transfer impact assessment.
5.8 Records. Supplier maintains a record of Sub-processors engaged for the Services, available on request. Certified Conveo service partners performing Conveo-routed work act as Sub-processors under this Section and appear on the Sub-processor List.
6. Security
6.1 Technical and organisational measures. Supplier implements and maintains appropriate technical and organisational measures (“TOMs”) per Article 32 GDPR, described at trust.conveo.ai (Annex 1) and updatable per clause 6.4.
6.2 Security assessment. In assessing the appropriate level of security, Supplier takes into account the state of the art, implementation costs, and the nature, scope, context and purposes of Processing and the risks to natural persons. The TOMs address pseudonymisation and encryption; ongoing confidentiality, integrity, availability and resilience; timely restoration after incidents; and regular testing and evaluation.
6.3 Security programme. Supplier operates a risk-based information security program aligned with recognised frameworks (e.g. ISO/IEC 27001, SOC 2), reviews its TOMs at least annually and after material changes, and ensures personnel with access to Personal Data are under confidentiality obligations and receive security and privacy training.
6.4 Updates to TOMs. Supplier may update its TOMs to reflect technological developments, provided updates do not materially decrease the overall security of the Services.
6.5 Additional measures. Additional or bespoke measures requested by Customer beyond the baseline are discussed in good faith, agreed in writing, and implemented at Customer’s cost unless required by Supplier’s non-compliance.
6.6 Material TOM changes. Supplier notifies Customer of material TOM changes reasonably expected to materially reduce overall security at least thirty (30) days in advance where feasible, otherwise without undue delay; emergency changes may take immediate effect with notice thereafter.
6.7 Security contact. [email protected].
7. Data Breach
7.1 Notification. If Supplier becomes aware of a Personal Data Breach affecting Personal Data, Supplier shall notify Customer without undue delay and in any case within seventy-two (72) hours of becoming aware, including (to the extent known): the nature of the breach; the categories and approximate number of Data Subjects and records concerned; likely consequences; and measures taken or proposed, with rolling updates as facts emerge.
7.2 Cooperation. Supplier shall cooperate without undue delay with Customer (and, where applicable, Customer’s customer) in investigating, mitigating and remediating the breach, and shall document the facts, effects and corrective actions.
7.3 Remedy and mitigation. Supplier will take reasonable and prompt steps to remedy and mitigate the effects of any Personal Data Breach.
8. Audit and information rights
8.1 Documentation and third-party reports. On written request, Supplier makes available information reasonably necessary to demonstrate compliance: summaries of relevant policies and TOMs; current third-party audit/certification reports; and a high-level summary of the most recent penetration test and remediation status. Supplier responds to materially equivalent security questionnaires once per 12-month period.
8.2 Right to audit. If clause 8.1 information does not reasonably demonstrate compliance, Customer may audit no more than once per rolling 12 months (except per clause 8.6), on 30+ days’ notice, during business hours, minimising disruption, and records-first.
8.3 Scope and safeguards. Audits are limited to the Processing of Customer Personal Data and relevant systems and locations, and never require disclosure of other customers’ information, trade secrets or source code, pricing, or information whose disclosure would breach law or third-party confidentiality.
8.4 Costs. At Customer’s expense; if a material non-compliance is identified, Supplier reimburses reasonable, evidenced audit costs.
8.5 Remediation. Agreed remedial actions are implemented within sixty (60) days of agreement, with written status updates until closure.
8.6 Regulator/incident-driven audits. Additional audits may be conducted where required by a Supervisory Authority, following a confirmed breach affecting Customer Personal Data, or on a material change in applicable law.
8.7 Authorities. Supplier makes clause 8.1–8.5 information available to a competent Supervisory Authority on lawful request.
8.8 Confidentiality of audit materials. Audit information is Supplier’s Confidential Information, used solely to verify compliance, shared on a need-to-know basis, and deleted or returned after the audit and remediation unless retention is legally required.
9. Transfer of Personal Data
9.1 Lawful mechanisms. International Transfers occur only under a valid GDPR Chapter V mechanism: an adequacy decision (Art. 45) or the EU SCCs (2021/914; Module 2 and/or 3), with a documented TIA and supplementary measures where required.
