Databehandleraftale (DPA) GDPR art. 28

Version 1.3 | Version date: 24 August 2026 | Effective from acceptance of the Terms of Service


Controller	The legal entity on whose behalf an account has been created and Verbu's Terms of Service have been accepted, cf. the definition of "Customer" in the Terms of Service.
Processor	Verbu ApS, CVR no. 45855309, Nymarksvej 57, 5800 Nyborg, Denmark ("Verbu").
Entry into force	The DPA becomes binding when an authorised representative of the Controller accepts the DPA electronically as part of activating the Service, or when the DPA is otherwise entered into between the parties.

1. Instructions and purpose

Verbu processes personal data solely on documented instructions from the Controller. This DPA and Verbu's Terms of Service constitute the primary instructions. Verbu does not use personal data for its own purposes, including profiling, marketing or model training. The subject matter of the processing is described in Annex A. This DPA supplements Verbu's Terms of Service and forms an integral part of the contractual basis. In the event of any conflict between the DPA and the Terms of Service regarding the processing of personal data, the DPA prevails.

2. The Controller's obligations

The Controller is responsible for ensuring that a valid legal basis exists for all personal data processed via the Service, that data subjects are duly informed, and that the Service is not used to process special categories of personal data without prior written agreement with Verbu.

3. Security (TOMs)

Verbu has implemented and maintains technical and organisational security measures appropriate to the level of risk of the processing, cf. GDPR art. 32 and Annex B. The security measures are adjusted on an ongoing basis in line with technological developments and changes in the threat landscape.

4. Transcriptions and data retention

Verbu does not record calls. Calls are transcribed to text and made available to the Controller via the platform.

The Controller determines the retention period for transcriptions. Verbu retains transcriptions until the Controller requests deletion, or until the customer relationship ends, cf. section 9.

The Controller may at any time request deletion, in full or for a defined period, via legal@verbu.com. Verbu complies with the request without undue delay and no later than 30 days after receipt.

5. Sub-processors

The Controller hereby approves Verbu's use of the sub-processors set out in Annex C. Verbu gives written notice on the addition or replacement of sub-processors. The Controller has 10 days from the notice to object in writing.

If the parties cannot reach agreement before the expiry of the objection period, this DPA and the associated agreement terminate automatically upon expiry of the objection period. Payments for services already delivered are not refunded.

Verbu imposes on all sub-processors obligations equivalent to those in this DPA and remains fully liable for their compliance.

6. International transfers

Transfers to sub-processors in third countries take place on the basis of the European Commission's Standard Contractual Clauses (SCCs, Commission Implementing Decision (EU) 2021/914) or another valid transfer basis under GDPR Chapter V. Verbu carries out a transfer impact assessment (TIA) for processing in third countries. Verbu always uses an EU endpoint/server where this is available.

7. Data subjects' rights and personal data breaches

Verbu assists the Controller in responding to requests from data subjects to exercise their rights under GDPR Chapter III and forwards requests received directly within 3 working days.

In the event of a personal data breach affecting the Controller's personal data, Verbu notifies the Controller without undue delay and no later than within 24 hours with the information available at the time of notification.

8. Audit and documentation

Verbu makes available the documentation necessary to demonstrate compliance with this DPA. The Controller has the right to an audit at most once a year with 30 days' notice, during normal working hours and against reimbursement of Verbu's documented costs.

9. Termination and deletion

The DPA is valid for as long as Verbu processes personal data on behalf of the Controller. On termination, Verbu deletes or returns, at the Controller's choice, all of the Controller's personal data no later than 30 days after the termination date. Written confirmation is provided on request.

10. Liability, governing law and contact

The parties' liability is subject to the limitations set out in the Terms of Service, unless mandatory law requires otherwise. The DPA is governed by Danish law. Disputes are settled before the Odense City Court. The supervisory competence of the Danish Data Protection Agency is not affected.

Verbu DPA contact: Daniel Petersen, CEO, legal@verbu.com

Customers requiring a customised DPA may contact legal@verbu.com.

Annex A: Subject matter of the processing

GDPR art. 28(3) | Integral part of the DPA


Subject matter	Provision of Verbu's AI-driven voice agent platform ("the Service")
Duration	From entry into force until termination of the customer relationship
Nature of the processing	Collection, transmission, real-time analysis, transcription and structured output of voice data and text content. Voice data is processed transiently; transcriptions are stored and made available to the Controller via the platform.
Purpose	Provision, troubleshooting and securing of the Service in accordance with the Controller's instructions
Types of personal data	Phone number, conversation metadata, transcription content, company-specific configuration content, user account and login data
Categories of data subjects	End users and callers interacting with the Controller's voice agent; the Controller's employees with access to the platform; imported customer data.
Special categories	None. The Service must not be used to process special categories cf. GDPR art. 9 without prior written agreement.

Annex B: Security measures (TOMs)

GDPR art. 32 | Integral part of the DPA

Principle-based approach: Verbu implements and continuously adjusts security measures corresponding to the level of risk of the processing, the state of the art and the cost of implementation, cf. GDPR art. 32. Specific technical solutions may change without prior notice, provided that the overall level of security is maintained or improved.


Access control	Access to systems that process personal data is limited to authorised persons with a work-related need. Strong authentication (MFA) is required for access to production environments.
Cryptography	Personal data is encrypted in transit (TLS 1.3, HSTS) and at rest (AES-256 via cloud key management). Encryption keys are managed securely and rotated regularly.
Data minimisation and retention	Verbu does not record calls. Transcriptions are retained until the Controller requests deletion, or the customer relationship ends. The Controller determines the retention period. Language models and real-time services are configured with zero data retention.
Confidentiality	All employees and sub-contractors with access to personal data are subject to a written confidentiality obligation and receive relevant data protection training.
Incident management	Verbu monitors systems on an ongoing basis and maintains procedures for detecting, handling and notifying personal data breaches. The Controller is notified no later than 24 hours after Verbu becomes aware of a breach, cf. GDPR art. 33-34.
Supplier management	Sub-processors are subject to obligations equivalent to those in this DPA. Verbu assesses sub-processors' level of security prior to engagement. Verbu always uses an EU endpoint/server where this is available.

Annex C: Categories of sub-processors

Integral part of the DPA | General approval cf. section 5 | Confidential, disclosed under NDA

Verbu does not publish the names of individual sub-processors as part of this DPA. All sub-processors are subject to obligations equivalent to those in this DPA. The current list is available on request: www.verbu.com/legal/sub-processors.

Category	Place of processing	Activity	Safeguards
Telephony infrastructure and call routing	EU/EEA	Call routing and phone numbers	Individual DPAs
Speech synthesis and real-time transcription	EU/EEA	Real-time transcription (STT) and text-to-speech (TTS)	Data-minimised
Language models (LLM) and AI infrastructure	EU/EEA (some optional models in the USA)	Conversation generation and structured outputs	Zero data retention where available; SCCs for processing outside the EU/EEA
Real-time infrastructure and agent framework	EU/EEA	Real-time audio and core agent framework	Subject to a DPA equivalent to this one
Application hosting and compute	EU/EEA	Hosting of platform components	SOC 2-certified
Infrastructure and dedicated hosting	EU/EEA	Hosting of infrastructure components	EU-incorporated
Database hosting (incl. transcriptions)	EU/EEA	Storage of user data, metadata and transcriptions	Encryption
Transactional email infrastructure	EU/EEA	System notifications	Subject to a DPA equivalent to this one
Error logging	EU/EEA	System alerts and performance monitoring	Data scrubbing
LLM observability / tracing	EU/EEA	Model input/output logging	PII masking; subject to a DPA equivalent to this one