Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") applies when the Vigilbase entity that contracts with you ("Vigilbase") Processes Customer Personal Data on your behalf in providing the Services. If this DPA conflicts with the Terms of Service or an Order Form on the Processing of Personal Data, this DPA prevails.

For Customer Personal Data, you are the controller and Vigilbase is your processor. If you act as a processor for your own customers, for example as a managed service provider, Vigilbase is your subprocessor and you confirm that your controller has authorized our appointment.

Vigilbase is an independent controller of personal data that it Processes for its own purposes, such as account administration, billing, security of the Services, our websites and marketing. Our Privacy Policy covers that Processing.

2. Definitions

• "Customer Personal Data" means Personal Data in Customer Content that Vigilbase Processes on your behalf.
• "Data Protection Laws" means all laws on the Processing of Personal Data that apply to a party, including the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, US state privacy laws such as the California Consumer Privacy Act, Brazil's LGPD, South Africa's Protection of Personal Information Act, Kenya's Data Protection Act 2019, the DIFC Data Protection Law 2020 and the UAE Personal Data Protection Law.
• "Personal Data", "Process", "controller", "processor" and "data subject" have the meanings given in the Data Protection Laws, and include equivalent terms such as "personal information", "service provider", "responsible party" and "operator".
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Subprocessor" means any processor, including a Vigilbase Affiliate, that Vigilbase engages to Process Customer Personal Data.
• "Standard Contractual Clauses" means the clauses adopted by European Commission Implementing Decision (EU) 2021/914.

3. Processing on your instructions

Vigilbase will Process Customer Personal Data only on your documented instructions. Your instructions are the Terms of Service, your Order Forms, your configuration and use of the Services, and any other written instructions we agree. Vigilbase will tell you if it believes an instruction breaks Data Protection Laws, and may then suspend the affected Processing.

If a law requires Vigilbase to Process Customer Personal Data otherwise, Vigilbase will tell you before doing so unless that law prohibits it.

The subject matter, nature, purpose and duration of the Processing and the types of Personal Data and data subjects are described in Annex 1.

4. Personnel

Vigilbase will give access to Customer Personal Data only to personnel who need it to provide the Services, who are bound by confidentiality obligations and who have completed security and privacy training.

5. Security

Vigilbase will implement and maintain the technical and organizational measures in Annex 2. Vigilbase operates an information security program that is ISO 27001 and SOC 2 Type 2 compliant. We may update the measures as technology and threats change, provided that the overall level of protection is not reduced.

6. Subprocessors

You give Vigilbase general authorization to engage Subprocessors. The current Subprocessors, including Vigilbase Affiliates, are listed in the Vigilbase Trust Center.

Vigilbase will update the list at least 30 days before a new Subprocessor starts Processing Customer Personal Data and will notify the account administrators of paying customers and anyone who has asked to be notified by email to legal+privacy@vigilbase.com. In an emergency affecting the security or availability of the Services, we may replace a Subprocessor sooner and will notify you as soon as possible.

You may object to a new Subprocessor on reasonable data protection grounds within 14 days of notice. We will then work with you in good faith to find a solution. If we cannot, you may terminate the affected Services by written notice and we will refund prepaid fees for the remaining term.

Vigilbase will impose on each Subprocessor, by written contract, data protection obligations that protect Customer Personal Data at least as well as this DPA, and remains liable to you for its Subprocessors' performance of those obligations.

7. Assistance

Taking into account the nature of the Processing, Vigilbase will help you, through the features of the Services and otherwise as reasonably needed, to respond to requests from data subjects exercising their rights. If a data subject contacts us directly about Customer Personal Data, we will refer them to you.

Vigilbase will give you reasonable information and help for your data protection impact assessments and prior consultations with supervisory authorities, to the extent they relate to our Processing.

8. Personal Data Breaches

Vigilbase will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed. We will provide further information as it becomes available.

Vigilbase will take reasonable steps to contain and remedy the breach and will help you meet your obligations to notify supervisory authorities and data subjects. Notifying you of a breach is not an admission of fault or liability.

9. Audits

Vigilbase will make available the information reasonably necessary to demonstrate compliance with this DPA. On request, and subject to confidentiality, we will provide our latest SOC 2 Type 2 report and ISO 27001 certificate and answer a reasonable security questionnaire once a year.

