Legal

Data Processing Addendum

Last updated and effective:

This Data Processing Addendum (“DPA”) is part of the Terms of Service between VektorForgeAI LLC (“VektorForgeAI”, “we”, “us”) and a business customer (“Customer”, “you”) whenever we process Personal Data on your behalf through our Platforms: currently Product Architect and Program Forgemaster and, when it launches, Systems Alloysmith, together with any Platform we add later. It applies automatically; if you need a countersigned copy, email info@vektorforgeai.com. If this DPA conflicts with the Terms of Service, this DPA controls for the processing of Personal Data. Words such as Services, Platform, Your Content, Security Incident, staff and subprocessor have the meanings in our Terms of Service.

1. Definitions

  • Personal Data: personal information, as defined in our Terms of Service, that you or the people you share with put into the Platforms as part of Your Content. It does not include information that has been aggregated or de-identified so that it can no longer reasonably be linked to anyone.
  • Data Protection Laws: the privacy and data protection laws that apply to the processing of Personal Data, including US state privacy laws such as the Virginia Consumer Data Protection Act and, where applicable, the EU General Data Protection Regulation, the UK GDPR and the Swiss Federal Act on Data Protection.
  • Other terms, such as controller, processor, business, service provider, consumer, sale, sensitive data and data protection assessment, have the meanings given in the Data Protection Laws.

2. Roles

You are the controller (or “business”) of Personal Data, and we are your processor (or “service provider”). We are a separate controller only for the information our Privacy Policy describes as ours, such as account information, billing and usage records, and the messages and Feedback you send us.

3. Details of the processing

  • Subject matter and purpose: providing, securing and supporting the Platforms you use, under the Terms of Service.
  • Nature of the processing: storing and hosting Your Content; showing it to you and the people you share with; processing it with AI features when you or the people you share with use them; sending it to third-party services and external AI assistants you connect; keeping backups; and supporting you at your request.
  • Types of Personal Data: names, email addresses, roles and skills of your team members; names, contact details and customer feedback of your customers and stakeholders; names and email addresses of the people you share with; and any personal information in the documents, comments, files and images you put into the Platforms. The Platforms are not designed for sensitive data (see section 5).
  • People the data is about: your staff and team members, your customers and stakeholders, the people you share with, and anyone else you mention in Your Content.
  • Duration: while you use the Platforms, and up to 30 days afterwards for deletion and for backups to expire (section 9).
  • Location: stored in the United States; some Subprocessors may process it in other countries where they operate (section 11).

4. Our commitments

We will:

  • process Personal Data only to provide, secure and support the Platforms, on your documented instructions (the Terms of Service, this DPA and your use of the Platforms’ features), unless the law requires otherwise, in which case we will tell you unless the law prohibits it;
  • not sell or share Personal Data, not use it for targeted advertising, not combine it with other data except as Data Protection Laws allow, and not use it for any purpose outside our direct business relationship with you;
  • make sure everyone who processes Personal Data, including our staff, is subject to a duty of confidentiality;
  • maintain appropriate technical and organizational security measures, including those described on our Security page, and not materially reduce them;
  • tell you if we believe an instruction from you breaks Data Protection Laws;
  • if a government or other third party demands Personal Data from us, refer it to you where we can, and tell you before we respond unless the law prevents it.

5. Your obligations

You will:

  • have a lawful basis for the Personal Data you put into the Platforms, and give the notices and obtain the consents Data Protection Laws require;
  • not put into the Platforms sensitive data they are not designed for, such as health information, genetic or biometric data, information revealing racial or ethnic origin, religious beliefs, sexual orientation or citizenship or immigration status, precise geolocation, or personal data of children under 13, as our Acceptable Use Policy also says;
  • give us only lawful instructions;
  • respond to requests from people exercising their rights about Personal Data, with our help under section 7;
  • be responsible for the people you share with and for the third-party services and external AI assistants you choose to connect.

6. Subprocessors

You authorize the subprocessors listed on our Subprocessors page. Each subprocessor works under a written contract that requires it to meet the same data protection obligations as this DPA, and we remain responsible for its performance. We will tell you at least 30 days before we add or replace a subprocessor, by updating our Subprocessors page and emailing business customers who have asked to be told. If you object on reasonable data protection grounds, we will work with you in good faith to find a solution; if we can’t, you may end the affected part of the Services and receive a refund of prepaid fees for the unused period. This notice period applies to changes of subprocessors; changes to this DPA itself take effect as described in the Terms of Service.

7. Helping you meet your obligations

Taking into account the nature of the processing, we will help you, to the extent you can’t do it yourself through the Platforms: respond to requests from people exercising their rights; keep Personal Data secure and meet your obligations to notify Security Incidents; and carry out data protection assessments (including data protection impact assessments) and consultations with regulators. If we receive a request directly from a person about Personal Data, we will refer them to you.

8. Security Incidents

If we become aware of a Security Incident affecting Personal Data, we will notify you without undue delay, and in any event within 72 hours after becoming aware of it, with the information you reasonably need to meet your own obligations, and we will take reasonable steps to contain and remedy it.

9. Return and deletion

At your direction, we will return or delete Personal Data. You can return it to yourself at any time by exporting Your Content in the formats each Platform offers. When your account ends, or when you ask us to, we will delete Personal Data within 30 days, unless the law requires us to keep it. Backups expire within 30 days and remain protected by this DPA until then. We will not try to re-identify any de-identified data derived from Personal Data.

10. Compliance information and assessments

  • Information: on reasonable request, we will make available the information in our possession needed to show that we meet this DPA and Data Protection Laws, such as answers to a reasonable security questionnaire.
  • Assessments: we will allow and cooperate with reasonable assessments by you, or by a qualified assessor you designate who is bound by confidentiality, with at least 30 days’ notice, during business hours, at your cost, and without disrupting the Services or other customers. On-site assessments are limited to once a year, unless a Security Incident or a regulator requires another.
  • Independent assessment: alternatively, we may arrange for a qualified and independent assessor to assess our policies and technical and organizational measures using an appropriate and accepted control standard or framework, and we will give you the assessment report on request.

11. Location and international transfers

We store Personal Data in the United States. Some Subprocessors may process it in other countries where they operate, as listed on our Subprocessors page. Where Data Protection Laws require safeguards for Personal Data transferred to us from the European Economic Area, the United Kingdom or Switzerland, the following are part of this DPA, without either party needing to sign anything further:

  • EEA: the Standard Contractual Clauses approved by the European Commission in Decision (EU) 2021/914 (“SCCs”), Module Two (controller to processor) and, where you are yourself a processor, Module Three (processor to processor). The optional docking clause (Clause 7) applies; under Clause 9, option 2 (general written authorization) applies, with the 30-day notice period in section 6 of this DPA; the optional language in Clause 11 does not apply; and Clauses 17 and 18 are governed by Irish law and the courts of Ireland.
  • United Kingdom: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
  • Switzerland: the SCCs, read so that references to the GDPR mean the Swiss Federal Act on Data Protection and the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

The information the SCCs’ annexes require is in section 3 of this DPA (the processing), our Privacy Policy and this DPA (the parties), our Subprocessors page and our Security page (our security measures). If the SCCs conflict with this DPA, the SCCs control. We have transfer safeguards in our contracts with our subprocessors where the law requires them.

12. Liability and term

Each party’s liability under this DPA is subject to the limitations in the Terms of Service. This DPA lasts as long as we process Personal Data on your behalf.

Contact

VektorForgeAI LLC, 8401 Mayland Dr, Ste 1121, Richmond, Virginia 23294, United States

Email: info@vektorforgeai.com