DATA PROCESSING AGREEMENT
META-365. Antonios Psarakis Mon IKE (trading as META-365)
Version: 1.0 | Effective date: 29 August 2026
Published at: https://meta-365.com/dpa
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Use / End User Licence Agreement (the "Agreement") between:
META-365. Antonios Psarakis Mon IKE, a Greek single-member private company (Μονοπρόσωπη Ι.Κ.Ε.), company registration number 159810458000, with registered office at Voulgaro Kisamou, Chania 73400, Greece, trading as META-365 ("Licensor", "we", "us"); and
the customer identified in the applicable Order ("Customer", "you").
This DPA applies where Licensor Processes Personal Data on Customer's behalf in connection with the pEntities application and related services (the "Offering"). Customer accepts this DPA by accepting the Agreement. No signature is required for this DPA to take effect, although Licensor will execute a counterpart on request.
1. DEFINITIONS
Terms defined in the Agreement have the same meaning in this DPA. In addition:
"Controller", "Processor", "Data Subject", "Processing", "Personal Data", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR.
"Customer Personal Data" means Personal Data contained within Customer Data which Licensor Processes on Customer's behalf under the Agreement.
"Data Protection Law" means all laws applicable to the Processing of Personal Data under the Agreement, including Regulation (EU) 2016/679 ("GDPR"), Greek Law 4624/2019, and any implementing, successor or replacement legislation.
"EEA" means the European Economic Area.
"Standard Contractual Clauses" means the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, or any successor clauses.
"Sub-processor" means any third party engaged by Licensor to Process Customer Personal Data.
2. ROLES OF THE PARTIES
2.1 In respect of Customer Personal Data, Customer is the Controller and Licensor is the Processor.
2.2 Where Customer is itself a Processor acting on behalf of a third-party Controller, Licensor acts as a Sub-processor. Customer warrants that it has the authority of that Controller to appoint Licensor and to agree this DPA on that Controller's behalf.
2.3 Each party is independently responsible for its own compliance with Data Protection Law.
2.4 Licensor does not sell Customer Personal Data, does not Process it for its own commercial purposes, and does not use it to train artificial-intelligence models. Any artificial-intelligence processing performed through the Offering is carried out on Customer's instruction, for Customer's benefit, using services deployed within Customer's own cloud subscription or under Customer's own configuration.
3. SCOPE AND DETAILS OF PROCESSING
The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subject are set out in Annex 1.
4. PROCESSING ON DOCUMENTED INSTRUCTIONS
4.1 Licensor will Process Customer Personal Data only on Customer's documented instructions, including with regard to transfers to a third country or an international organisation, unless required to do otherwise by Union or Member State law to which Licensor is subject. Where such a legal requirement applies, Licensor will inform Customer of that requirement before Processing, unless the law prohibits it on important grounds of public interest.
4.2 The Agreement, this DPA, and Customer's and its End Users' configuration and use of the Offering together constitute Customer's complete documented instructions. Additional or different instructions require the parties' written agreement and may be subject to additional charges.
4.3 Licensor will inform Customer if, in its opinion, an instruction infringes Data Protection Law. Licensor may suspend the affected Processing until the instruction is confirmed, amended or withdrawn.
5. CUSTOMER OBLIGATIONS
5.1 Customer is responsible for:
(a) the accuracy, quality and legality of Customer Personal Data and the means by which it was acquired;
(b) establishing and maintaining a lawful basis for the Processing;
(c) providing all required privacy information to, and obtaining all required consents from, Data Subjects;
(d) configuring the Offering, including user access rights and role assignments, so that End Users receive only the access appropriate to them; and
(e) securing the Microsoft 365 tenant and any cloud resources under Customer's own control, including identity, authentication and conditional access policies.
5.2 Special categories of data. Customer will not submit to the Offering any special categories of personal data within the meaning of Article 9 GDPR, or personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR, unless Customer has established a lawful basis and, where required, has carried out a data protection impact assessment.
The Offering does not request such data. Licensor exercises no control over, and does not monitor, the content that Customer, its End Users or third parties enter into free-text fields, uploaded documents, curricula vitae or messages.
5.3 Data collected from non-users. Where Customer uses the Offering to collect data from individuals who are not End Users — including job applicants submitting applications or external reviewers accessing shared documents — Customer remains the Controller for that data and is responsible for providing those individuals with a privacy notice and a route to exercise their rights. Such individuals have no account within Customer's tenant and cannot exercise rights through Customer's ordinary user-facing processes.
6. CONFIDENTIALITY OF PERSONNEL
6.1 Licensor will ensure that persons authorised to Process Customer Personal Data:
(a) are subject to a binding obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement;
(b) are informed of the confidential nature of the data; and
(c) Process Customer Personal Data only as necessary to perform Licensor's obligations under the Agreement.