9.2 No separate consent. Where Supplier relies on a valid mechanism and complies with the Section 5 notice regime, no separate prior written consent of Customer is required for International Transfers.
9.3 SCC incorporation. Where used, the SCCs are deemed entered into between the parties by reference, with the Appendix populated by Annex 1 of this DPA for SCC Annex I, the TOMs at trust.conveo.ai for SCC Annex II, and the Sub-processor List for SCC Annex III. Governing law and forum for the SCCs: Belgium.
9.4 Government access. Supplier handles government access requests per SCC Clauses 14–15, notifies Customer without undue delay where legally permitted, and documents its assessment and responses.
9.5 Records. Supplier maintains records of relevant International Transfers and provides high-level TIA conclusions and descriptions of supplementary measures, subject to confidentiality.
9.6 Minimization and localization. Transfers are limited to what the Services require; Supplier prefers Processing within the EEA where feasible.
10. Liability
Liability. Each party shall be liable under this DPA in accordance with the Agreement.
Aggregate application. The parties’ total aggregate liability arising out of or in connection with the Agreement and this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement, which shall apply in aggregate across the Agreement and this DPA together.
11. Duration and termination
11.1 Term. This DPA enters into force upon acceptance of, or incorporation into, the Agreement and lasts for the duration of the Agreement.
11.2 Termination. It terminates with the Agreement and cannot be terminated separately, unless the parties agree termination is necessary to comply with Data Protection Legislation or decisions of the Supervisory Authority.
11.3 Return and deletion. At the end of this DPA, all Personal Data processed shall, at Customer’s option, be deleted or returned. Supplier provides the information and documentation necessary for subsequent Processing, terminates the Processing after transfer, destroys remaining back-ups within four (4) weeks insofar as technically possible, and demonstrates complete deletion or return on request.
12. Applicable law and disputes
12.1 Governing law. This DPA is governed by Belgian law.
12.2 Disputes. Disputes are settled by the competent court determined in the Agreement.
13. Miscellaneous
13.1 Changes in law. If new guidance or a change in Data Protection Legislation or case law renders all or part of the Services illegal, Customer may terminate the Agreement unless the parties agree changes that restore legality.
13.2 Severability. Invalid or unenforceable provisions are severable; the remainder stands. If an invalid provision is fundamental, the parties negotiate in good faith to achieve its purpose.
13.3 Amendments. This DPA may be updated in accordance with the amendment mechanism of the Agreement into which it is incorporated; material changes will be notified to Customer, and the version in force at any time is published, with its archive, at conveo.ai/dpa. Where a signed DPA exists, it may only be changed by written amendment signed by both parties.
Annex 1 — Details of the Processing
Subject matter and nature of the Processing. Hosting, recording, transcription, AI-assisted moderation and analysis, storage, display and export of research study content and responses on the Conveo Platform, as configured and instructed by Customer through the platform.
Purpose. The performance of qualitative and quantitative research studies and related insight generation for Customer (or, where Customer is an agency, for its end clients), as instructed through the platform.
Duration. The term of the Agreement, plus the return/deletion period of clause 11.3.
Categories of Data Subjects. Research participants (respondents); Customer’s Users; and Customer contacts.
Categories of Personal Data. For participants — video, audio, transcripts, screener and demographic attributes, and any personal data participants share in their responses; for Users and contacts — identification and contact data, authentication data, and usage logs.
Special categories of data. None by default; the Agreement prohibits inputting special-category data unless explicitly permitted in writing and governed by an executed DPA covering it.
Technical and organisational measures. As described at trust.conveo.ai.
Contact for data protection notices. The administrator email address(es) of Customer’s organisation, as maintained in the platform.
Annex 2 — Standard Contractual Clauses
The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Modules 2 and 3 as applicable) are incorporated by reference per clause 9.3, with the Appendix populated as stated there. The full text is available at the European Commission’s website, eur-lex.europa.eu/eli/dec_impl/2021/914/oj, and, as executed between the parties by incorporation, from Supplier on request.
Annex 3 — Sub-processor List
The current list, including certified Conveo service partners engaged for Conveo-routed work: trust.conveo.ai/subprocessors.