Data Processing Agreement

Data Processing Agreement

This addendum („Addendum”) is concluded by and between:

  • The natural or legal person who accesses and uses the Platform (as defined below) to generate LinkedIn posts, for itself or on behalf of its own clients („Client”); and
  • VATIS TECH S.R.L., having its headquarters at 50 Lucian Pricop Street, Vădăstrița, Olt, sole identification number (CUI) 43155475, registered with the Trade Registry under no. J28/696/2021, operating the Brewbrand platform („Vatis Tech”)

Hereinafter, collectively, referred to as “Parties”, and, individually, referred to as “Party”.

‍

WHEREAS

  • Vatis Tech offers Brewbrand, a software product that generates LinkedIn posts based on the ideas and writing style of its users, available at https://www.brewbrand.ai and https://app.brewbrand.ai ("Platform");
  • The Client agreed to the Terms & Conditions of the Platform, available at https://www.brewbrand.ai/legal/terms-conditions ("Agreement");
  • In the performance of the Agreement, the Parties process personal data as controller and processor;
  • The Parties have decided to regulate the processing of personal data in order to meet the obligations relating to the protection of personal data imposed by the applicable legislation.

‍

THE PARTIES DECIDED AS FOLLOWS

DEFINITIONS

Personal Data

means any information about an identified or identifiable natural person;

Data Subject

means the natural person whose Personal Data is Processed;

Processing / to Process

means any operation or set of operations which is performed on Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Controller

means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;

Processor

means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller;

Subcontractor

means any Processor appointed by the Processor to Process Personal Data;

Personal Data Breach

means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed;

Relevant Personal Data

means Personal Data Processed by the Processor on behalf of the Controller, as described in Annex 1;

GDPR

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

Applicable Legislation

means GDPR, any relevant law implementing GDPR or regulating the protection of Personal Data, and any guidelines, codes of practice or other documents issued by the competent authorities;

Supervisory Authority

means the National Supervisory Authority for the Processing of Personal Data as well as any other supervisory authority concerned, in accordance with the GDPR;

Standard Contractual Clauses

means the standard clauses issued by the European Commission, in accordance with Article 46 of GDPR, for the transfer of Personal Data to countries outside the European Union and the European Economic Area, to which the European Commission has not recognised an adequate level of protection within the meaning of Article 45 of GDPR;

Services

means the services provided by the Parties in the performance of the Agreement.

PARTIES

In Processing Relevant Personal Data:

  • The Client acts as a controller (“Controller”);
  • Vatis Tech acts as a processor (“Processor”).

The Parties shall Process Relevant Personal Data in accordance with the obligations set out in this Addendum, as well as in accordance with obligations imposed by Applicable Legislation.

‍PROCESSING OF PERSONAL DATA

The Processor Processes the Relevant Personal Data of the Data Subjects only for the purposes set out in Annex 1. The Processor Processes the Personal Data only based on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by the European Union or member state law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before Processing. 

The Controller instructs the Processor and authorizes the Processor to instruct each Subcontractor to Process Relevant Personal Data and to transfer Relevant Personal Data to any third country, as necessary for the provision of the Services and the performance of the Agreement, in compliance with the provisions of this Addendum concerning the use of the Subcontractors and the transfer of the Personal Data.

The Controller warrants that it has a valid legal ground for the Processing of the Relevant Personal Data, including for providing the LinkedIn profile URLs of its own clients, and that it has informed the Data Subjects accordingly, in compliance with Articles 13 and 14 of GDPR.

PROCESSOR’S PERSONNEL

The Processor takes reasonable steps to ensure compliance with the Applicable Legislation by persons who may have access to Relevant Personal Data, ensuring that the access is strictly limited to those who must have such access. 

The Processor shall ensure that all the persons referred to in paragraph 1 are informed of the confidentiality of Relevant Personal Data and have undertaken to respect the confidentiality of Relevant Personal Data. 

USE OF SUBCONTRACTORS

The Controller authorizes the Processor to The Subcontractors indicated in Annex 2, under the terms provided for in this Addendum, in connection with the Processing of the Relevant Personal Data.

