Data Processing Agreement

This Data Processing Agreement ("DPA") is made between the customer that uses a Talivio product as a business or organisation ("Controller", "you") and Talivio Technology OÜ, registry code 16991406, Ahtri tn 12, 15551 Tallinn, Estonia ("Talivio", "Processor", "we").

It applies whenever we process personal data on your behalf in one of the products listed in Annex 1. It forms part of the agreement under which you use that product (the "Main Agreement") and takes effect when you accept that agreement, for example by creating an account, team or workspace. If you need a countersigned copy, write to [email protected]; the signed copy has the same content as this page.

Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning given in Regulation (EU) 2016/679 ("GDPR").

1. Roles and scope

1.1 You are the controller of the personal data you or your users put into a product ("Customer Personal Data"). We process it as your processor. Where you are yourself a processor for someone else, we are your sub-processor and you confirm that your controller has authorised this.

1.2 We are a controller, not a processor, for the data we need to run our own business with you: your account and sign-in data in Talivio Accounts, billing and payment records, support correspondence and security logs. That processing is described in our privacy policy and is outside this DPA.

1.3 You are responsible for having a lawful basis for the processing, for the content of your instructions, for the information you give to data subjects, and for the accuracy of the data you put into a product.

1.4 Where your processing is also subject to a law outside the EU/EEA — for example the Turkish Personal Data Protection Law No. 6698 (KVKK) — compliance with that law remains your responsibility as controller, including any notice, registration, explicit consent or cross-border transfer requirement (such as KVKK Article 9 for data stored on our EU servers). We act as your processor under Article 28 GDPR and give you the information you reasonably need for it.

2. Subject matter, duration, nature and purpose

2.1 The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects for each product are set out in Annex 1. The purpose is always to provide the product you use, as described in the Main Agreement and its documentation, and to support and secure it.

2.2 This DPA lasts as long as we process Customer Personal Data for you under the Main Agreement, plus the deletion periods in section 9.

3. Processing only on your instructions

3.1 We process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country, unless EU or Member State law requires otherwise; in that case we inform you before processing unless that law prohibits it. Your instructions are this DPA, the Main Agreement and your use and configuration of the product (for example sending a message, approving a change on a server, starting a scan or enabling an AI feature).

3.2 We tell you immediately if, in our opinion, an instruction infringes the GDPR or other EU or Member State data protection law.

3.3 We do not sell Customer Personal Data, do not use it for our own purposes such as advertising or profiling, and do not use it to train AI models.

4. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and accesses it only as far as needed to provide, support or secure the product.

5. Security of processing

We take the technical and organisational measures required by Article 32 GDPR. The measures in place today are listed in Annex 3. We may change them as technology develops, but never so that the overall level of protection drops.

6. Sub-processors

6.1 You give us a general authorisation to engage sub-processors. The sub-processors in use today are listed in Annex 2.

6.2 We announce any intended addition or replacement of a sub-processor on this page and by e-mail to the account owner at least 30 days in advance. You may object on reasonable data protection grounds within that period. We will then try to find a solution with you; if we cannot, you may terminate the affected product without penalty before the change takes effect.

6.3 We impose on each sub-processor, by contract, data protection obligations that offer the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures. We remain fully liable to you for the performance of our sub-processors' obligations.

6.4 Services that you choose and connect — for example your own servers and hosting provider in Hostio, your own Meta WhatsApp Business account in Replio, your own domain and DNS provider in Mailio, or a payment provider you connect to your own account — are not our sub-processors. Your relationship with them is your own.

7. Data subject requests

Taking into account the nature of the processing, we help you with appropriate technical and organisational measures to answer requests from data subjects exercising their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection). Most requests can be handled by you directly in the product (export, edit, delete). If a data subject contacts us directly about Customer Personal Data, we forward the request to you without undue delay and do not answer it ourselves unless you instruct us to.

8. Assistance, breach notification and impact assessments

8.1 Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 GDPR: security of processing, notification of personal data breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation.

8.2 We notify you of a personal data breach affecting Customer Personal Data without undue delay and at the latest within 48 hours after becoming aware of it, so that you can meet the 72-hour deadline of Article 33 GDPR. The notice goes to the account owner by e-mail and includes, as far as then known, the information listed in Article 33(3): the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information we do not yet have follows in phases without further undue delay.

8.3 We document every breach, take reasonable steps to contain it and reduce its effects, and do not notify authorities or data subjects about your data on your behalf unless you ask us to or the law requires it.

9. Deletion or return at the end

9.1 While the Main Agreement runs, you can export Customer Personal Data with the product's export features, or ask us for an export in a common machine-readable format.

9.2 When the Main Agreement ends, or when you delete your account, team or workspace, we delete Customer Personal Data from the live systems within 30 days, unless you asked us to return it first. Copies in encrypted backups are deleted as the backups rotate out — daily copies after 14 days, weekly copies after 8 weeks and monthly copies at the latest 12 months later. Until then backups are not used except to restore after an incident, and data restored that way is deleted again.

9.3 We keep data longer only where EU or Member State law requires us to store it (for example accounting records), and then only for that purpose and that period.

10. Demonstrating compliance and audits

10.1 On request we make available the information necessary to demonstrate compliance with Article 28 GDPR — this DPA, the current Annexes, a description of our security measures, and the logs a product keeps of your own team's activity.

10.2 We allow and contribute to audits, including inspections, by you or an independent auditor you mandate who is bound by confidentiality. Unless a supervisory authority requires it or there are concrete indications of a breach, audits take place at most once a year, on 30 days' written notice, during business hours, without access to other customers' data, and at your own cost. We first try to answer the audit questions in writing.

