Data Processing Agreement

01Scope and Incorporation

1.1 This Data Processing Agreement (“DPA”) forms part of every Business Consulting Agreement or other service agreement (the “Agreement”) between Smart Mentoring Oy (“Smart Mentoring” or “Processor”) and its business client (the “Client” or “Controller”) that refers to this DPA. The Client accepts this DPA by signing the Agreement. No separate signature is required.

1.2 The version of this DPA that applies is the version identified in the Agreement (or, if none is identified, the version published at smartmentoring.com/dpa on the date the Agreement is signed). Each version is archived by Smart Mentoring, is not altered after publication and is provided to the Client on request.

1.3 This DPA applies only where Smart Mentoring processes personal data on behalf of the Client in connection with the services (“Client Personal Data”). It does not apply to personal data that Smart Mentoring processes as an independent controller, such as the contact, billing and engagement data of the Client’s own representatives, which is processed in accordance with Smart Mentoring’s Privacy Policy.

1.4 Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in Regulation (EU) 2016/679 (“GDPR”). “Data Protection Law” means the GDPR, the Finnish Data Protection Act (1050/2018) and, where applicable, the UK GDPR.

1.5 If this DPA and the Agreement conflict on a matter of personal data protection, this DPA prevails.

02Details of the Processing

2.1 The subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

2.2 Smart Mentoring processes Client Personal Data only for the purpose of providing the services under the Agreement.

03Obligations of the Client (Controller)

3.1 The Client is responsible for the lawfulness of the processing it instructs, including having a valid legal basis, and for providing data subjects with the information required by Articles 13 and 14 GDPR.

3.2 Where the Client shares recordings or transcripts of its own sales calls, meetings or other communications, the Client is responsible for informing the participants of the recording and, where required, obtaining their consent.

3.3 The Client shall share only the personal data that is necessary for the services and shall not share special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR) unless agreed in writing in advance.

04Obligations of Smart Mentoring (Processor)

4.1 Instructions. Smart Mentoring processes Client Personal Data only on the Client’s documented instructions, including with regard to transfers to third countries, unless required to do so by EU or Member State law; in that case Smart Mentoring informs the Client of the legal requirement before processing, unless the law prohibits this. The Agreement, this DPA and the Client’s written instructions (including by email or in a shared workspace) constitute the Client’s documented instructions. Smart Mentoring informs the Client without delay if, in its opinion, an instruction infringes Data Protection Law.

4.2 Confidentiality. Smart Mentoring ensures that all persons authorised to process Client Personal Data, including its employees and subcontracted team members, are bound by an obligation of confidentiality and receive access only to the extent necessary for the services.

4.3 Security. Smart Mentoring implements the technical and organisational measures required by Article 32 GDPR, as described in Annex 2, taking into account the state of the art, the costs of implementation and the risks to data subjects.

4.4 Assistance. Taking into account the nature of the processing, Smart Mentoring assists the Client by appropriate measures in responding to requests from data subjects exercising their rights, and in meeting the Client’s obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments and prior consultation). Smart Mentoring forwards any data subject request it receives regarding Client Personal Data to the Client without undue delay and does not respond to it unless authorised by the Client.

4.5 Personal data breaches. Smart Mentoring notifies the Client without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. The notification includes the information available to Smart Mentoring that the Client needs to meet its own obligations, and Smart Mentoring takes reasonable steps to contain and remedy the breach.

4.6 Client systems. Where the Client grants Smart Mentoring access to its own systems (for example CRM, email marketing, advertising or analytics accounts), Smart Mentoring uses that access only for the services and only through the named team members agreed with the Client. The providers of those systems are the Client’s own service providers and not sub-processors of Smart Mentoring. The Client may revoke access at any time.

05Use of Artificial Intelligence Tools

5.1 Smart Mentoring may use the AI tools listed in Annex 3 to analyse, summarise and draft material for the Client, for example to analyse sales call transcripts or prepare offer, sales and marketing materials. These AI providers act as sub-processors under Section 6.

5.2 Smart Mentoring uses AI tools only under business or API terms under which the provider does not use the data submitted to train its general models, and does not give AI tools standing access to the Client’s systems.

5.3 Smart Mentoring minimises the personal data submitted to AI tools, for example by removing or pseudonymising names and contact details where this is practical. All AI-assisted output is reviewed by a person before it is delivered or used. No decisions producing legal or similarly significant effects on data subjects are made solely by automated means.

5.4 The Client may instruct Smart Mentoring in writing to exclude specified Client Personal Data from AI-assisted processing, and Smart Mentoring will follow that instruction.

