Data processing agreement
Art. 28 GDPR · German: Auftragsverarbeitungsvertrag (AVV)
We process customer data only on documented instructions, under a data processing agreement pursuant to Art. 28 GDPR. The DPA applies to Vanadio pilot and roll-out agreements.
Key commitments
- Subject matter
- Classification of incoming email, extraction of structured data from business inquiries, and support of the customer's quoting workflow.
- Duration
- The term of the underlying service agreement.
- Categories of data
- Email metadata and the content of business correspondence, including contact details of the customer's business partners.
- Hosting
- Processing on servers in the European Union only.
- Sub-processors
- Engaged only with prior information to the customer and under equivalent contractual obligations. The current list is annexed to the DPA.
- Confidentiality and security
- Personnel bound to confidentiality; technical and organizational measures per the TOMs annex, including encryption and strict tenant separation.
- Deletion on termination
- On termination, customer data is returned or deleted in line with the agreed deletion concept.
- Audit rights
- The customer may verify compliance as provided in the DPA.
Get the DPA
We send the current DPA on request and countersign it for your records. Reach us at privacy@vanadio.ai.