Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Vireki Scientific Systems ("Processor") and the customer ("Controller") for Vireki services (the "Agreement"), and applies where the Processor processes Customer Personal Data on the Controller's behalf, in accordance with Article 28 of Regulation (EU) 2016/679 ("GDPR") and the UK GDPR.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR.

2. Scope and details of processing

• Subject matter: provision of licensing, account management and support services.
• Duration: the term of the Agreement plus the return/deletion period below.
• Nature and purpose: storage, hosting, licence validation, support communications.
• Data subjects: Controller's authorised users and contacts.
• Categories of data: names, business email addresses, organisation, licence and seat data, support correspondence, technical identifiers.
• Special categories: none intended.

3. Processor obligations

1. Process personal data only on documented instructions of the Controller, including the Agreement (Art. 28(3)(a)).
2. Ensure persons authorised to process are bound by confidentiality (Art. 28(3)(b)).
3. Implement appropriate technical and organisational measures under Art. 32 (Annex 2).
4. Engage subprocessors only per Section 4 (Art. 28(2), (4)).
5. Assist the Controller in responding to data subject requests (Art. 28(3)(e)).
6. Assist with Art. 32–36 obligations, including DPIAs and prior consultation.
7. Delete or return personal data at the end of services (Section 7).
8. Make available information necessary to demonstrate compliance and allow audits (Section 6).

4. Subprocessors

The Controller gives general authorisation for the subprocessors listed on the Subprocessors page. The Processor will notify the Controller at least 30 days before adding or replacing a subprocessor; the Controller may object on reasonable data-protection grounds, and if unresolved, terminate the affected services. The Processor imposes equivalent data-protection obligations on each subprocessor and remains liable for their performance.

5. Personal data breaches

The Processor will notify the Controller without undue delay, and in any event within 48 hours [placeholder], after becoming aware of a personal data breach, providing information reasonably required for the Controller's Art. 33/34 obligations.

6. Audits

The Processor will provide summaries of security documentation and, no more than once per year on 30 days' notice, permit audits by the Controller or an independent auditor bound by confidentiality, at the Controller's cost.

7. Return and deletion

Within 30 days of termination, the Processor will delete or return Customer Personal Data at the Controller's choice, unless retention is required by law.

8. International transfers

Transfers outside the EEA/UK are made under an adequacy decision or the EU Standard Contractual Clauses (Module 2/3) and UK Addendum, which are incorporated by reference.

9. Liability and precedence

Liability is subject to the limits in the Agreement. In case of conflict, this DPA prevails over the Agreement regarding personal data processing; the SCCs prevail over this DPA.

Annex 1 — Parties

Processor: Vireki Scientific Systems, [address placeholder], contact hello@vireki.com. Controller: as identified in the order form.

Annex 2 — Technical and organisational measures

• Encryption in transit (TLS 1.2+) and at rest.
• Role-based access control, least privilege, MFA for administrative access.
• Logging and monitoring of access to production systems.
• Regular backups and tested restore procedures.
• Vulnerability management and dependency patching.
• Staff confidentiality obligations and security training.

To execute a signed copy of this DPA, contact hello@vireki.com.