The Processor shall ensure that each Subcontractor is able to respect the level of protection of Relevant Personal Data as required in this Addendum. The Processor shall enter into a contract with each Subcontractor. Obligations similar to those set out in this Addendum for the Processor shall be imposed to the Subcontractor.

The Processor remains fully liable to the Controller for the performance of the obligations of each Subcontractor.

The Processor shall inform the Controller, by e-mail or by updating Annex 2 on the Platform, at least 15 days before adding or replacing a Subcontractor. The Controller may object on reasonable grounds within this period. If the Parties cannot reach a solution, the Controller may terminate the Agreement.

DATA SUBJECTS’ RIGHTS

The Processor shall assist the Controller in the fulfilment of its obligations arising from the exercise by the Data Subjects of their data protection rights.

The Processor shall notify and cooperate with the Controller on any request from a Data Subject for the exercise of a right in connection with Relevant Personal Data.

‍SECURITY OF PERSONAL DATA

The Processor shall implement appropriate technical and organisational measures to ensure a level of security adequate to this risk, as provided for by the GDPR, including at least the measures set out in Annex 3..

PERSONAL DATA BREACH

The Processor shall notify the Controller without undue delay and in any case within 48 hours, as of the moment when the Processor becomes aware of a Personal Data Breach in connection with Relevant Personal Data. The notification shall include, to the extent available, the information set out in Article 33 (3) of GDPR.

The Processor shall take immediate action to investigate the Personal Data Breach in connection with Relevant Personal Data and to identify, prevent and mitigate its effects as much as possible.

The Processor shall cooperate with the Controller and take reasonable steps in accordance with the Controller’s documented instructions for the remedy of the Personal Data Breaches in connection with Relevant Personal Data.

DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

Considering the nature of Processing and the information available to the Processor, the Processor assists the Controller in ensuring compliance with the obligations provided for by Articles 35 and 36 of GDPR regarding the data protection impact assessment and prior consultation.

ERASURE OR RETURN OF RELEVANT PERSONAL DATA

At the time of ceasing the provision of the Services involving the Processing of Relevant Personal Data, the Controller may request the Processor (i) to return to the Controller a copy of all Relevant Personal Data and to remove all copies of the Relevant Personal Data Processed by the Processor and/or (ii) to delete all Relevant Personal Data and to remove all copies of relevant Personal Data Processed by the Processor. The Processor will act in accordance with the instructions received from the Controller, without undue delay.

By way of exception to the provisions of paragraph 1, the Processor shall be able to keep a copy of the Relevant Personal Data, insofar is subject to a legal obligation to that effect and for the storage period required by the European Union or member state law to which the Processor is subject.

INFORMING THE CONTROLLER AND THE AUDIT RIGHT

The Processor shall inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or member state data protection provisions.

The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Addendum and in the Applicable Legislation and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. The Controller or the mandated auditor obliges to undertake confidentiality obligations towards the Processor to protect the confidentiality of the information of the Processor and of third parties which might be found out by the Controller or the mandated auditor during the audit.

TRANSFER OF PERSONAL DATA

If the Relevant Personal Data is transferred to a territory or to a country outside the European Union or the European Economic Area not designated by the European Commission as providing an adequate level of protection, the Parties will take appropriate safeguards, including by concluding Standard Contractual Clauses.

Where the Processor or its Subcontractors transfer Relevant Personal Data to a country outside the European Union or the European Economic Area not designated by the European Commission as providing an adequate level of protection, the Processor shall ensure that appropriate safeguards are in place in accordance with Article 46 of GDPR, such as Standard Contractual Clauses.

DURATION

This Addendum shall enter into force on the date the Client accepts the Agreement and shall cease on the latest of the following dates: (i) the date of termination of the Agreement or (ii) the date of termination of the last Services provided under the Agreement.

MISCELLANEOUS

This Addendum is governed by Romanian law. The Parties agree that any disputes or complaints arising under this Addendum fall within the jurisdiction of the competent Romanian courts.

Where there is a discrepancy between the provisions of this Addendum and any other agreement between the Parties, including the provisions of the Agreement, this Addendum shall prevail in respect of matters relating to the data protection obligations.

