The AskCody Data Processing Agreement (DPA)

DPA UPDATE NOTICE

An Update to the AskCody Data Processing Agreement

For AskCody customers and data protection contacts | Effective 6th of July 2026

We have refreshed the AskCody Data Processing Agreement (DPA). The update was prepared with our external legal counsel and is about clarity and precision. It does not reduce the protections you have, and it does not change how we secure or process your data. It also reflects one new sub-processor, described below. This note explains what changed and why, so you have the full picture.

What changed

Clearer, plainer wording

We tightened the language throughout and removed passages that were redundant or hard to follow. The structure still follows the Europen Data Protection Board’s and Danish Data Protection Agency's official processor template under Article 28 of the GDPR, so the agreement remains a recognised, pre-approved standard.

The right supervisory authority for you

Where the DPA previously named the Danish Data Protection Agency, it now refers to "the competent supervisory authority." Your competent authority depends on where your organisation is based. This change makes the agreement correct for every customer, wherever you operate, rather than pointing to the Danish authority by default.

Our 24-hour breach notification is reaffirmed

If a personal data breach affects your data, AskCody notifies you without undue delay and no later than 24 hours after we become aware of it. That commitment is unchanged, and we have made sure it reads consistently across the whole agreement.

Clearer audit provisions

Your right to audit and inspect AskCody as your data processor is unchanged. We clarified how assurance over our sub-processors works: rather than implying you can audit providers like our cloud infrastructure directly, the DPA reflects how this is done in practice. We demonstrate our sub-processors' compliance through our annual independent ISAE 3000 audit and supporting documentation, which we make available to you on request.

Clearer description of processing

We rewrote the appendices describing the purpose and nature of the processing, and our instructions, in plainer language. The substance of what we process, and why, is the same.

A new sub-processor: FoldSpace, for the Copilot AI Assistant in AskCody

We have added one new sub-processor, FoldSpace (Foldspace.ai inc.), which powers the AskCody Copilot AI Assistant. FoldSpace processes the same categories of data AskCody already processes on your behalf, namely business contact details and meeting data, solely to provide the Copilot AI Assistant feature. It does not receive any new category of personal data.

The safeguards are the same ones you already rely on across our sub-processors. Data is sent over encrypted connections (HTTPS/TLS), encrypted at rest, and protected with supplementary measures including encryption and pseudonymisation. FoldSpace is hosted on Google Cloud Platform in the United States, and transfers rely on the EU-US Data Privacy Framework together with EU Standard Contractual Clauses and supplementary measures.

As with any change to our sub-processors, this is notified to you in advance under the DPA, and you may object within the notice period set out in the agreement. All other sub-processors are unchanged, and the full, current list remains available in Appendix B to the DPA.

Why you do not need to worry

Nothing in this update weakens your protection or our security posture. The same independent ISAE 3000 audit continues each year. The same Microsoft Azure infrastructure remains in place, and the one new sub-processor is covered by the same transfer safeguards and security measures as the others. Our obligations as your processor under Article 28 of the GDPR are fully maintained. In short, this is a clarity and accuracy update, reviewed by external counsel, plus one clearly disclosed sub-processor addition, not a change to the commitments you rely on.

What you need to do

For most customers, no action is needed. The updated DPA applies going forward and is available to you on request. If your organisation has a signed DPA that references specific clause numbering, if you would like a countersigned copy of the new version, or if you have questions about the new sub-processor, contact us and we will arrange it.

Questions

We are happy to walk you through any of these changes. Please reach us at privacy@askcody.com and we will help.

DATA PROCESSING AGREEMENT FOR ASKCODY