Data Processing Agreement

VitaMedas processes Personal Data only on the documented instructions of the Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by Union, Member State or United States law to which VitaMedas is subject (in which case VitaMedas shall inform the Controller of that legal requirement before processing, unless the relevant law prohibits such information on important grounds of public interest).

The Controller’s documented instructions comprise:

• the underlying Master Services Agreement, order form and Terms of Service;
• this DPA and its Annexes;
• configuration options selected by the Controller in the VitaMedas administrative console or by API call;
• API calls and dashboard actions executed by the Controller’s authorised users in their capacity as such; and
• any additional written instructions signed by both parties.

VitaMedas shall immediately inform the Controller if, in its opinion, an instruction infringes GDPR, KVKK, UK GDPR or other applicable data-protection law, without prejudice to Section 9.2 (Customer indemnity).

VitaMedas ensures that persons authorised to process Personal Data have committed themselves to confidentiality through written agreements that survive termination of their relationship with VitaMedas, or are under an appropriate statutory obligation of confidentiality. Access to Personal Data is restricted on a least-privilege basis; only a documented subset of engineering and incident-response personnel can access production infrastructure, and even that subset cannot decrypt user payloads owing to the zero-knowledge architecture.

VitaMedas implements and maintains appropriate technical and organisational measures as required by Article 32 GDPR to ensure a level of security appropriate to the risk, including the measures referred to in Article 32(1)(a)–(d). A high-level summary is set out in Annex II and is detailed in the VitaMedas Security Statement, which is incorporated by reference and forms part of this DPA.

VitaMedas may update its technical and organisational measures from time to time, provided that any update does not materially decrease the overall level of protection.

The Controller grants VitaMedas general written authorisation to engage sub-processors for the purpose of providing the service, subject to this Section 5.4.

The current list of authorised sub-processors, together with the country of processing and the nature of the service provided, is published at vitamedas.com/legal/subprocessors and reproduced in Annex III. The Controller is authorised to subscribe to email notifications of changes through the Sub-processors page.

VitaMedas shall inform the Controller of any intended addition or replacement of sub-processors at least thirty (30) days in advance of the change becoming effective. During that notice period the Controller may object to the change for legitimate, documented data-protection reasons by email to privacy@vitamedas.com. If the parties cannot resolve the objection in good faith within thirty (30) days of receipt of the objection, the Controller may terminate the affected portion of the service for cause, without penalty, on written notice. No refund is owed for the unused portion of any prepaid term where termination is by reason of sub-processor objection.

VitaMedas shall (i) impose on each sub-processor, by written contract, data-protection obligations substantively equivalent to those imposed on VitaMedas under this DPA and (ii) remain fully liable to the Controller for the performance of the sub-processor’s obligations, in accordance with Article 28(4) GDPR.

VitaMedas shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller’s obligations to respond to requests from Data Subjects exercising their rights under Articles 12–22 GDPR and Article 11 KVKK, including the rights of access, rectification, erasure, restriction, portability, objection and not to be subject to automated decision-making.

VitaMedas shall acknowledge a documented request for assistance within two (2) business days and provide substantive assistance within five (5) business days of receipt, save where the complexity or volume of the request reasonably requires a longer period (in which case VitaMedas shall communicate the expected timeline to the Controller without undue delay).

By reason of the zero-knowledge architecture, VitaMedas’s assistance is necessarily limited to operations available on the ciphertext layer (for example, deletion or restriction of an object) and on account-level metadata. The Controller acknowledges that this is the deliberate design of the platform and forms part of the consideration for it.

VitaMedas shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR taking into account the nature of the processing and the information available to VitaMedas. Without limitation, VitaMedas shall:

• provide reasonable information to support a Controller data-protection impact assessment under Article 35 GDPR;
• cooperate with the supervisory authority where prior consultation is required under Article 36 GDPR;
• notify Personal Data Breaches in accordance with Section 8 of this DPA; and
• provide on request a copy of its current Security Statement and most recent third-party penetration-test summary, where available.

On termination or expiry of the underlying agreement, the Controller may elect, by written notice given within thirty (30) days of the effective termination date, to have VitaMedas (a) return all Personal Data to the Controller in encrypted form, in the file formats native to the platform, or (b) permanently delete all Personal Data. In the absence of such election within the 30-day window, VitaMedas shall permanently delete all Personal Data within a further thirty (30) days.

Permanent deletion comprises the removal of the ciphertext blobs and associated wrapped keys from primary storage and from any backup copy within thirty-five (35) days. The Controller acknowledges that, even prior to such deletion, the ciphertext is cryptographically unrecoverable without the data subject’s passphrase, which VitaMedas does not hold.

VitaMedas may retain Personal Data after termination only to the minimum extent and for the minimum period required by applicable law. Where such retention applies, VitaMedas continues to be bound by all confidentiality and security obligations of this DPA in respect of the retained data.

On request, VitaMedas shall provide the Controller with a written certificate of deletion signed by an authorised officer.

