Data processing addendum

This Data Processing Addendum ("DPA") is part of the Terms between {{LEGAL_ENTITY}} (ABN {{ABN}}) ("vfrey", the processor) and the customer (the controller). It applies when vfrey processes personal data on the customer's behalf while providing the service, and the GDPR, the UK GDPR, the CCPA or a similar law applies to that data. Where the Australian Privacy Act applies, vfrey also handles that data as the customer's service provider and follows the same instructions.

Terms that this DPA does not define have the meaning in the GDPR.

The free local tool runs on your machine and sends us nothing, so vfrey does not process personal data for you through it and this DPA does not apply to it. It applies to the paid service (the console).

• Subject matter: running the vfrey console and its paid features for the customer.
• Duration: while the customer has a workspace, and the deletion period below.
• Nature and purpose: storing, transmitting, rendering, and sending, as the features are used: team files and projects, outreach mail (recipients' names and addresses and message content), research results the customer saves (watchlists), workspace members' account details, and platform credentials.
• Types of personal data: names, email addresses, handles, message content, public profile data, and anything else the customer puts in its files.
• Data subjects: the customer's team members, the people the customer emails, creators on the customer's watchlists, and people who appear in the customer's content.

vfrey is a controller, not a processor, for its own account, billing and security data, and for the creator research index. See the Privacy Policy and the Creator Data Notice.

• Process the data only on the customer's documented instructions (the Terms, this DPA, and what the customer does in the console and the API), unless the law requires otherwise. We tell the customer first if we think an instruction breaks the law.
• Make sure the people who can access the data are bound by confidentiality.
• Keep appropriate technical and organisational security measures: encryption of platform secrets, workspace isolation checked on every request, private storage buckets, row-level security, hashed tokens and suppression records, and access limited to staff who need it. [OWNER: add or attach the full security measures list]
• Use only the subprocessors on the Subprocessors page, under written terms that give the same protection. We give the customer at least 30 days' notice by email before we add or replace one. The customer may object on reasonable data protection grounds in that time. If we cannot resolve it, the customer may cancel and receive a refund of prepaid unused amounts.
• Help the customer answer requests from data subjects, and with security, breach notification, impact assessments and consultation with authorities, taking into account the nature of the processing.
• Tell the customer without undue delay, and in any case within 72 hours, after we become aware of a breach of the personal data we process for them.
• On the end of the service, delete the customer's data within 30 days of closure (or return it first, on request), unless the law requires us to keep a copy. Backups expire on their normal cycle.
• Give the customer the information needed to show that we comply with this DPA, and allow audits by the customer, or an auditor it names, once a year with reasonable notice, at the customer's cost, or answer a reasonable security questionnaire instead. [LAWYER: confirm audit wording]

The customer is responsible for having a lawful basis, and giving the notices required, for the personal data it puts into vfrey, including the people it emails and the creators it watches. It must follow the Acceptable Use Policy.

vfrey hosts in Sydney, Australia, and its subprocessors may process data in other countries. For data subject to the GDPR, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference, as follows: Module Two (controller to processor) applies, and where the customer is itself a processor, Module Three. Clause 7 (docking) applies. In Clause 9, Option 2 (general authorisation) applies with the notice period above. In Clause 11, the optional language is not used. In Clause 17, the law is that of Ireland. In Clause 18, the courts are those of Ireland. Annex I is completed by the "Scope of processing" section above, and the competent authority is the one for the customer's establishment. Annex II is the security measures above. Annex III is the Subprocessors page.

For data subject to the UK GDPR, the UK International Data Transfer Addendum to the EU SCCs (version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018) is incorporated by reference, with the tables completed from this DPA. For data subject to the Swiss FADP, the SCCs apply with references to the GDPR read as the FADP.

If a clause conflicts with the SCCs, the SCCs win. [LAWYER: confirm module choices, governing law and the data exporter and importer details for the SCCs]

To the extent the CCPA applies, vfrey is a service provider. It will not sell or share the personal information it receives from the customer, will not retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in the Terms, and will not combine it with other data except as the CCPA permits. vfrey will tell the customer if it can no longer meet its CCPA duties.

If this DPA conflicts with the Terms on personal data, this DPA wins. To sign a copy, to ask for the security measures, or for any DPA question, write to privacy@vfrey.ai, or to {{POSTAL_ADDRESS}}.