Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Vantrel LLC (“Processor”) and the customer (“Controller”). It applies to personal information contained in Customer Data that we process on the Controller’s behalf while providing the service.

2. Details of processing

• Subject matter: hosting and processing of Customer Data to provide the service.
• Duration: the term of the subscription, plus the deletion period below.
• Nature and purpose: storage, organization, display, export and deletion of operational records.
• Data subjects: the Controller’s Users, staff, contractors and contacts recorded in the workspace.
• Categories of data: names, work contact details, assignments, schedules, notes, photos and activity records entered by the Controller. The Controller should not enter sensitive categories of data unless strictly necessary.

3. Instructions

We process personal information only on the Controller’s documented instructions, which are given through the Terms, the Order and the Controller’s use of the service settings. We will tell the Controller if we believe an instruction breaks applicable law.

4. Confidentiality

Personnel with access to Customer Data are bound by confidentiality obligations and have access only as needed to provide and support the service.

5. Security measures

• Encrypted connections (HTTPS) between users and the service.
• Role-based access controls within each workspace.
• Restricted, logged internal access to production systems.
• Regular backups and procedures to restore availability after an incident.

6. Subprocessors

The Controller authorizes us to use subprocessors, such as cloud hosting and email delivery providers, bound by written terms that protect personal information at least as well as this DPA. We will give notice of new subprocessors and the Controller may object on reasonable grounds; if we cannot address the objection, the Controller may end the affected service.

7. Assistance and requests

We will help the Controller, taking into account the nature of the processing, to respond to requests from individuals exercising their rights and to meet its security and impact-assessment obligations. If we receive a request directly, we will refer it to the Controller.

8. Security incidents

We will notify the Controller without undue delay after becoming aware of a breach affecting its personal information, and share the information reasonably available to help it meet its own obligations.

9. Return and deletion

The Controller can export Customer Data at any time during the subscription. After the subscription ends, we delete Customer Data from the active service within 30 days and from backups on their normal rotation, unless the law requires us to keep it.

10. Information and audits

On reasonable written request, we will provide information necessary to demonstrate compliance with this DPA, and cooperate with reasonable audits conducted with prior notice and under confidentiality.