Data processing agreement (dpa) — found from the homepage — Gmelius

Cited by

Facts read from this source

• GDPR laws Report an error

  “Gmelius is committed to complying with data protection laws such as the GDPR, the Swiss FADP, the UK GDPR and the CCPA”

• SOC 2 Report an error

  “We're SOC2 Type II certified.”

• Provider Report an error

  “Company Data is hosted on Google Cloud infrastructure and may be accessed by Subprocessors in the United States as listed in Schedule 1.”

• Establishment Report an error

  “Gmelius is established in Switzerland, a jurisdiction recognised as adequate by the European Commission and the United Kingdom.”

• Transfer mechanisms Report an error

  “they also execute the Standard Contractual Clauses (Module 2, or Module 3 where Company acts as a Processor) as completed in Appendix A, together with the Swiss amendments and, for UK data, the UK Addendum”

• Breach notification Report an error

  “Gmelius will notify Company without undue delay, and in any event within seventy-two (72) hours after confirming a Personal Data Breach affecting Company Data.”

• Deletion timeline Report an error

  “Gmelius will, at Company's election made in writing before that date, return Company Data in a commonly used format or delete it, and will in any case delete Company Data (including AI personalisation data, agent memory and audit trails) within ninety (90) days after termination”

• Export Report an error

  “During the term, Company may export Company Data through the Services.”

• Subject rights controls Report an error

  “The Services provide Company with controls to retrieve, correct, delete and export Company Data.”

• Audit rights Report an error

  “Company (or an independent auditor bound by confidentiality and not a competitor of Gmelius) may conduct an audit of Gmelius' relevant facilities and records, no more than once in any twelve-month period, on at least thirty (30) days' written notice, during business hours”

• Audit documents Report an error

  “Gmelius will make available to Company, on request and subject to confidentiality, its most recent SOC 2 Type II report, penetration test summary and other documentation reasonably necessary to demonstrate compliance with this DPA.”

• Penetration testing Report an error

  “annual independent penetration testing”

• Encryption Report an error

  “encryption of data in transit (TLS) and at rest”

• MFA Report an error

  “role-based access control with least-privilege and multi-factor authentication for personnel”

• List Report an error

  “Google Cloud EMEA Limited / Google LLC EU / USA Cloud infrastructure, storage, logging; AI model inference (Gemini via Vertex AI, zero data retention)”

• Cloudflare Report an error

  “Cloudflare, Inc. USA DNS, CDN, network security SCCs; Data Privacy Framework”

• Twilio Report an error

  “Twilio Inc. (SendGrid) USA Transactional email delivery SCCs; Data Privacy Framework”

• Stripe Report an error

  “Stripe, Inc. USA Payment processing (billing data only) SCCs; Data Privacy Framework”

• Hubspot Report an error

  “HubSpot, Inc. USA Customer relationship management and support (account contact data only; no Company Content) SCCs; Data Privacy Framework”

• AI zero retention providers Report an error

  “Gmelius will engage only providers that contractually commit to (a) zero data retention, meaning Company Data is not stored or logged beyond immediate processing, and (b) not using Company Data to train or improve their models.”

• AI opt out Report an error

  “Company may disable AI Features at the workspace level, and Gmelius will not enable them for Company without Company's prior written consent”

• AI features Report an error

  “including AI Sorting, Dispatching and Reply Assistants and configurable agents ("Meli")”

• Agent audit trail Report an error

  “Gmelius provides an audit trail of agent actions to support Company's oversight obligations.”

• Connected applications not subprocessors Report an error

  “Connected Applications are engaged by Company, not by Gmelius, and are not Subprocessors.”

• Change notice Report an error

  “Gmelius will notify Company of any intended addition or replacement of a Subprocessor at least thirty (30) days before the Subprocessor Processes Company Data, by email to Company's administrative contact and by updating Schedule 1.”

• HIPAA baa available Report an error

  “If the Agreement is a HIPAA Business Associate Agreement or the parties have executed one, that agreement governs Protected Health Information and prevails over this DPA to the extent of any conflict.”

• DPA updates notice Report an error

  “Gmelius will notify Company of any update at least thirty (30) days before it takes effect, by email to Company's administrative contact and by posting the updated version at https://gmelius.com/legal/dpa”

• Scc governing law Report an error

  “the Clauses are governed by the law of Ireland, unless the data exporter is established in another EU member state whose law permits third-party beneficiary rights, in which case the law of that state applies.”

• DPA last updated Report an error

  “Last Updated: June 10, 2026”

• Security measures AI Report an error

  “for AI Features, permission-scoped agent access, egress controls, configurable human-approval steps and audit logging of agent actions.”

• Trust center Report an error

  “Request a copy of our latest SOC2 Type II report and learn more about our infrastructure, policies and practices by visiting our Trust Center at trust.gmelius.com”

• Language supported Report an error

  “English Français Deutsch Português Español 日本語”

• List Report an error

  “Gmail Google Groups Google Workspace Admin Google Meet Google Calendar Salesforce HubSpot Slack Trello Nicereply Zapier Make Relay.app”

• API documentation Report an error

  “API Documentation ⧉”

• Team features Report an error

  “Gmail Shared Inbox Shared Gmail Labels Shared Email Drafts Email Notes & @mentions Email Delegation Email Templates”

3 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agent Advocate Ticketing, queues & SLA
• The Agent Advocate Channels in one queue
• The Agent Advocate Knowledge base & deflection
• The Agent Advocate Customer data protection
• The Agent Advocate Integrations & API
• The Agent Advocate European sovereignty
• The Data Protection Officer Ticketing, queues & SLA
• The Data Protection Officer Knowledge base & deflection
• The Data Protection Officer Customer data protection
• The Data Protection Officer Integrations & API
• The Data Protection Officer European sovereignty
• The Shop Operator Ticketing, queues & SLA
• The Shop Operator Customer data protection
• The Shop Operator Integrations & API
• The Shop Operator European sovereignty
• The Integrator Ticketing, queues & SLA
• The Integrator Customer data protection
• The Integrator Integrations & API
• The Integrator European sovereignty
• The Skeptic Ticketing, queues & SLA
• The Skeptic Channels in one queue
• The Skeptic Knowledge base & deflection
• The Skeptic Customer data protection
• The Skeptic Integrations & API
• The Skeptic European sovereignty
• The Support Lead Ticketing, queues & SLA
• The Support Lead Knowledge base & deflection
• The Support Lead Customer data protection
• The Support Lead Integrations & API
• The Support Lead European sovereignty