Skip to content
Product: CoLoop Memory is live, and Thought Partner Chat has been rebuilt for verifiable analysis
Blog: Introducing the new Thought Partner Chat
Events: Co-working at CoLoop HQ, see upcoming dates
CoLoop
Book a call

GDPR Compliance FAQs

Background

  • GDPR covers a range of regulations designed to safegaurd the rights of individuals in the EU and UK.
  • When handling Personal Data this must be done in a way that avoids infringing the rights of the concerned individuals under GDPR.
  • In software supply chains this means ensuring that when data changes hands it doesn't limit the ability of the concerned individuals to enforce those rights under GDPR.

Sources

FAQs

Is storing data in the US GDPR Compliant?

  • Yes, you can store data in the US under GDPR.
  • PII can be transferred and stored in the US using a range of approved transfer mechanisms.
  • At CoLoop we rely on Standard Contractual Clauses contained within our Data Processor Agreement.
  • These are a standard set of approved Clauses published by regulators that can be included in a Data Processor Agreement in order to provide appropriate safeguards.
  • Alongside the SCCs, we have carried out a transfer risk assessment covering our transfers to the US.
  • All of the subprocessors we work with are also bound by SCCs, so the same safeguards apply at every step of the chain.
  • For UK data, our Data Processor Agreement includes the ICO's International Data Transfer Addendum to the EU SCCs. The ICO approves this as an alternative to its standalone International Data Transfer Agreement (IDTA).

Sources

What legal mechanisms cover data sent to US servers, and what is the retention?

  • We rely on Standard Contractual Clauses and the UK Addendum in our DPA as an approved transfer mechanism.
  • Data is retained until you delete it, or until 90 days after the end of your contract, whichever comes first.
  • You can delete data at any time by deleting it in the platform. Once deleted, backups persist for 7 days and are then removed.

Sources

Can you guarantee client data isn't shared outside the EEA? (A UK government client was concerned.)

  • No but that shouldn't be an issue.
  • When you create a project in CoLoop you are asked to choose a region in the beginning.
  • Any subseqeuntly uploaded raw data will be stored in the chosen region
  • Additionally any transcription tasks that occur will also be sent to servers in that physical region.
  • The derivatives and outputs of that processing — in this case the transcript outputs are then stored on servers in the US where the majority of our infrastructure sits.
  • All data is encrypted at rest and in transit and the keys and access credentials for the cloud infrastructure operated by us in the US reside with us.

Sources

Where is my data geographically processed?

  • When you create a project in CoLoop you are prompted to choose a region at the beginning
  • This region will be used to store any uploaded files along with the processing and redaction of any uploaded transcripts.
  • The derivatives of this processing are then sent to servers operated by us in the US.

Sources

Can you confirm UK data storage and explain international transfers?

  • When you setup a project in CoLoop you can choose UK as the storage region for your data.
  • Any uploaded files will be stored there.
  • Any transcription tasks that take place will also occur in the chosen region
  • This is important from a GDPR perspective.
  • Audio and video carry the highest risk: voices and faces identify people, and recordings can capture special category data such as health. Keeping them in your chosen region, and sending only text outside it, is a data minimisation measure.
  • By enabling local storage and processing only the derivatives of that processing are sent outside of the UK/EU.
  • These derivatives are lower classification enabling Data Controllers to provide guarantees that further reasonable steps are being taken to minimise egress of PII outside of the EEA.

Sources

Are US-hosted servers GDPR compliant, and will there be non-US servers?

  • Refer to answer above
  • We don't have plans to create copies of our processing infrastructure in the UK or EU as this would require spinning up and maintaing and entire copy of our infrastructure separately.
  • Non US based processing or storage is almost never a hard requirement and emphasis on this typically stems from a misunderstanding of the difference between geographic regions and jurisdiction when it comes to data.
  • We are a UK Limited company and are subject to and within recourse of GDPR.

Sources

We don't store any data outside the EU/UK — how can we use CoLoop?

  • It's extremely unlikely that none of the providers you use or their subprocessors don't have servers physically located in the US
  • Additionally, CoLoop is a UK limited company. When you send data to us, you're sending it to a UK organisation that is fully accountable under UK GDPR wherever the data is processed, and the Information Commissioner's Office can hold us directly to account. Where your data reaches our US subprocessors, it is protected by SCCs and the UK Addendum.

Sources

Can you process data using only EU-based sub-processors?

  • We rely on services and providers that don't offer EU only based processing.
  • Any data processed outside the EU/UK is transferred to the US in a GDPR compliant manner and relies on SCCs (Standard Contractual Clauses) as an approved transfer mechanism.

Sources

Is there a way to use CoLoop that doesn't involve any transfer of PII outside the UK/EU?

  • If you want to avoid exporting all PII altogether to the US you can enable automated PII redaction
  • This can be enforced at an organisational level and will automatically scrub and remove any PII from transcripts before they are processed on servers in the US.
  • We strongly recommend investigating clearly whether this is actually a hard requirement as remove key proper nouns from research material can confuse the meaning and make it difficult to understand what is going on.

Sources

Which other companies are involved in processing my data?

  • A full list of subprocessors can be found in our Trust Centre
  • For all subprocessors that handle data from the EU or UK we have in place data privacy agreements that specifically exclude: retention; training; resale or any other use of provided data beyond the specified purposes set by us in order to provide our service.
  • You're notified before we add a new subprocessor.

Sources

What data redaction and deletion features are offered?

We offer the following features to assist with data compliance management:

  • PII Redaction — automatically redact PII from transcripts and uploaded files
  • Face Blurring — blur faces to obscure identities in video highlight reels
  • Voice Modulation — modulated voices to obscure identity in video highligh reels
  • Media Deletion — automatically delete all original media (audio and video) after a specified amount of time.

Sources

Does CoLoop train on my data?

  • We do not train on any uploaded data to CoLoop
  • Additionally, our AI and transcription subprocessors are bound by zero-retention and no-training terms.

Sources

How do deletion requests work?

  • You can request deletion of your data from the platform directly by logging in and deleting a project.
  • Deletion requests are processed immediately with backups removed 7 days thereafter.

Sources

What happens to my data when I use the recording bot?

  • When you record a meeting using CoLoop, the audio is processed in the region chosen when creating the project.
  • After the call ends, the recorded video is stored in that same region.
  • The transcripts and derived outputs are stored in the US.
  • If PII redaction is enabled, PII is removed from transcripts before they are sent to our servers in the US.

Sources