Data Processing Addendum

1Scope

This Data Processing Addendum ("DPA") forms part of the agreement between UNIWISE LLC ("Vega") and an organisation that has accepted Vega's Terms of Service ("Customer"). It applies when Vega processes Customer Personal Data, and binds when Customer accepts the Terms, without a signature. A countersigned copy is available on request.

Where this DPA and the Terms conflict on personal data, this DPA governs.

2Definitions

Data Protection Law: The data protection laws that apply to the processing, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and US state privacy laws.
Customer Personal Data: Personal data Vega processes for Customer under the Terms, described in Annex I.
SCCs: The Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
Subprocessor: A third party Vega engages to process Customer Personal Data.

Other terms have the meaning given in the GDPR.

3Processing

Customer is the controller and Vega the processor of Customer Personal Data. Vega processes it only on Customer's documented instructions, which are the Terms, this DPA and Customer's use of Vega, and tells Customer if it believes an instruction breaks Data Protection Law. Vega ensures that people it authorises to process Customer Personal Data are bound by confidentiality.

For account administration, billing, security and abuse prevention, Vega is a controller in its own right, and its Privacy Policy applies to that processing instead of this DPA.

Vega does not sell or share Customer Personal Data, or use it outside the business purpose of providing Vega, and does not train AI models on it. Under US state privacy laws, Vega acts as Customer's service provider or processor.

4Security

Vega maintains the technical and organisational measures in Annex II and will not materially reduce the protection they give.

5Subprocessors

Customer authorises the subprocessors on Vega's subprocessor list, which is the list of subprocessors for the SCCs. Vega adds a new subprocessor at least 30 days before it begins processing Customer Personal Data, and emails account holders when it does. Customer may object within those 30 days on reasonable data protection grounds; if the parties cannot resolve it, Customer may end the affected part of the service.

Vega engages each subprocessor under a written contract that imposes the data protection obligations Article 28 of the GDPR requires, including the SCCs where they apply. Vega remains responsible to Customer for the performance of its subprocessors.

6Data subject requests

Vega will refer a request it receives about Customer Personal Data to Customer, unless the law requires Vega to answer it, and will help Customer respond to requests to exercise rights under Data Protection Law. A user can export their own data from Vega, and Vega can produce the same export for Customer.

7Security incidents

Vega will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information it has at the time, and will help Customer meet its obligations to notify authorities and individuals.

8Assistance

Vega will give Customer the information it reasonably needs for data protection impact assessments and consultations with supervisory authorities.

9Audits

On reasonable written request, Vega will provide the information needed to show it complies with this DPA, such as a completed security questionnaire, once a year, and again after a personal data breach or when a supervisory authority asks. Where that information is not enough, Vega will allow for and contribute to audits, including inspections, by Customer or an independent auditor it appoints, on reasonable notice, under confidentiality and at Customer's cost. This does not limit any audit right that Data Protection Law or the SCCs give Customer or a supervisory authority.

10Deletion and return

When the agreement ends, Vega will, as Customer chooses, return Customer Personal Data and then delete it, or delete it, unless the law requires Vega to keep it. Deleted data leaves backups as they expire.

11International transfers

Vega and its subprocessors process Customer Personal Data in the locations on the subprocessor list, mainly the United States. For personal data from the EEA, the parties incorporate the SCCs, Module Two (controller to processor), or Module Three (processor to processor) where Customer is itself a processor, completed by Annexes I and II, with Irish law and courts where the SCCs require a choice. For the UK, they incorporate the UK International Data Transfer Addendum. For Switzerland, the SCCs apply with the Swiss Federal Act on Data Protection in place of the GDPR.

12Liability

Each party's liability under this DPA is subject to the limitations in the Terms, except where the SCCs do not allow it.

13Term and changes

This DPA lasts as long as Vega processes Customer Personal Data, and is governed by the law that governs the Terms, except where the SCCs require otherwise. Vega publishes a change that reduces the protection this DPA gives at least 30 days before it takes effect, and emails account holders. Every published version is kept.

14Contact

Questions, a countersigned copy or a security questionnaire: help@tryvega.tech.

15Annex I · Description of processing

Parties: Customer, as controller (data exporter). Vega, as processor (data importer). Contact details are those on Customer's account and in section 14.
Subject matter and purpose: Providing Vega to Customer under the Terms: saving conversations from the AI tools Customer's users connect, organising and summarising them, and showing them to those users and their teams as the Privacy Policy describes.
Nature of processing: Collection, storage, organisation, analysis by AI models, display and deletion.
Duration: The term of the agreement, and until deletion under section 10.
Data subjects: Customer's employees, contractors and other users, and people mentioned in their conversations.
Categories of personal data: Account details, such as name, email address and team role; conversation content and what Vega creates from it; usage information.
Sensitive data: Not sought. Vega removes the sensitive details about people it recognises, such as their health, before storing an excerpt, and never shows anything it decides is not work, such as a user's health, money or family, to Customer's other users. Other sensitive data may be present if a user discusses it with an AI tool, until it is deleted.
Frequency: Continuous, while a user's AI tools are connected.
Supervisory authority: The authority competent for Customer under Data Protection Law.

16Annex II · Security measures

Encryption: Data is encrypted in transit and at rest. Full conversation text a user chooses to keep is encrypted again in the application before it is stored, and is not stored if that cannot be done.
Minimal retention: Full text is kept only where a user chooses to keep it. Vega redacts recognised secrets, such as API keys, access tokens and private keys, before content is stored, and recognised email addresses, phone numbers, card numbers, IBANs and sensitive details about people before an excerpt is stored.
Access control: Every request for customer data is authenticated and limited to the data its account may see. What only its owner may see is left out of what others receive, not hidden in it.
Pseudonymisation: Identifying details are removed before anything is used across accounts.
Credentials: Keys that connect a user's AI tools are stored only as hashes. The service uses short-lived cloud credentials and stores no static cloud key.
Staff accountability: Staff access to customer data is restricted. Each staff sign-in to a customer account for support is written to a log that holds no content.
Team audit log: Changes to a team's settings and members are logged, cannot be edited or deleted, and every member can read them.
Portability and deletion: Users can export or delete their data. Deleting an account releases its team seats rather than deleting the team's data, and deleted data leaves backups as they expire.
Browser protections: Vega's pages cannot be framed by other sites and are denied camera, microphone and location access.
Payments: Card details are handled by Vega's payment provider and never reach Vega.
Incident response: Security incidents are investigated and notified as section 7 describes.
No tracking: Vega uses no third-party analytics, advertising, session-recording or error-reporting service.