Legal

Data processing agreement

Version 1.0 · Last updated 28 October 2026

The data processing agreement between a Customer (controller) and Wolp (processor), with technical measures and the sub-processor list. It forms part of the Terms. This document is issued in English only; the English version is the sole and binding version.

1. Parties and roles. For content the Customer provides, data from the Customer's connected sources and data Wolp processes for the Customer, the Customer is controller and Tobias Kocúr, SZČO ("Wolp") is processor. The Customer is also controller of outreach recipients' data (the Customer supplies the contacts from its own lawful sources and chooses the recipients; Wolpers do not source leads) and Wolp is processor in every sending mode, including mail sent from Wolp's mailbox. Wolp is never a joint controller; it is controller solely for (i) Customer-user account, sign-in and security-log data, (ii) billing data, and (iii) abuse and security monitoring of the service, limited to the metadata needed to detect abuse. All content, contact and recipient data, including the suppression list, is processed as processor and only on the Customer's documented instruction, which includes honouring STOP requests and the mandatory AI disclosure. The suppression list is kept separately per Customer, with no look-up across Customers. The Customer documents that Wolp is instructed to stop a message or campaign that fails the policy check, for abuse detection (AUP). Wolp does not use Customer data for its own purposes: no model training, no cross-customer enrichment, no marketing. The Customer is responsible for the legal basis and content and indemnifies Wolp as set out in the Terms; Wolp may block an account or campaign. Forms part of the Terms; on data protection it prevails over the Terms.

2. Subject, duration, nature. Wolp processes personal data to provide the Wolp service for the term and the period in clause 9. Nature: storing, reading connected sources, writing and sending messages, processing replies, maintaining the suppression list. Purpose: solely providing the service per Customer instructions.

3. Data subjects and data. B2B contacts and recipients (name, business e-mail, role, company, communication content), Customer users (e-mail, sign-in and security data including IP), people appearing in connected sources. Special categories must not be processed (AUP).

4. Instructions. Wolp processes only on documented Customer instructions (configuration, brief, Terms), including with regard to transfers to third countries, unless required to do otherwise by Union or Member State law; in that case Wolp informs the Customer before processing, unless that law prohibits it. It informs the Customer if it considers an instruction unlawful.

5. Confidentiality. Authorised persons are bound by confidentiality.

6. Security (Annex 2). Measures appropriate under art. 32.

7. Sub-processors. The Customer gives general authorisation for the sub-processors in Annex 3. Wolp gives at least 30 days' notice of changes by e-mail to the account owner and at status.wolp.ai; within that period the Customer may object on reasonable grounds, otherwise terminate. Wolp imposes equivalent obligations on sub-processors and remains liable.

8. Transfers outside the EEA. For third-country transfers (e.g. US: Anthropic, Cloudflare, Google, Stripe) Wolp relies on an adequacy decision (EU-US Data Privacy Framework where the supplier is certified) or Standard Contractual Clauses (module 3 processor-to-processor) with a transfer impact assessment (TIA). If the Customer is outside the EEA, the relevant SCC modules apply. A TIA summary is available on request.

9. Return and deletion. At the end of the service Wolp, at the Customer's choice, returns (exports) and deletes the data within 30 days, except data it must retain by law; retention of campaign messages and audit is a Customer instruction, by default 3 months after campaign end; Wolp may propose a longer default (12 months once scaled) with 30 days' notice, and the Customer may reject it, set its own period within the plan maximum, or terminate; where the service ends mid-campaign the 30-day deletion period prevails; Wolp offers the suppression list for export before deletion; backups (PITR) expire within 30 days; LLM gateway backups 14 days (scheduling on the gateway host is not yet in place). Export and erasure of a tenant are handled manually on request.

10. Assistance. Wolp assists with data-subject rights (access, erasure, objection, opt-out) and with the Customer's obligations under arts. 32 to 36 GDPR (security, breach notification, DPIA, prior consultation) and supervisory-authority contact, to a reasonable extent. The Customer, as controller, carries out the DPIA; Wolp supplies the inputs. A data-subject request received by Wolp is forwarded to the Customer without undue delay.

11. Personal data breach. Wolp notifies the Customer without undue delay, as a target (not a guarantee) within 24 hours of detecting exposure of personal data, so the Customer can meet the 72-hour deadline of art. 33. The notice covers nature, scope, consequences and remedial steps.

12. Audit. Wolp provides information needed to demonstrate compliance and allows audits (reasonable notice, once a year, at the Customer's cost, without affecting other customers). Wolp may offer reports and certifications instead of on-site audit.

13. Liability. Per the Terms' limits, without prejudice to data-subject rights.

Annex 1: Processing details

Annex 2: Technical and organisational measures

• Access: invite-only, magic link + mandatory MFA, sessions 30 d idle / 90 d absolute, OAuth for agents.
• Isolation: tenant data lives in its own Durable Object; shared are the Registry DO (user e-mails, invite hashes) and D1 CONTROL (aggregate usage); tools run under risk classes with human approval.
• Encryption: TLS in transit; connection secrets encrypted in the vault (application-level encryption of the MFA secret is planned, see known gaps); secrets via OpenBao, agents never hold values.
• Outbound policy enforced in code (AI disclosure, STOP, suppression, dedup, approval).
• Logs contain no e-mail addresses, subjects or message content; IDs and error codes only.
• LLM gateway: message logging off, cache off, per-tenant spend tracking.
• Backups: PITR 30 d. Monitoring: Better Stack, /health without data.
• Incidents: SEV1 runbook, one on-call person, status.wolp.ai.
• Known gaps (not yet met): MFA secret stored in plaintext in the DO; enforcement in software of the campaign-message retention period (3 months after campaign end, 12 once scaled); no SOC 2 certification.

Annex 3: Sub-processors