Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the agreement between you (“Customer”, the controller) and Virtual Buddy(“we”, the processor) for the provision of the Service. It governs our processing of personal data on your behalf and applies where such processing is subject to the EU General Data Protection Regulation (GDPR), the UK GDPR, or comparable data protection laws.
1. Roles of the parties
For personal data that we process on your behalf when providing the Service (“Customer Personal Data”), you act as the controller (or processor on behalf of your own controllers) and we act as the processor (or sub-processor). Each party will comply with its respective obligations under applicable data protection law.
2. Scope & instructions
We will process Customer Personal Data only on your documented instructions, including as set out in this DPA and the agreement, and as needed to provide and secure the Service, unless required to do otherwise by law. The subject matter, duration, nature, and purpose of processing, the types of personal data, and the categories of data subjects are described in our Privacy Policy and the agreement.
3. Confidentiality
We ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and access the data only as necessary to perform their duties.
4. Security
We implement appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art and the risks of processing. These measures include encryption in transit and at rest, encryption of stored credentials and tokens, access controls, and tenant isolation, as described in our Security overview.
5. Sub-processors
You provide general authorization for us to engage sub-processors to support delivery of the Service. We maintain a current list on our Sub-processors page and impose data-protection obligations on each sub-processor that are no less protective than those in this DPA. We will give reasonable notice of intended changes to sub-processors so that you may object on reasonable grounds.
6. International transfers
Where processing of Customer Personal Data involves a transfer outside the EEA or UK to a country without an adequacy decision, such transfers are made under appropriate safeguards, including the European Commission’s Standard Contractual Clauses (SCCs) and, for UK transfers, the UK International Data Transfer Addendum to the SCCs, together with any supplementary measures required.
7. Assistance to the controller
Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to data-subject requests and meet your obligations regarding security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities.
8. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and will provide information reasonably necessary to help you meet your notification obligations.
9. Data subject requests
To the extent you are unable to address a data-subject request through the Service, we will, on your instruction, provide reasonable assistance to enable you to respond. Export and deletion tooling is available in-app and by contacting privacy@virtualbuddy.app.
10. Return & deletion
Upon termination of the Service, and on your request, we will delete or return Customer Personal Data, and delete existing copies, unless retention is required by law. Deletion will occur within a commercially reasonable period after termination.
11. Audits
We will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable confidentiality and security conditions.
12. Precedence & contact
In the event of a conflict between this DPA and the agreement regarding the processing of Customer Personal Data, this DPA prevails. Questions regarding this DPA can be sent to privacy@virtualbuddy.app.