Data processing agreement (business users)

Data processing agreement (business users)

This agreement applies where you are a business customer and personal data you upload to Vitna (for example, details inside your jobs, photos or voice notes) is processed for you. It takes effect when you accept the Terms of service.

1. Roles

• Account data (your sign-in and billing details): Vitna is the controller.
• Uploaded content (the photos, notes, audio and documents you add, and the reports drafted from them): you are the controller; Vitna is the processor.

2. Processing details

• Subject matter: storage and processing of uploaded content to provide the service, including drafting reports with AI as you direct.
• Duration: until you delete the content or your account ends.
• Nature and purpose: hosting, backup, display, drafting, export.
• Categories of data subjects: your staff and the people appearing in your content (for example customers, clients, patients).
• Categories of data: as you upload — text, images, audio, video, documents, and any personal data inside them.

3. Your instructions

We process uploaded content only on your instructions (the actions you take in the app) and to comply with law. We will tell you if an instruction looks unlawful.

4. Confidentiality and staff

Our staff who could access uploaded content are bound by confidentiality.

5. Security

Security measures are described on our security page. We use the hosted Supabase platform (encryption in transit; access controls; org-scoped row security) — see the security page for the summary.

6. Sub-processors

We use the processors listed on our sub-processors page. We will give 30 days’ notice in the app or by email before adding or replacing one, and you may object on reasonable grounds.

7. Data subject requests

If a person asks us directly for their data, we will refer them to you and assist you on request. Tools in the app let you export and delete content.

8. Breach notice

If we become aware of a personal data breach affecting your uploaded content, we will tell you without undue delay, with the information available to us.

9. Deletion

On account deletion (via the app or our web deletion page) we delete your uploaded content, subject to the backup window described in the privacy policy.

10. Audits

On request, we will provide the information reasonably needed to demonstrate compliance, including this agreement, the sub-processor list and our security page.

11. Contact

[email protected] · company details in the site footer.