Data processing agreement
Pre-signed by us. Read it, counter-sign it, and send it back. Nobody here has to be involved for you to have a signed agreement.
Version 1.0.0 Effective 2026-08-24 Last updated 2026-08-24
In short
Applies to: A business customer's legal team
- Pre-signed. Read it and counter-sign it without speaking to anybody here.
- Sub-processors are incorporated by reference and carry 30 days of notice.
- Transfers out of the UK and the EEA rely on Standard Contractual Clauses.
The parties
The processor under this agreement is the entity below. It is also the entity named in the footer of every page on this site.
- Legal entity: SNOWWANE LIMITED
- Company number: 13823125
- Registered address: Online company registered in England and Wales
- Data protection contact: privacy@tingvar.com
What is in it
| Item | What happens |
|---|---|
| Roles | You are the controller of the personal data in your sessions. Tingvar is your processor for it, and a controller only for your own account data |
| Subject matter and duration | Processing lasts for the term of your subscription and for the retention periods published in the privacy notice |
| Instructions | We process on your documented instructions. The instruction is your use of the product, and anything outside it needs your agreement |
| Confidentiality | Everyone with access is bound to confidentiality. Today that is one named person and the access is logged |
| Security measures | The measures are the controls published on the security page, incorporated by reference so the two cannot diverge |
| Sub-processors | General authorisation, with the list published and 30 days of notice before a new one begins processing |
| Transfers | Standard Contractual Clauses, with the UK Addendum where the UK GDPR applies. Processing is in the United States |
| Assistance | We help you answer a data subject request, a data protection impact assessment and a regulator, within the statutory windows |
| Breach notice | Without undue delay after we become aware, with what we know at the time rather than a complete report we do not have yet |
| Deletion and return | On termination, deletion of session content, with backups purged within 30 days. Billing records survive for 7 years because tax law requires it |
| Audit | Our documentation and our questionnaire responses first. An on-site audit where a regulator or a documented concern requires one |
The sub-processors it incorporates
The list is published rather than attached, so a change is visible without a contract amendment. It carries an effective date and 30 days of notice before a new vendor begins processing customer data.
| Vendor | Data it receives | Where |
|---|---|---|
| Google Cloud, Vertex AI | Your audio, your transcript, the brief, persona speech | us-central1, United States |
| Google Cloud, Speech-to-Text | Your audio, your transcript | us-central1, United States |
| Media server | Your audio and persona audio, in transit | Decided with the vendor |
| Paddle, merchant of record | Billing identifiers and transaction metadata | Decided with the vendor |
| Application hosting | Request metadata, account data, transcripts, the brief | Decided with the vendor |
| Brevo, transactional email | Your email address and the content of the message | Decided with the vendor |
| WorkOS, enterprise federation | Your email address, your name, and the group memberships your employer syncs | Decided with the vendor |
| Error monitoring | Stack traces. No request bodies | Decided with the vendor |
Getting a copy
A downloadable file is published here once the four outstanding entity details are supplied, because a signed PDF with a placeholder in the parties clause is worse than no PDF. Until then this page is the authoritative text and the version table below is how you cite it.
| Version | Published | What happens |
|---|---|---|
| 1.0.0 | 2026-08-24 | First publication. The parties clause is outstanding and labelled on this page |
Not yet produced
A signed document you can download and send to your own lawyer. The terms are published as text on this site already. The file waits on counsel and on the entity name that would sign it.
If your own paper has to be used
That is an enterprise conversation rather than a download. Write to the address below or book a demo and say so on the form.
legal@tingvar.com
Related questions
Do you have a DPA?
Yes, Tingvar publishes a pre-signed data processing agreement at tingvar.com/dpa that your legal team can read in full before speaking to anybody here. It carries the sub-processor list by reference, the 30 day change notice, and the transfer mechanism we rely on for customers outside the United States. There is no form in front of it and no call required. A signed file follows once the four outstanding entity details are supplied. If your own paper has to be used, the demo page is the route.