Data Processing Agreement

For the personal data you and your team enter into the Service to run your properties (“Customer Personal Data”), you are the controller and Vabumi is the processor. This DPA governs that processing.

For a narrower set of data Vabumi processes for its own purposes — creating and securing accounts, billing, responding to enquiries, and running the website — Vabumi is an independent controller. That processing is described in our Privacy Policy and is outside this DPA.

The subject matter, duration, nature and purpose of the processing, the categories of data subjects and the categories of personal data are set out in Annex I.

“GDPR”, “controller”, “processor”, “data subject”, “personal data”, “processing”, “personal data breach” and “supervisory authority” have the meanings given in Regulation (EU) 2016/679. “Data Protection Law” means the GDPR, the UK GDPR, the Swiss FADP and any national law implementing or supplementing them, as applicable to the Customer. “Sub-processor” means a third party engaged by Vabumi to process Customer Personal Data. “Agreement” means the Terms of Service or any signed order form or master agreement between the parties, together with this DPA.

Vabumi will process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country, unless required to do so by EU or Member State law — in which case Vabumi will inform you before processing, unless that law prohibits it on important grounds of public interest.

Your instructions are: the Agreement, this DPA, your use of the Service’s features and settings, and any further written instructions agreed between us. Vabumi will immediately inform you if, in its opinion, an instruction infringes Data Protection Law.

Vabumi ensures that every person it authorises to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and processes the data only on Vabumi’s instructions. Access is limited to personnel who need it to operate, support or secure the Service.

Vabumi implements and maintains the technical and organisational measures set out in Annex II, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons (GDPR Article 32). Vabumi may update those measures from time to time, provided the updates do not materially reduce the overall level of protection.

You give Vabumi general written authorisation to engage the sub-processors listed in Annex III. Vabumi imposes on each sub-processor, by written contract, data-protection obligations that are no less protective than those in this DPA, and remains fully liable to you for the performance of each sub-processor’s obligations.

Vabumi will publish any intended addition or replacement of a sub-processor in Annex III on this page and notify your organisation’s administrators by email at least 30 days before the new sub-processor processes Customer Personal Data. You may object on reasonable, data-protection-related grounds within that period. If we cannot resolve the objection, either party may terminate the affected part of the Service, and you will receive a pro-rata refund of any prepaid fees for the terminated part.

Sub-processors engaged only for Vabumi’s own controller processing (see §1) are disclosed in the Privacy Policy and are not subject to this notice procedure.

Some features of the Service send Customer Personal Data — including free-text task content and staff voice recordings — to third-party AI providers for transcription, extraction, classification and translation. For every AI provider in Annex III, Vabumi uses business or API terms under which the provider does not use Customer Personal Data to train or improve its models, and Vabumi will not enable any setting or programme that would allow it to. The providers, what they receive, and their retention terms are:

• OpenAI — receives The text of tasks and notes submitted to AI features, and staff voice notes as audio.. OpenAI does not use API inputs or outputs to train or improve its models. API content is retained for up to 30 days for abuse monitoring, then deleted; zero-data-retention is available on approval and will be adopted when granted.
• Anthropic — receives The text of tasks submitted for triage; and, on our own side, enquiry, meeting and account notes.. Anthropic does not train models on API inputs or outputs under its Commercial Terms. Inputs and outputs are deleted within 30 days unless flagged for policy enforcement or retention is required by law.

Vabumi does not itself train models on Customer Personal Data. Where a provider offers a shorter retention or zero-data-retention option for API customers, Vabumi will adopt it and reflect the change in Annex III.

Taking into account the nature of the processing, Vabumi will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to data-subject requests under Chapter III of the GDPR. If a data subject contacts Vabumi directly about Customer Personal Data, Vabumi will refer the request to you without undue delay and will not respond on your behalf unless you instruct it to.

Vabumi will also assist you, taking into account the nature of the processing and the information available to it, in meeting your obligations under GDPR Articles 32 to 36 (security, breach notification, data-protection impact assessments and prior consultation).

Vabumi will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases as it becomes available. Vabumi will cooperate with you and take reasonable steps to contain and remediate the breach.

Vabumi hosts and processes Customer Personal Data in the locations stated in Annex I. Where a sub-processor processes Customer Personal Data outside the European Economic Area, the transfer is made under a lawful transfer mechanism: an EU adequacy decision (including for Switzerland and, for organisations certified under the EU-US Data Privacy Framework, the United States), or the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) as incorporated in Vabumi’s agreement with that sub-processor. The mechanism relied on for each sub-processor is stated in Annex III.

Where you are established in the United Kingdom or Switzerland, the applicable UK Addendum or Swiss amendments to the Standard Contractual Clauses are deemed incorporated to the extent required.

During the term of the Agreement you can export Customer Data through the Service or by request. On termination or expiry, Vabumi will, at your choice, return or delete all Customer Personal Data — and will in any event delete it within 90 days of termination, unless EU or Member State law requires longer storage of specific records. In that case Vabumi will retain only the records so required, for only as long as required, and will continue to protect them under this DPA. Deletion from backups follows the backup rotation cycle of the hosting provider.

Vabumi will make available to you all information necessary to demonstrate compliance with Article 28 GDPR, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Audits are limited to once per twelve months (more often following a personal data breach or where required by a supervisory authority), on at least 30 days’ written notice, during business hours, at your cost, and subject to reasonable confidentiality obligations. Vabumi will first satisfy audit requests through written responses and any available third-party assessment reports; on-site inspection is reserved for where those are insufficient.

This DPA takes effect when you accept the Terms of Service or otherwise begin using the Service, and remains in force for as long as Vabumi processes Customer Personal Data on your behalf. In case of conflict, this DPA prevails over the Agreement with respect to the processing of personal data. Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Data Protection Law does not permit them to be limited. This DPA is governed by the law that governs the Agreement — the laws of Estonia unless otherwise agreed in writing.

Countersigned copy. Acceptance of the Terms of Service is recorded per organisation and is sufficient to bind both parties to this DPA. If your procurement or legal process requires a countersigned copy, print this page, complete the block below, and send it to [email protected]. Vabumi will countersign and return it. Filling in the block below does not change the terms above.