Data Processing Agreement

This agreement covers the personal data inside the documents a customer uploads to Vaario (“customer data”). For that data the customer is the controller and Vaario is its processor. It forms part of Vaario's Terms of Service and applies together with them. For the data Vaario holds about the customer as a user (email, sign-in and usage records) Vaario is a controller, as the privacy policy explains.

The customer is the person or organisation that holds the Vaario account. The processor is [LEGAL ENTITY NAME], [REGISTERED ADDRESS], Estonia, registry code [REGISTRY CODE] (“Vaario”). The law that applies is the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), which Vaario applies to every customer wherever they are.

The subject matter, duration, nature and purpose of the processing, the types of personal data and the data subjects are in Annex I.

• Vaario processes customer data only on the customer's documented instructions. The Terms, this agreement and the customer's use of the product's features are the customer's complete instructions.
• Vaario does not process customer data for its own purposes. In particular it does not use customer data to train, tune or improve any AI model, its own or anyone else's, and its AI provider is instructed the same way.
• If Vaario thinks an instruction breaks the GDPR or another EU data-protection rule, it tells the customer at once.
• Vaario processes customer data only as the customer instructs, unless EU or Member State law requires otherwise. In that case it tells the customer before processing, unless the law forbids it.

Vaario makes sure that everyone it allows to process customer data has committed to confidentiality or is under a statutory duty of confidentiality. Vaario's staff do not open customer documents except at the customer's request (for example, for support) or where the law requires it.

Vaario applies the technical and organisational measures in Annex II, which take into account the state of the art, the cost, the nature of the processing and the risk to the people concerned (Art. 32). It reviews them whenever it changes how documents are processed.

• The customer gives Vaario a general written authorisation to use the sub-processors in Annex III.
• Vaario gives at least 30 days' notice before adding or replacing a sub-processor, by updating the sub-processors page and writing to the email address on each account. The customer may object on reasonable data-protection grounds during that time. Vaario then discusses it with the customer; if no solution is found, the customer may stop using the service for that processing and end the contract.
• Vaario binds each sub-processor to data-protection obligations that are in substance the same as these, and remains responsible to the customer for what its sub-processors do.

The database and every AI request stay in the EU. Where a sub-processor reaches data outside the EU/EEA, Vaario relies on the Standard Contractual Clauses approved by the European Commission. Sending review notes by email is the one place where contract text the customer chooses to send leaves the EU; the privacy policy explains this and the limits of EU-only processing.

• Data subjects' requests. If a person whose data is in a customer document writes to Vaario, Vaario passes the request to the customer without delay and does not answer it itself. Vaario helps the customer answer such requests with the tools in the product (for example, the data export) and with technical measures.
• Security, breaches and impact assessments. Vaario helps the customer meet its obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information Vaario has.

If Vaario becomes aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to customer data, it tells the customer without undue delay. It gives what it knows that Article 33(3) asks for: what happened and which data are involved, who to contact, the likely consequences, and what it is doing about it, and adds to that as it learns more. The customer, as controller, decides whether to notify its supervisory authority and the people concerned, and Vaario helps it do so.

• During the contract, the customer can export its data from Settings and delete any document, or the whole account, at any time. Documents nobody has used are deleted after the retention period the customer chooses (30 days by default), after an email warning.
• At the end, when the account is deleted, Vaario deletes the customer data from its live systems at once, together with the files it stores. The customer should export what it wants to keep first, because the deletion cannot be undone.
• Copies that remain in a provider's backups are deleted when those backups expire on the provider's schedule; Vaario does not use them for anything else.
• Vaario keeps nothing longer than this unless EU or Member State law requires it.

On request, Vaario gives the customer the information needed to show that it meets this agreement, such as its security summary and answers to the customer's standard compliance questionnaire, under a confidentiality undertaking. The customer, or an auditor it appoints who is bound by confidentiality, may also audit Vaario, including by inspection, once a year and after a personal data breach. The customer gives at least 30 days' notice, the audit takes place in business hours without disrupting the service, and it does not reach other customers' data or anything that would weaken security. Each side bears its own costs unless the audit shows that Vaario did not meet this agreement.

The customer makes sure it has a lawful basis to upload the documents and have them processed as described here, and that its instructions are lawful. What it must confirm when it uploads is in the Terms (section 5 and section 7).

Liability under this agreement is governed by the liability clause of the Terms, without limiting a data subject's rights against either side under Article 82 of the GDPR. This agreement is governed by the GDPR and by the law and courts the Terms name. If this agreement and the Terms conflict on the processing of customer data, this agreement prevails.

The same list, with what each one receives, is on the sub-processors page.