Data Processing Agreement

This Data Processing Agreement ("DPA") applies when a Business or Enterprise customer (the controller) uses Solvani and Victoriny AB (the processor) processes personal data on its behalf under Article 28 of the GDPR. It forms part of the Terms of Service.

1. Subject and duration

Processing of communication, contact and calendar data from accounts the customer connects, for the duration of the subscription.

2. Instructions

We process personal data only on the customer's documented instructions, which are the configuration and use of the service, and inform the customer if an instruction appears to breach data protection law.

3. Confidentiality and security

Personnel with access are bound by confidentiality. We apply the technical and organisational measures described on our security page, including encryption, access control with two-factor authentication and row-level isolation.

4. Subprocessors

The customer authorises the listed subprocessors. We give at least 30 days' notice of new subprocessors, and the customer may object.

5. International transfers

Transfers outside the EU/EEA rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, as applicable.

6. Assistance, breaches and audits

We assist with data subject requests and impact assessments, notify personal data breaches without undue delay and at the latest within 48 hours, and make information available to demonstrate compliance.

7. Deletion

At the end of the subscription we delete or return personal data within 30 days, unless law requires storage.

Enterprise customers can request a signed copy via support@solvani.app.