Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Dictate ("Processor") and you ("Controller") to the extent that Dictate processes Personal Data on behalf of the Controller.

2. Definitions

• "Personal Data" - Any information relating to an identified or identifiable natural person
• "Processing" - Any operation performed on Personal Data
• "Controller" - The entity that determines the purposes and means of Processing
• "Processor" - The entity that processes Personal Data on behalf of the Controller
• "GDPR" - General Data Protection Regulation (EU) 2016/679

3. Scope of Processing

Subject Matter: Dictate provides a frame-level audio relay service that transmits audio data between the Controller's end-users and upstream speech recognition providers.

Nature of Processing: Audio bytes are relayed in real-time without decoding, recording, or storage. Only metadata (duration, timestamps, session IDs) is stored.

Purpose: To enable real-time speech-to-text transcription through secure relay.

4. Processor Obligations

• Process Personal Data only on documented instructions from the Controller
• Ensure personnel authorized to process Personal Data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Not engage sub-processors without Controller's prior written consent
• Assist the Controller in fulfilling data subject rights requests
• Delete or return all Personal Data upon termination

5. Security Measures

Dictate implements the following security measures:

• Encryption in transit (TLS 1.2+)
• Encrypted storage of API credentials
• Access control and authentication
• Regular security assessments
• Frame-level relay (no decoding, no storage of audio content)

6. Data Subject Rights

Dictate assists the Controller in responding to requests from data subjects exercising their rights under GDPR, including:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object

7. Sub-Processors

Current sub-processors:

8. Data Breach Notification

In the event of a Personal Data breach, Dictate shall notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of the breach, providing sufficient information to allow the Controller to meet its obligations under GDPR.

9. Audits

Dictate makes available all information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

10. Contact

For questions about this Data Processing Agreement, please contact:
support@dictate.top