Data Processing Agreement (business and organisation customers)

Draft agreement – under review · Last updated 16 October 2026. This is an English translation of the Finnish original; if the versions differ, the Finnish version applies.

This data processing agreement (Article 28 of Regulation (EU) 2016/679, GDPR) is part of the Terms of Service and applies when an organisation (the "Customer": for example a church, school, association or company) uses Espero's event features and Quiet North, Inc. ("Espero") processes personal data on the Customer's behalf. Events organised by a private individual are covered by the Privacy Policy.

1. Roles

The Customer is the controller and Espero the processor of the following data: the speech at the Customer's events and its transcript, captions and translations, song lyrics saved by the Customer and their translations, questions shown on the projector, listener counts and listeners' technical identifiers, and event feedback ("Customer Data"). Espero is an independent controller of user accounts, messaging between users, payments, trial-abuse prevention and the security and development of its own service, as described in the Privacy Policy.

2. Subject matter, duration, nature and purpose of the processing

Espero turns the speech at the Customer's events into text, translates it into the languages chosen by the Customer and the listeners, reads translations aloud, shows the captions to the members of the Customer's group and to viewing-link holders, produces listener counts and feedback for the Customer, and keeps the text for the period described in section 3b of the Privacy Policy: captions and listener data 30 days from the start of the broadcast; song lyrics saved for an event 30 days after the last save, at the earliest a week after the event ends and at the latest after one year, or earlier when the Customer deletes them or the event's group; when the lyrics library is enabled, library lyrics until the Customer deletes them. The processing lasts for as long as the Customer uses the event features and, for the data, until it has been deleted.

Data subjects: speakers, participants and listeners at events, and people mentioned in the captions. Categories of data: speech and the text and translations made from it; song lyrics; questions, without the sender's name for listeners and with it for the Customer; listeners' account identifier or random device identifier, language, listening status and lag; feedback answers under a keyed identifier. Speech may include special categories of personal data, such as religious beliefs or health information; the Customer is responsible for the lawful basis of their processing and for the information given to participants.

3. The Customer's instructions

Espero processes Customer Data only on the Customer's documented instructions. The instructions are the Terms of Service, this agreement and the choices the Customer makes in the event features: starting and pausing captioning, languages, the viewing link, downloading, correcting lines, song lyrics and deletions. If Espero considers that an instruction infringes data protection law, it informs the Customer. The Customer is responsible for having the right to process the data and to provide it to Espero, for informing participants about captioning, and for having the rights to the song lyrics.

4. Espero's obligations

• Confidentiality: Customer Data is handled only by authorised persons bound by confidentiality.
• Security: Espero implements appropriate technical and organisational measures (Article 32): transport encryption, provider-stated encryption at rest, access controls, automatic deletion schedules and the measures described in the security description.
• Data subject requests: Espero assists the Customer in responding to data subject requests with the means available to it, for example by deleting a caption line or the text of a broadcast at the Customer's request, and forwards requests it receives directly to the Customer unless the law requires otherwise.
• Personal data breaches: Espero notifies the Customer of a personal data breach affecting Customer Data without undue delay after becoming aware of it and provides the information about the breach available to it.
• Assistance: Espero assists the Customer to a reasonable extent with the obligations under Articles 32 to 36, including data protection impact assessments, taking into account the nature of the processing and the information available to Espero.
• Deletion: Captions, translations and listener data are deleted automatically 30 days after the start of the broadcast, and the Customer can delete them earlier. Song lyrics saved for an event are deleted on the schedule described in section 2, at the latest after one year, and deleting the group deletes them at once. When the Customer's use ends, the remaining Customer Data is deleted on these schedules unless the law requires retention; deleting the Customer's account deletes the Customer's organizer data at once; song lyrics saved for the group's events are deleted on the schedule above, and the group's events themselves remain until the group is deleted. Downloaded files are under the Customer's control.
• Information and audits: Espero makes available the information necessary to demonstrate compliance with this agreement and allows audits by the Customer or an independent auditor mandated by it, on reasonable notice, at most once a year unless a supervisory authority requires otherwise, primarily in writing and at the Customer's expense.

5. Sub-processors

The Customer gives general prior authorisation for the use of the service providers in the recipient categories described in section 4 of the Privacy Policy as sub-processors. Espero provides a named list on request (hello@espero.live), concludes a written agreement with each sub-processor imposing equivalent obligations, and remains responsible for its sub-processors. Espero informs the Customer in advance of a new sub-processor or a change of sub-processor; the Customer may object to the change on justified data protection grounds, and if no solution is found, the Customer may stop using the event features, in which case valid, unused bought hours are refunded.

6. Transfers outside the EU

Some sub-processors process Customer Data in the United States (speech recognition, speech synthesis, AI translation and its fallback) as described in sections 4 and 9 of the Privacy Policy. Transfers rely on the EU-U.S. Data Privacy Framework (DPF) where the sub-processor is certified under it, and otherwise on the Commission's Standard Contractual Clauses. The Customer receives a copy of the transfer mechanisms on request.

7. Liability and term

The parties' liability is governed by sections 7.8 and 11 of the Terms of Service. This agreement remains in force for as long as Espero processes Customer Data. In case of conflict, this agreement prevails over the Terms of Service as regards the processing of personal data. Changes are notified in accordance with section 13 of the Terms of Service.

8. Contact

Data protection matters and the sub-processor list: hello@espero.live.

← Back to Espero   Terms of Service →