Data Processing Agreement

01Framework and roles

This Data Processing Agreement ('DPA') forms part of the contract between the customer (data controller) and Virtus Lever (data processor), within the meaning of Article 28 of the GDPR.

02Subject of processing

Virtus Lever processes personal data solely on behalf of the customer, for the purpose of providing the email prioritisation service: analysis, scoring, and presentation of the daily priority.

03Duration

Processing lasts for the duration of the contractual relationship. Upon termination, data is deleted or returned at the customer's choice, within 24 hours.

04Processor obligations

• Process data only on documented instructions from the customer.
• Ensure confidentiality of persons authorised to process the data.
• Implement appropriate technical and organisational security measures.
• Assist the customer in responding to data subject rights requests.
• Notify any data breach without undue delay.

05Subprocessors

The customer authorises the use of subprocessors listed on the Subprocessors page. Any new addition will be communicated in advance, giving the customer the opportunity to object.

06Transfers outside the EU

Data is hosted within the European Union. No transfer outside the EU is made without appropriate safeguards (standard contractual clauses).

07Security

AES-256 encryption at rest, TLS 1.3 in transit, access compartmentalisation and logging. Measures are reviewed regularly.

08Audit

Virtus Lever makes available the information necessary to demonstrate compliance with Article 28 and submits to reasonable audits, with reasonable notice.