VitaMedas shall make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to the following terms (which the parties agree are reasonable in the context of a multi-tenant zero-knowledge service):

1. Frequency. Audits shall be conducted no more than once per twelve (12) month period, save where (i) required by a competent supervisory authority or (ii) following a Personal Data Breach for which VitaMedas is responsible.
2. Notice. The Controller shall give VitaMedas not less than thirty (30) days’ prior written notice of an intended audit, save in the case of an emergency audit required by a supervisory authority (in which case the notice period shall be as short as is reasonably practicable).
3. Conduct. The auditor shall execute a confidentiality undertaking acceptable to VitaMedas before receiving any information. The audit shall be conducted during regular business hours, in a manner that does not unreasonably interfere with VitaMedas’s operations, and shall be limited in scope to documents, controls and interviews reasonably necessary to assess compliance with this DPA.
4. Cost. Each party shall bear its own costs of the audit. VitaMedas reserves the right to charge the Controller a reasonable fee, based on VitaMedas’s then-current professional services rates, for time spent by VitaMedas personnel assisting the audit in excess of eight (8) person-hours per audit.
5. Substitution. VitaMedas may discharge its audit obligation in whole or in part by furnishing on-demand attestations, third-party audit reports (for example, SOC 2 or ISO 27001 once obtained), penetration-testing summaries, and responses to a written security questionnaire, provided that such substitute materials reasonably address the matters that the Controller intends to audit.
6. Multi-tenant integrity. No audit may compromise the security of any other VitaMedas customer, expose any other customer’s data, or require disclosure of VitaMedas trade secrets unrelated to the processing of the Controller’s Personal Data.

Where the Controller is established in the EEA and Personal Data is transferred to a country that has not received an adequacy decision under Article 45 GDPR, the SCCs are hereby incorporated into this DPA by reference, with the following module elections and dock-in particulars:

• Module Two (Controller to Processor) applies between the Controller and VitaMedas where VitaMedas is established outside the EEA;
• Module Three (Processor to Processor) applies between VitaMedas and any sub-processor established outside the EEA;
• the optional docking clause is incorporated;
• Clause 7 (Docking), Clause 9(a) Option 2 (General written authorisation, 30-day notice), Clause 11(a) (No independent dispute resolution body), Clause 17 Option 1 (governing law of the EU Member State of the data exporter, or Ireland if exporter is outside the EEA), Clause 18 (Forum and jurisdiction: the courts of the data exporter’s EU Member State, or Ireland) are elected;
• Annexes I and II to the SCCs are completed by reference to Annexes I, II and III of this DPA, mutatis mutandis.

Where the Controller is established in the United Kingdom, the UK International Data Transfer Addendum to the SCCs (Version B1.0, in force 21 March 2022) is incorporated by reference. Tables 1–4 of the Addendum are completed by reference to the corresponding particulars of this DPA and its Annexes. The parties select the ICO-issued Addendum rather than the standalone IDTA.

For Customers established in Türkiye and Personal Data of Turkish data subjects, cross-border transfers are conducted pursuant to Article 9 KVKK on the basis of (i) the explicit consent of the data subject where required, or (ii) an undertaking executed by VitaMedas as transferor and the relevant recipient as approved by the KVKK Board, or (iii) within the framework of the binding corporate rules where applicable.

Subject to Section 9.3, the aggregate liability of VitaMedas arising out of or in connection with this DPA, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the lower of (i) the fees paid by the Controller to VitaMedas under the underlying agreement during the twelve (12) months preceding the event giving rise to the claim, or (ii) ten thousand euros (€10,000). This cap is in addition to, and does not increase, any liability cap stated in the underlying agreement; where both apply, the lower cap prevails.

The Controller shall defend, indemnify and hold harmless VitaMedas, its affiliates, and their respective directors, officers and employees against all claims, losses, damages, liabilities, costs and expenses (including reasonable legal fees) arising out of or relating to (i) the Controller’s issuance of an instruction to VitaMedas that infringes applicable data-protection law, (ii) the Controller’s lack of an adequate legal basis under Article 6 or Article 9 GDPR (or the KVKK or UK GDPR equivalents) for the processing it directs, or (iii) the Controller’s breach of its obligations as Controller under Articles 24 to 26 GDPR.

Nothing in this DPA limits or excludes a party’s liability for (a) fraud or fraudulent misrepresentation, (b) gross negligence or wilful misconduct, (c) breach of confidentiality obligations under Section 5.2, or (d) any liability that cannot be limited or excluded under applicable law (including administrative fines imposed directly on a party by a supervisory authority).

Data exporter (Controller): the Customer identified in the underlying agreement. Contact details and the name of the data-protection contact are as set out in the Controller’s VitaMedas administrative console.

Data importer (Processor): VitaMedas, Inc., 2261 Market Street STE 69554, San Francisco, CA 94114, United States Data-protection contact: privacy@vitamedas.com.

The supervisory authority competent for the data exporter is, by default, the supervisory authority of the EU Member State of the exporter’s establishment. Where the exporter is established outside the EEA, the competent supervisory authority is the Irish Data Protection Commission for the purpose of SCC Clause 13. Turkish data subjects retain rights of complaint to the KVKK Board.