Data processing agreement

#1Parties, roles and scope

You — the customer: the organisation that owns one or more vitrinka workspaces, acting as controller (or as a processor for your own clients, in which case we act as your sub-processor and this agreement applies accordingly).

We — LEFTEQ s.r.o., Herálecká IV 1583/4, Krč, 140 00 Praha 4, Czech Republic (IČO 21624062), operator of vitrinka, acting as processor.

This agreement covers the personal data contained in workspace content: boards, cards, annotations, uploads, artifacts, screenshot sets, recorded sessions, project indexes, tasks and related material you and your agents put into workspaces. It does not cover the account, billing and security data we process as a controller in our own right — the privacy policy describes that half.

It forms part of the terms of service. Where this agreement and the terms conflict on the processing of personal data, this agreement controls.

#2Description of the processing

Subject matter

Hosting and operating vitrinka workspaces for the customer.

Duration

The life of the customer's organisation and its workspaces, plus the deletion window in section 8.

Nature and purpose

Storage, retrieval, display, rendering, indexing, replay, projection onto boards, transmission to recipients the customer designates (share links, connected apps, AI providers), backup and deletion — always on the customer's instructions, never for our own purposes.

Categories of data subjects

The customer's team members and agents; and any person whose data appears in content the customer brings in — typically the customer's own users and customers, above all people appearing in recorded browser sessions.

Categories of personal data

Whatever the customer's content contains. Typically: names, email addresses, identifiers, screen content and interaction data captured by the journey recorder (including network requests and console output, after redaction), and the actor names attached to writes. The terms prohibit bringing in special-category data (GDPR Art. 9), payment card numbers and government identity documents.

#3Instructions — Art. 28(3)(a)

We process workspace content only on your documented instructions, including for international transfers. Your instructions are: the operations you and your members perform in the product, through the API, the CLI and connected apps; the configuration you set (retention, redaction policy, share links); and this agreement. We follow additional reasonable written instructions if they concern data protection and are technically feasible; if an instruction requires engineering work, we tell you and agree the terms first.

If we believe an instruction infringes the GDPR or other applicable data-protection law, we tell you without undue delay before carrying it out.

The one exception: we process without instructions where EU or Czech law requires us to, and we tell you which law, before processing, unless that law forbids the telling.

#4Confidentiality — Art. 28(3)(b)

Every person we authorise to process workspace content is bound by a contractual or statutory duty of confidentiality. Production access is limited to the people who operate the service; we do not read workspace content as a matter of routine, and the per-workspace encryption described in the security overview means stored content is ciphertext to anyone without the workspace's key path.

#5Security — Art. 28(3)(c), Art. 32

We implement and maintain the technical and organisational measures published at /legal/security — per-workspace envelope encryption at rest, full-disk encryption below it, TLS in transit, physical tenant isolation, hashed credentials and tokens, scoped and rotating connector tokens, rate limiting, an append-only security audit trail, encrypted and rehearsed backups, and the rest of that page, which forms the security annex of this agreement (section 11).

We may improve the measures over time; we will not materially reduce the overall level of protection during a subscription period.

#6Sub-processors — Art. 28(3)(d)

You give general written authorisation for the sub-processors listed at /legal/subprocessors, which names each entity, its role, location and transfer safeguard.

• We email organisation owners at least 30 days before a new sub-processor starts processing workspace content.
• If you object on reasonable data-protection grounds and we cannot offer a workaround, you may terminate the affected subscription and we refund any prepaid fees for the period after termination.
• Every sub-processor is bound by a written contract imposing data-protection obligations no less protective than this agreement, and we remain fully liable to you for its performance.
• Providers you connect yourself — an AI provider on your own key, an AI assistant via OAuth — are your processors or recipients, not our sub-processors, and are deliberately outside this clause.

#7Assistance — Art. 28(3)(e) and (f)

Data-subject requests. Taking into account the nature of the processing, we assist you with appropriate technical and organisational measures in fulfilling your obligation to respond to data-subject requests. In practice you can serve most requests yourself — content is readable, exportable and deletable in the product and through the API — and if a request reaches us directly concerning your workspace content, we forward it to you without undue delay and do not answer it in your place.

Breach notification. We notify you without undue delay, and in any case within 72 hours of becoming aware, of a personal-data breach affecting your workspace content — with the nature of the breach, the categories and approximate numbers concerned, the likely consequences, the measures taken or proposed, and a contact point — supplementing as facts emerge.

DPIAs. We assist you with data protection impact assessments and prior consultations concerning your use of vitrinka, primarily through the documentation at /legal/security, /legal/subprocessors and the privacy policy, and by answering specific questions at privacy@vitrinka.ai.

#8Deletion and return — Art. 28(3)(g)

You can take your content out at any time while the subscription runs: sets export as zip archives, and board and library content is reachable through the documented API. On written request we produce a machine-readable archive within 30 days.

On termination of the subscription, or when you delete a workspace, we delete the workspace's content: its encryption key is destroyed immediately — making the stored content permanently unreadable, including inside existing backups — and the ciphertext is then physically removed. Backup archives rotate out entirely within 30 days. We certify completed deletion in writing on request.

We retain data past termination only where EU or Czech law requires it, and only for as long as it requires.

#9Information and audits — Art. 28(3)(h)

We make available the information necessary to demonstrate compliance with Article 28: the security overview, the sub-processor register, this agreement, and written answers to your security and compliance questionnaires, which we complete promptly and honestly.

Where that documentation is genuinely insufficient, you (or an independent auditor you mandate, who is not our competitor) may audit, under these conditions: 30 days' written notice, at most once per 12 months (and additionally after a breach affecting your data), during business hours, at your cost, without access to other customers' data or to systems whose inspection would compromise them, and under confidentiality. We contribute to audits by making knowledgeable people available.

#10International transfers

Workspace content is processed in the European Union — hosting and storage at Hetzner in Germany and Finland. We do not transfer it to a third country on our own initiative.

Where a restricted transfer nonetheless occurs through a listed sub-processor, it is covered by the safeguard named for that sub-processor on the register: an EU–US Data Privacy Framework certification or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), which are incorporated into this agreement by reference — Module Two where you are a controller, Module Three where you are a processor — to the extent such a transfer occurs.

Transfers you cause yourself — content you send to an AI provider or assistant you connected — are yours: you choose the provider, so you choose the transfer and its safeguard.

#11Liability, term and the annex

Liability under this agreement follows the limitation in the terms of service, except where the GDPR mandates otherwise (Article 82 governs the allocation between controller and processor).

This agreement runs as long as we process workspace content for you and ends when deletion under section 8 completes. Sections that by nature survive — confidentiality, liability, audit rights over the processed period — survive.

Security annex. The technical and organisational measures are the ones published and dated at /legal/security, which forms part of this agreement. Sub-processor annex: the register at /legal/subprocessors. Processing description: section 2 above.