6.2 Licensor applies documented screening, security training and least-privilege access controls to such personnel, and revokes access with credential rotation on the end of any engagement.
7. SECURITY
7.1 Licensor will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. The measures in force at the effective date of this DPA are described in Annex 3.
7.2 Licensor may update the measures in Annex 3 from time to time, provided that the overall level of security is not materially reduced.
7.3 Licensor commissions an independent third-party penetration test of the Offering at least annually, together with a remediation verification re-test. Licensor will make a summary of the most recent results available to Customer on request, subject to reasonable confidentiality undertakings.
8. SUB-PROCESSORS
8.1 General authorisation. Customer grants Licensor general authorisation to engage Sub-processors, subject to this clause. Licensor's current Sub-processors are listed in Annex 2.
8.2 Obligations flow-down. Licensor will impose on each Sub-processor, by written contract, data protection obligations no less protective than those set out in this DPA, and will remain fully liable to Customer for the performance of each Sub-processor's obligations.
8.3 Changes. Licensor will give Customer at least thirty (30) days' prior notice of the addition or replacement of a Sub-processor. Notice will be given by email to Customer's administrative contact and by updating Annex 2 at https://meta-365.com/dpa.
8.4 Objection. Customer may object to a proposed Sub-processor on reasonable data protection grounds by written notice within the notice period. The parties will discuss the objection in good faith. If it cannot be resolved, Customer may terminate the affected Offering without penalty by written notice before the change takes effect, and Licensor will refund any prepaid fees covering the period after termination.
9. INTERNATIONAL TRANSFERS
9.1 Licensor Processes Customer Personal Data within the EEA. Licensor's own infrastructure is located within the EEA.
9.2 Where the Offering provisions cloud resources within Customer's own subscription, Customer selects the deployment region and Processing within those resources takes place in the region Customer selects.
9.3 Licensor will not transfer Customer Personal Data outside the EEA unless it has first put in place a valid transfer mechanism under Chapter V GDPR. Where the Standard Contractual Clauses are relied upon, they are incorporated into this DPA by reference with the following specifications:
(a) Customer is the data exporter and Licensor is the data importer;
(b) Module Two (Controller to Processor) applies, or Module Three (Processor to Processor) where clause 2.2 applies;
(c) the optional docking clause applies;
(d) in Clause 9, Option 2 (general written authorisation) applies with the notice period in clause 8.3 of this DPA;
(e) in Clause 17, the governing law is the law of Greece;
(f) in Clause 18(b), the competent courts are the courts of Greece;
(g) the competent Supervisory Authority is the Hellenic Data Protection Authority; and
(h) Annexes 1, 2 and 3 of this DPA serve as the corresponding Annexes to the Standard Contractual Clauses.
9.4 Transfers carried out by Microsoft in its capacity as provider of the underlying cloud and productivity platform are governed by Microsoft's own data protection terms and transfer mechanisms.
10. ASSISTANCE WITH DATA SUBJECT RIGHTS
10.1 Taking into account the nature of the Processing, Licensor will assist Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling Customer's obligation to respond to requests to exercise Data Subject rights under Chapter III GDPR.
10.2 Where a Data Subject contacts Licensor directly in respect of Customer Personal Data, Licensor will not respond substantively but will refer the Data Subject to Customer and inform Customer without undue delay.
10.3 Licensor will respond to a request for assistance from Customer within five (5) working days, so that Customer can meet its own statutory deadline.
10.4 Customer Personal Data held within Customer's own Microsoft 365 tenant or within Customer-controlled cloud resources is under Customer's direct control. Customer can exercise rights in respect of that data using its own administrative tools without Licensor's involvement.
11. PERSONAL DATA BREACH
11.1 Licensor will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
11.2 The notification will describe, to the extent known at the time:
(a) the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects and records concerned;
(b) the likely consequences;
(c) the measures taken or proposed to address it and mitigate its effects; and
(d) a contact point from whom further information may be obtained.
Where the information cannot be provided at the same time, it will be provided in phases without further undue delay.
11.3 Licensor will assist Customer in meeting Customer's own obligations under Articles 33 and 34 GDPR, taking into account the nature of the Processing and the information available to Licensor.
11.4 Notification of a Personal Data Breach under this clause is not, and will not be construed as, an acknowledgement of fault or liability.
12. DATA PROTECTION IMPACT ASSESSMENT
Licensor will provide reasonable assistance to Customer with any data protection impact assessment under Article 35 GDPR and any prior consultation with a Supervisory Authority under Article 36 GDPR, in each case solely in relation to Processing carried out by Licensor and taking into account the nature of the Processing and the information available to Licensor.
13. DELETION AND RETURN
13.1 On termination or expiry of the Agreement, Licensor will, at Customer's election, delete or return Customer Personal Data held by Licensor, and delete existing copies, unless Union or Member State law requires continued storage.