06Sub-processors

6.1 The Client gives Smart Mentoring general written authorisation to engage the sub-processors listed in Annex 3, as updated from time to time in accordance with this Section.

6.2 Smart Mentoring informs the Client of any intended addition or replacement of a sub-processor at least 14 days in advance by email or by updating Annex 3 with a notice to the Client. The Client may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Smart Mentoring will not use the new sub-processor for the Client’s data, or, if this is not reasonably possible, either party may terminate the affected part of the services without penalty.

6.3 Smart Mentoring imposes on each sub-processor, by written contract, data protection obligations that provide at least the level of protection required by Article 28(3) GDPR, and remains responsible to the Client for the performance of each sub-processor’s obligations.

07International Transfers

7.1 Smart Mentoring transfers Client Personal Data outside the EU/EEA only where the transfer complies with Chapter V GDPR, relying on (a) an adequacy decision of the European Commission, including the EU–U.S. Data Privacy Framework for certified recipients, or (b) the European Commission’s Standard Contractual Clauses together with any supplementary measures required.

7.2 The location and transfer mechanism of each sub-processor are listed in Annex 3.

08Deletion and Return

8.1 Upon termination or expiry of the Agreement, Smart Mentoring deletes Client Personal Data within 30 days, or returns it to the Client first if the Client so requests in writing before the end of the Agreement, unless EU or Member State law requires storage. Data in backups is deleted in accordance with the normal backup cycle and is not restored to active use.

8.2 Deliverables that do not contain personal data, and anonymised or aggregated data that no longer identifies any individual, are not affected by this Section.

09Information and Audits

9.1 Smart Mentoring makes available to the Client the information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Client or an auditor mandated by the Client.

9.2 Audits are requested in writing at least 30 days in advance, are carried out during normal business hours, no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach, and are subject to confidentiality. Each party bears its own costs, unless the audit reveals a material breach by Smart Mentoring.

10Liability, Term and Changes

10.1 Each party’s liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Law does not permit such limitation. Nothing in this DPA limits the rights of data subjects under Article 82 GDPR.

10.2 This DPA remains in force as long as Smart Mentoring processes Client Personal Data, even after the Agreement has ended.

10.3 Smart Mentoring may publish new versions of this DPA. A new version applies to an existing Agreement only if the Client agrees to it, or if it is required by Data Protection Law or does not reduce the protection of Client Personal Data and the Client has been notified at least 30 days in advance. Changes to Annex 3 follow Section 6.

10.4 This DPA is governed by the laws of Finland. Disputes are resolved as provided in the Agreement.

11Contact

Data protection matters and notifications under this DPA: Smart Mentoring Oy, [email protected], Eerikinkatu 32–36, 00180 Helsinki, Finland. Notifications to the Client are sent to the email address used by the Client in connection with the Agreement.

A1Annex 1 — Details of the Processing

Subject matter and purpose

Provision of business consulting services in sales, marketing, pricing, offer development and business strategy, including analysis of the Client’s sales and marketing performance, preparation of materials and support in the Client’s sales and marketing activities.

Nature of processing

Collection, receipt, storage, organisation, analysis, transcription, summarisation, AI-assisted processing, use in drafting, retrieval, transmission within the team, and deletion.

Categories of data subjects

The Client’s prospects and leads, customers, email subscribers and audience members, participants in the Client’s sales calls and meetings, and the Client’s employees and contractors.

Types of personal data

Names and contact details (email, phone, social media profile); company and job title; CRM, lead and pipeline data (source, status, notes, purchase history); recordings and transcripts of sales calls and meetings (voice, image, content of conversation); email and message content; survey and application form answers; campaign, advertising and analytics data relating to identifiable persons.

Special categories

None intended. See Section 3.3.

Duration

The term of the Agreement and the deletion period in Section 8.

A2Annex 2 — Technical and Organisational Measures

• Access to Client Personal Data is restricted to team members who need it for the services; access rights are removed when no longer needed.
• Personal user accounts, strong passwords and multi-factor authentication on core systems where available.
• Encryption in transit (TLS) and encryption at rest as provided by the sub-processors’ platforms.
• Client data is stored only in the approved systems listed in Annex 3, not on removable media or personal accounts.
• Written confidentiality obligations for all employees and subcontracted team members.
• Data minimisation and pseudonymisation before AI-assisted processing where practical (Section 5).
• Sub-processors selected on the basis of their security and data protection commitments.
• Documented procedure for handling and notifying personal data breaches.
• Deletion of Client Personal Data at the end of the engagement (Section 8).

A3Annex 3 — Sub-processors

Last updated: 23 October 2026