If that information is not enough to show compliance, a supervisory authority requires it, or after a Personal Data Breach, you may audit our Processing of Customer Personal Data. Audits need 30 days' notice, take place no more than once in 12 months during business hours, are carried out by you or an independent auditor bound by confidentiality, are at your cost, and must not access other customers' data or compromise security.

10. International transfers

Vigilbase and its Subprocessors Process Customer Personal Data in the countries shown on the subprocessors page, including the United States. Vigilbase will transfer Customer Personal Data across borders only in compliance with Data Protection Laws.

EEA. For transfers from the European Economic Area to a country without an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA. Module Two applies where you are a controller, and Module Three where you are a processor. You are the data exporter and Vigilbase is the data importer. Clause 7 (docking) applies. Under clause 9, option 2 (general written authorization) applies with the notice period in section 6. The optional wording in clause 11 does not apply. Under clause 13, the competent supervisory authority is the one determined by your establishment or representative. Clauses 17 and 18 select the law and courts of Ireland. Annexes I and II are completed by Annexes 1 and 2 of this DPA, and Annex III by the subprocessors page.

United Kingdom. For transfers subject to UK data protection law, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner applies. Its tables are completed with the details in this DPA, and neither party may end it under its section 19.

Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the Standard Contractual Clauses apply as above, references to the GDPR include the Swiss Act, the Federal Data Protection and Information Commissioner is a competent supervisory authority, and data subjects in Switzerland may sue in Switzerland.

Other countries. Where another Data Protection Law requires a transfer mechanism, such as Brazil's LGPD standard contractual clauses, section 72 of South Africa's POPIA, sections 48 to 50 of Kenya's Data Protection Act or the transfer rules of the DIFC Data Protection Law, this DPA and the clauses above are intended to provide the required safeguards. Where a law requires its own standard clauses, they are incorporated with the details in this DPA.

Vigilbase will ensure that any Affiliate that Processes Customer Personal Data is bound by written terms at least as protective as this DPA, including the transfer mechanisms above. If a public authority requests access to Customer Personal Data, Vigilbase will notify you where the law allows, and will challenge requests it considers unlawful.

11. Return and deletion

During the term you can export Customer Content through the Services. Within 30 days after the Services end, Vigilbase will delete Customer Personal Data, unless the law requires us to keep it. Copies in backups are deleted as the backups expire, within 90 days, and stay protected by this DPA until then.

12. US state privacy laws

Where US state privacy laws apply, Vigilbase is your service provider or processor. Vigilbase will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Services, and will not combine it with personal information from other sources except as those laws allow. Vigilbase will comply with those laws, provide the same level of protection they require, notify you if it can no longer meet its obligations, and let you take reasonable steps to stop and remediate unauthorized use.

13. Liability and term

Each party's liability under this DPA is subject to the limitations in section 19 of the Terms of Service, except where Data Protection Laws or the Standard Contractual Clauses do not allow it to be limited. This DPA applies for as long as Vigilbase Processes Customer Personal Data.

Annex 1: Description of the Processing

Annex 2: Technical and organizational measures

• Governance. An information security management system that is ISO 27001 compliant and SOC 2 Type 2 audited, with policies reviewed at least yearly and a named security lead.
• Access control. Single sign-on and multi-factor authentication for staff, role-based least-privilege access, step-up authentication for sensitive actions, quarterly access reviews and prompt removal of access when staff leave.
• Encryption. TLS 1.2 or higher in transit and AES-256 or equivalent at rest. Secrets are held in a managed secrets store, never in source code.
• Tenant isolation. Customer data is separated by tenant in the application and database layers, and isolation is tested.
• Secure development. Code review for every change, automated tests and security scanning in CI, dependency monitoring and protected production deployments.
• Monitoring and logging. Centralized logging of administrative and security events, alerting and 24/7 coverage by our follow-the-sun teams.
• Vulnerability management. Regular penetration testing, a public vulnerability disclosure program and remediation timelines by severity.
• Incident response. A documented and tested incident response plan, including breach notification as set out in section 8.
• Resilience. Hosting on providers with redundant infrastructure, backups and documented recovery procedures.
• Vendor management. Security and privacy review of Subprocessors before use and periodically after.
• People. Confidentiality agreements, security and privacy training at hiring and every year, and pre-employment screening where local law allows.
• Physical security. Provided by our hosting providers' certified data centers. Vigilbase does not operate its own data centers.