13.2 Customer must communicate its election within thirty (30) days of termination. In the absence of an election, Licensor will delete the data at the end of that period.
13.3 Customer Data held within Customer's own Microsoft 365 tenant or within Customer-controlled cloud resources remains under Customer's control and is unaffected by termination of the Agreement. Deletion of those resources is Customer's responsibility. Customer is responsible for exporting any data it wishes to retain before terminating those resources.
13.4 Data held by Licensor is retained during the term in accordance with the retention periods in Annex 1. Backup copies are deleted on their ordinary cycle and remain subject to clause 6 until deleted.
13.5 Licensor will confirm completion of deletion in writing on request.
14. RECORDS AND AUDIT
14.1 Licensor will make available to Customer the information necessary to demonstrate compliance with the obligations in this DPA.
14.2 Customer may verify Licensor's compliance no more than once in any twelve (12) month period, and additionally at any time following a Personal Data Breach affecting Customer Personal Data, in accordance with this clause.
14.3 Licensor will first respond to a reasonable written information request, providing its current security documentation and the summary results of its most recent independent penetration test.
14.4 Where the information provided under clause 14.3 is genuinely insufficient to demonstrate compliance, Customer may conduct, or mandate an independent auditor to conduct, an audit. Such an audit will be:
(a) on at least thirty (30) days' written notice;
(b) during Licensor's normal business hours;
(c) subject to reasonable confidentiality undertakings;
(d) limited in scope to Processing carried out under the Agreement; and
(e) conducted so as not to disrupt Licensor's operations or compromise the security or confidentiality of any other customer's data.
14.5 Customer bears the cost of any audit under clause 14.4, unless the audit reveals a material breach by Licensor of this DPA, in which case Licensor bears the reasonable cost.
14.6 An auditor mandated by Customer must not be a competitor of Licensor.
15. SUPPORT DATA
Where Customer provides data to Licensor in the course of obtaining technical support, Licensor Processes any Personal Data within it as Processor, on the terms of this DPA.
16. GENERAL
16.1 Precedence. In the event of a conflict between this DPA and any other part of the Agreement, this DPA prevails in respect of the Processing of Personal Data.
16.2 Changes to this DPA. Licensor may update this DPA where required by a change in Data Protection Law, regulatory guidance, or the Offering. Licensor will give Customer at least thirty (30) days' notice of any change that materially reduces Customer's rights, by email and by updating this page. Continued use of the Offering after the effective date constitutes acceptance.
16.3 Governing law and jurisdiction. This DPA is governed by the laws of Greece. The parties submit to the non-exclusive jurisdiction of the courts of Greece, without prejudice to any Data Subject's rights under Data Protection Law.
16.4 Liability. The liability of each party under this DPA is subject to the limitations and exclusions set out in the Agreement.
16.5 Contact. Data protection enquiries should be addressed to privacy@meta-365.com. Licensor's lead Supervisory Authority is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα).
16.6 Data Protection Officer. Licensor has not appointed a Data Protection Officer. Article 37 GDPR does not require one: Licensor does not carry out large-scale systematic monitoring of Data Subjects, and does not Process special categories of data at scale as a core activity. The contact point in clause 16.5 discharges the equivalent function.
ANNEX 1 — DETAILS OF PROCESSING
Subject matter. Provision of the pEntities document intelligence, workflow, human resources, ticketing, legal case management and communications platform, delivered as a Microsoft Teams and Outlook application.
Duration. The term of the Agreement, plus the retention periods set out below.
Nature and purpose of Processing. Collection, storage, retrieval, organisation, structuring, consultation, use, analysis (including artificial-intelligence-assisted extraction, summarisation, classification and search), transmission and erasure of Customer Data, for the purpose of providing the Offering to Customer and its End Users.
Categories of Data Subject
| Category | Relationship to Customer |
|---|---|
| End Users | Employees, workers and contractors of Customer |
| External guest reviewers | Individuals invited by an End User to review a document |
| External approvers | Individuals named in a Customer workflow |
| Job applicants | Individuals with no prior relationship to Customer |
| Signatories | Parties to a document sent for electronic signature, where that feature is enabled |
| Individuals named within Customer Data | Incidental — any person referred to in a document, message or record |
Categories of Personal Data
| Category | Examples |
|---|---|
| Identity | Microsoft Entra ID object identifier, tenant identifier, User Principal Name, display name |
| Contact | Email address |
| Employment | Role, department, manager, absence and scheduling data |
| Content | Documents, email, chat messages, ticket and case text — content determined by Customer |
| Recruitment | Curriculum vitae content, application responses |
| Authentication | Guest access codes, stored only as a salted cryptographic hash |
| Behavioural | Request telemetry, workflow decisions, approvals and audit records |
The Offering does not request special categories of personal data. Where such data is entered by Customer, an End User or a third party into free-text fields or uploaded documents, clause 5.2 applies.