11. Transfers outside the EU/EEA

11.1 We host Customer Personal Data in the European Union. A transfer to a third country takes place only where a sub-processor in Annex 2 needs it and only on the basis of Chapter V GDPR: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified US recipients) or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 3, processor to processor), with supplementary measures where needed.

11.2 Annex 2 shows, for each sub-processor, where the data is processed and on which basis.

12. Additional terms for Hostio (servers with root access)

12.1 Hostio is a control panel. It holds root or sudo SSH access to the servers you connect, so it can technically reach every file on them, including databases, application files and the personal data of your own customers ("End-User Data"). We do not choose or know the categories of End-User Data on your servers.

12.2 Hostio is built to touch as little End-User Data as possible: it stores server inventory and the output of the operations it runs; it does not copy databases or application files to its own systems, except while a site move you start streams them from server to server; it does not store the values of environment files; it masks secrets in operation output before saving it; it reads log files on demand without storing them; and its optional agent sends only metrics (processor, memory, disk, service status).

12.3 You remain responsible for your servers. You decide which servers to connect and which changes to apply. Every change is shown as a preview before it runs and keeps a way to roll back. We are not responsible for the result of a change you or your team approved, for changes made outside Hostio (including by another control panel), for the security of servers you operate, or for backups of your own data. Read-only checks make no changes to your servers.

12.4 Talivio staff act inside your team only through a membership that you can see and remove, and every action they take is recorded in your team's operation log.

12.5 When you remove a server or delete your team, we remove Hostio's SSH key from the connected servers where we can still reach them; you should check that it is gone.

13. Liability, precedence and term

13.1 Each party's liability under this DPA is subject to the limitations agreed in the Main Agreement. Nothing in this DPA limits liability that cannot be limited under Article 82 GDPR or other mandatory law, or liability for intent or gross negligence.

13.2 If this DPA and the Main Agreement conflict on the protection of personal data, this DPA prevails. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.

13.3 This DPA ends when we no longer process Customer Personal Data for you. Sections 9 and 10 survive until the deletion is complete.

14. Changes and governing law

14.1 We may update this DPA where the law, guidance of a supervisory authority or a change in our products requires it. We notify account owners of material changes by e-mail at least 30 days in advance; changes never lower the protection the GDPR requires. The version and date at the top show the text in force.

14.2 This DPA is governed by the laws of Estonia. The courts of Harju County (Harju Maakohus), Tallinn, have jurisdiction, without prejudice to the rights of data subjects and the powers of supervisory authorities under the GDPR.

Annex 1 — Description of the processing

Common to all products: Customer Personal Data is processed to store it, display it to you and your authorised users, transmit it where you ask the product to, back it up, secure it and provide support. Data subjects always include your own authorised users (name, e-mail address, role, sign-in and activity logs, IP addresses). The table adds what is specific to each product.

Duration: as long as you use the product (section 2.2). Frequency: continuous. Retention after the end: section 9.

Annex 2 — Sub-processors

The sub-processors below may process Customer Personal Data. Rows marked Being confirmed are still being verified as part of the legal review of this draft; until then we describe them as precisely as we currently can rather than leave them out.

Services we use as controller (not sub-processors under this DPA)

For transparency: these providers process data about you as our customer — payment, sign-in, website statistics — for which we are the controller (section 1.2). They do not receive the Customer Personal Data you put into a product.

Annex 3 — Technical and organisational measures

We are a small company and hold no security certification. The measures below are the ones actually in place; details are available on request.

Location and infrastructure

• Customer Personal Data is hosted in the European Union: France (Contabo, Lauterbourg) and, for the Hostio control plane, Germany (Linode, Frankfurt).
• Production servers are changed only through version-controlled deployments; configuration files containing secrets are kept outside the web root, and plain-text backups of them are not left on servers (checked weekly).
• The mail server is monitored (queue, disk and blocklist alerts), and its management interface accepts calls only from our application server.

Encryption

• All traffic to our sites, the mail server (IMAP, SMTP) and the AI gateway uses TLS; outgoing mail is DKIM-signed.
• Mailboxes on the mail server are encrypted at rest.
• Credentials that products hold for you are encrypted in the database — for example Hostio's SSH keys, Replio's WhatsApp access tokens and A11yProof's test accounts for scans behind a login.
• Backups are encrypted with AES-256 before they leave our servers; the key is stored separately from the backups.

Availability and recovery

• Nightly encrypted backups of the application servers and the mail server, kept for 14 days (daily), 8 weeks (weekly) and 12 months (monthly).
• An automated restore test runs every week.

Access control

• Sign-in through Talivio Accounts, with two-factor authentication available to every user (authenticator app, or one-time codes by e-mail, SMS or WhatsApp). One-time codes are stored hashed, can be used once and are locked after repeated wrong attempts; signing in with Google or Apple does not skip two-factor authentication.
• Roles inside each product (for example admin and member) decide who in your team can see and change what; data of different customers is separated at application level.
• Access by Talivio staff is limited to the people who need it to operate, support or secure the products, and is bound by confidentiality.

Logging and accountability

• Talivio Accounts records sign-ins and security events (such as two-factor changes and new devices).
• Products keep activity logs of changes made in your team — Hostio records every operation with the person who ran it; Mailio and Growio keep activity logs.

Data minimisation in AI features

• The Talivio AI gateway stores usage metadata (product, model, token counts) but not the content of prompts or answers.
• Our products do not send your customers' names or e-mail addresses to the gateway as identifiers; Growio's term summary receives no name, surname or diagnosis of the child.
• Replio's AI replies and Growio's term summary are optional; you decide whether to switch them on.