Where the obligations of the Parties need to be amended as a result of changes in the Applicable Legislation or as a result of the issuance by the European Commission or the Supervisory Authority of standard contractual clauses, including in case of modification or adoption of new Standard Contractual Clauses on international transfers, the Parties undertake to amend this Addendum accordingly.

This Addendum does not apply to the Personal Data of the Client (or of its representatives) processed by Vatis Tech as controller for the purposes of account management, payment, invoicing, communication and marketing, which is governed by the Privacy Policy available at https://www.brewbrand.ai/legal/privacy-policy.

ANNEX 1

Relevant Personal Data

  • Ideas submitted by the Client in the form of text, audio, video or images, and any Personal Data contained therein;
  • LinkedIn profile URL provided by the Client, for itself or for its own clients, and the content of the public LinkedIn posts collected based on it, for the purpose of analysing the writing style;
  • Posts generated through the Platform and messages exchanged through the Platform's chat function;
  • Name, surname, e-mail address and username of the persons designated by the Client to use the Platform.

Data Subjects

  • Persons designated by the Client to use the Platform;
  • Natural persons on whose behalf the Client generates posts (including the Client's clients);
  • Other natural persons mentioned in or appearing in the content submitted by the Client.

Nature and purpose of the Processing of Relevant Personal Data

  • Analysing the writing style of the Data Subject based on the LinkedIn posts provided;
  • Generating, editing and storing LinkedIn posts.

Subject-matter and duration of the Processing of Relevant Personal Data

  • Relevant Personal Data will be Processed during the existence of the Client's account on the Platform;
  • Upon deletion of the account, Relevant Personal Data will be deleted within [30] days, except where the Processor is required by law to retain it, in accordance with Article 10.

Processing operations

  • Collection, storage, analysis, generation of text using artificial intelligence models, editing, retrieval and erasure, as necessary for the provision of the Services.

‍

Annex 2: Subcontractors

‍

Subcontractor

Service

Relevant Personal Data

Clerk, Inc.

User authentication

Name, surname, e-mail address, LinkedIn profile URL

Convex, Inc.

Database

Name, surname, e-mail address, LinkedIn profile URL

Apify Technologies s.r.o.

Collection of public LinkedIn posts

LinkedIn profile URL

Upstash, Inc.

Caching and task queueing

User account ID, LinkedIn profile URL

Vercel Inc.

Application hosting

Data in transit through the Platform

Anthropic

AI text generation

Content of public LinkedIn posts, post ideas submitted by the Client

OpenAI

AI text generation

Content of public LinkedIn posts, post ideas submitted by the Client

‍

ANNEX 3 – TECHNICAL AND ORGANISATIONAL MEASURES

Access control

  • Access to the Platform is based on individual user accounts, managed through a dedicated authentication provider;
  • Access of the Processor's personnel to Relevant Personal Data is granted only to the extent necessary for the performance of their duties and is revoked when no longer needed;
  • Administrative accounts used to access the Processor's systems and Subcontractors' consoles are protected by multi-factor authentication.

Encryption

  • Relevant Personal Data is encrypted in transit using TLS;
  • Relevant Personal Data is encrypted at rest by the Subcontractors providing database and storage services.

Separation of data

  • Relevant Personal Data of each Client is logically separated from the data of other Clients.

Subcontractors

  • Subcontractors are selected based on their ability to provide an adequate level of security and are bound by data processing agreements;
  • Subcontractors providing artificial intelligence models do not use Relevant Personal Data to train or improve their models.

Data minimisation and erasure

  • Only the Relevant Personal Data necessary for the provision of the Services is transmitted to Subcontractors;
  • Relevant Personal Data is deleted in accordance with Annex 1 and Article 10.

Confidentiality

  • Persons authorised to process Relevant Personal Data are bound by confidentiality obligations.

Incident management

  • The Processor maintains a procedure for detecting, investigating and notifying Personal Data Breaches, in accordance with Article 8.

Testing and review

  • The Processor regularly reviews and updates these measures, taking into account the state of the art and the risks of the processing.

‍