Retention
| Data | Location | Retention |
|---|---|---|
| Identity claims used for authentication | Not persisted | Duration of the request |
| Document content during processing | Not persisted — held in memory only | Duration of the request |
| Guest portal document cache and access-code hash | Licensor storage | 3 days, enforced by automated lifecycle policy |
| Guest access session | — | 4 hours |
| Workflow run state and history | Licensor storage | Retained for the duration of the subscription; deleted on customer offboarding |
| Electronic signature index metadata | Licensor storage | Until deleted by the workflow |
| Operational telemetry | Licensor subscription | 90 days |
| Subscription and configuration records | Licensor subscription (West Europe) | Duration of the subscription; deleted on cancellation |
| Entity, HR, ticketing, asset, case and workflow data | Customer's own cloud storage | Controlled by Customer |
| Artificial-intelligence embeddings and search indexes | Customer's own search resource | Controlled by Customer |
ANNEX 2 — SUB-PROCESSORS
Current as at the effective date of this DPA.
| Sub-processor | Role | Location of Processing | Data protection terms |
|---|---|---|---|
| Microsoft Corporation and its affiliates | Cloud hosting, identity and authentication, and the Microsoft 365 services on which the Offering operates | Customer-selected regions for Customer-controlled resources; Licensor infrastructure within the EEA | Microsoft Products and Services Data Protection Addendum |
No other Sub-processor Processes Customer Personal Data. No analytics, advertising, marketing, customer-relationship-management or profiling service receives Customer Personal Data.
Electronic signature. Electronic signature functionality is not enabled by default and no electronic signature provider Processes Customer Personal Data unless Customer expressly enables the feature. Where Customer does so, the relevant provider will be added to this Annex under the notice procedure in clause 8.3 before any Customer Personal Data is transmitted to it, and an appropriate transfer mechanism will be put in place under clause 9 where that provider Processes outside the EEA.
ANNEX 3 — TECHNICAL AND ORGANISATIONAL MEASURES
Measures in force at the effective date, maintained under clause 7.
| Area | Measures |
|---|---|
| Authentication | Authentication is delegated entirely to Microsoft Entra ID. Tokens are validated for signature, issuer and audience at the platform edge before any application code executes. No local or application-managed administrative accounts exist |
| Tenant isolation | Customer identity is derived exclusively from the validated authentication token and never from request content. Stored data is namespaced per tenant. Isolation is verified by independent penetration testing across the data-bearing interface in both tenant directions, with positive controls |
| Authorisation | Role-based access control enforced server-side before Processing. Failed role resolution results in self-only access. Elevated roles are assignable only to individual users, never to applications or service principals |
| Encryption in transit | TLS 1.2 minimum; HTTPS-only; secure-only management protocols |
| Encryption at rest | Platform storage encryption; hardware-security-module-backed key vault; AES-256-GCM with per-tenant key derivation for stored tokens; PBKDF2 with constant-time comparison for access codes |
| Secret management | Production secrets held in a managed key vault and resolved at runtime. Credentials for Customer-controlled cloud resources are resolved on demand through the cloud control plane under a managed identity and held only in process memory; they are not persisted |
| Injection and output safety | Parameterised database access; output sanitisation on all rendered content; outbound requests restricted by host allow-list with post-resolution address validation |
| Logging and monitoring | Authentication failures, authorisation denials, cross-tenant access attempts, privileged operations and configuration changes are recorded to append-only platform services that operational personnel cannot alter. Defined alert conditions and documented response targets apply |
| Separation of duties | Code review of security-impacting changes is performed by an individual who holds no production access. Incident command is separated from security risk ownership |
| Personnel security | Screening before access is granted; written confidentiality obligations surviving engagement; documented security training; access granted at the minimum scope required and revoked with credential rotation on departure |
| Resilience and availability | Delivered on cloud platform-as-a-service components with platform-managed redundancy; documented business continuity and disaster recovery arrangements with defined recovery objectives |
| Testing and assurance | Independent third-party penetration testing at least annually, with a mandatory remediation verification re-test. Automated pre-merge checks enforce tenant isolation independently of human review |
| Incident response | Documented incident response plan with severity classification, pre-authorised containment actions that do not await staffed hours, and a 72-hour Controller notification commitment |
| Data minimisation and deletion | Documented retention schedule with automated lifecycle enforcement; defined customer offboarding procedure with written confirmation on request |
| Governance | Information Security Policy, formal risk assessment methodology and register, Record of Processing Activities, logging and monitoring policy, and personnel security policy, each reviewed on a defined cycle |
END OF DATA PROCESSING AGREEMENT