Data processing agreement

TODO counsel: placeholder text. The agreement under Art. 28 GDPR must be finalised by legal counsel before launch.

1. Subject matter

Processing of personal data by Vyonica (processor) on behalf of the customer (controller) in the course of providing the compliance platform.

2. Nature and purpose

Storage, organisation and display of account data, AI system records, documents and evidence files; generation of exports; notifications about deadlines.

3. Categories of data and data subjects

Employees and contractors of the customer (names, e-mail addresses, roles, training attestations); persons mentioned in uploaded documents.

4. Duration

For the term of the service agreement. Data is deleted or returned at the end of the term, at the customer's choice.

5. Processor obligations

Instructions only from the controller; confidentiality; technical and organisational measures (Annex 2); assistance with data subject requests and breach notification within 72 hours; deletion after the end of processing; audit rights.

6. Sub-processors (Annex 1)

Sub-processor	Purpose	Location
TODO (cloud hosting)	Compute and storage	EU
TODO (e-mail delivery)	Transactional e-mail	EU
TODO (error monitoring)	Application errors	EU

7. Technical and organisational measures (Annex 2)

Encryption in transit and at rest; role-based access; MFA and SSO; audit logging; hash-chained evidence ledger; EU hosting; backups; least-privilege operations.