Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between the customer identified in the Agreement (“Customer”) and the viggoVet group entity that contracts with the Customer for the relevant region, as identified in our Legal Entities document (“viggoVet”). Each is a “Party”. This DPA supplements and forms part of the agreement governing the Customer’s use of viggoVet’s products and services (the “Agreement”), including our Terms of Service and Privacy Policy. On matters of data protection this DPA prevails over conflicting terms of the Agreement, and any prior data-protection agreement between the Parties is superseded.

1. Definitions

“Data Protection Laws” means all laws applicable to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act as amended (CCPA/CPRA), and other applicable privacy laws. “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, and “Personal Data Breach” have the meanings given in the GDPR. “Service Data” means Personal Data that viggoVet processes on behalf of the Customer through the services. “Subprocessor” means a third party engaged by viggoVet to process Service Data. “Standard Contractual Clauses” or “SCCs” means the clauses approved under EU Commission Decision 2021/914. “Third-Party Module” means an application or module built by an independent developer and enabled by the Customer through viggoVet’s SDK, API, MCP, or marketplace.

2. Roles and scope

• Roles. For Service Data, the Customer is the Controller (or a Processor acting for its own customers) and viggoVet is the Processor (or Subprocessor). For an Individual/Professional workspace, the account holder is the Controller of the workspace data. For the pet-owner app, the clinic is the Controller of clinical and client records.
• Scope. This DPA applies to all Service Data processed by viggoVet in providing the services, as described in Exhibit A.
• Instructions. viggoVet processes Service Data only on the Customer’s documented instructions, including as set out in the Agreement and as needed to provide the services, unless required by law (in which case viggoVet will inform the Customer unless the law prohibits it).
• Customer responsibility. The Customer is responsible for the lawfulness of its instructions, for having a lawful basis and any required consents, and for the accuracy of Service Data it provides.

3. Processing commitments

• Purpose limitation. viggoVet will not use, sell, share, or retain Service Data for any purpose other than providing the services and as instructed, and will not combine it with other data except to provide the services.
• No AI training. viggoVet will not use Service Data to train, fine-tune, or develop any AI or machine-learning model. Any analytics performed by viggoVet use only anonymised, aggregated technical and operational data that does not identify any Data Subject.
• Confidentiality. personnel authorised to process Service Data are bound by confidentiality obligations.
• Assistance. taking into account the nature of processing, viggoVet will assist the Customer with Data Subject requests, with security, breach notification, and with Data Protection Impact Assessments and prior consultations, as required by Data Protection Laws.
• Unlawful instructions. viggoVet will notify the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Laws, or if it can no longer meet its obligations.

4. Security measures

viggoVet will implement and maintain appropriate technical and organisational measures to protect Service Data against unauthorised or unlawful processing and accidental loss, destruction, or damage, taking into account the state of the art and the risk. These measures are described in Exhibit B and include encryption in transit and at rest, role-based least-privilege access, logging, monitoring, and region-based data residency.

5. Personal Data Breach

viggoVet will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Service Data, provide information reasonably available to it, and take reasonable steps to mitigate and remediate. viggoVet will assist the Customer in meeting its own notification obligations, including any 72-hour regulator-notification deadline. Notification of a breach is not an acknowledgement of fault.

6. Subprocessors

• General authorisation. the Customer authorises viggoVet to engage Subprocessors to provide the services. A current list is available to the Customer on request or through the platform.
• Flow-down and liability. viggoVet imposes data-protection obligations on each Subprocessor that are no less protective than this DPA, and remains responsible for its Subprocessors’ performance.
• Changes and objection. viggoVet will give the Customer prior notice of any new Subprocessor. The Customer may object on reasonable data-protection grounds within 14 days; if the Parties cannot resolve the objection, the Customer may terminate the affected service.
• Third-Party Modules are not Subprocessors. where the Customer enables a Third-Party Module, the developer is an independent Controller or the Customer’s own Processor, engaged directly by the Customer, and is not a viggoVet Subprocessor. viggoVet is not responsible or liable for that developer’s processing. The Customer is responsible for the data it instructs viggoVet to share with the Module and for its own arrangements with the developer.

7. International data transfers

• Safeguards. where viggoVet or a Subprocessor processes Service Data outside the EEA, UK, or Switzerland without an adequacy decision, the transfer is governed by the SCCs and equivalent safeguards, alongside the region-based data-residency measures.
• EU SCCs. the SCCs are incorporated by reference and apply as follows: Module Two (Controller to Processor) or Module Three (Processor to Subprocessor), as applicable; the optional docking clause applies; the governing law and the courts for the SCCs are those of Estonia; and the competent supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), consistent with viggoVet’s EU establishment (Viggo Software OÜ). Annex details are in Exhibit A.
• UK and Switzerland. for UK transfers, the UK International Data Transfer Addendum applies to the SCCs. For transfers subject to the FADP, the SCCs are read with the Swiss amendments (including reference to the Swiss Federal Data Protection and Information Commissioner and, where relevant, protection for legal entities).

8. Audit

viggoVet will make available information necessary to demonstrate compliance with this DPA. The Customer may, once per year, request such documentation. Where reasonably necessary and not addressed by available reports, the Customer may request an on-site audit on at least 21 days’ written notice, subject to agreement on scope, timing, confidentiality, and cost. Audits must not unreasonably disrupt viggoVet’s operations and are at the Customer’s expense.

9. Return or deletion of Service Data

On termination of the Agreement, and on the Customer’s written request, viggoVet will return or delete Service Data within the period stated in the Agreement, and delete existing copies, except where retention is required by law or for the period of backup cycles, after which it is securely deleted or anonymised.

10. Liability

Each Party’s liability under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Agreement. Nothing in this DPA limits liability that cannot be limited under applicable law, and the SCCs’ own liability provisions govern claims by Data Subjects under the SCCs.

11. Governing law, term, and changes

Except for the SCCs (which are governed as stated in Section 8), this DPA is governed by the law and dispute-resolution regime of the Agreement. This DPA takes effect when the Agreement is entered into and continues for as long as viggoVet processes Service Data, with provisions surviving termination as needed. viggoVet may update this DPA to reflect changes in Data Protection Laws or its services, on notice, provided the changes do not materially reduce the protection of Service Data.

Exhibit A, SCC Annex I

A. List of parties

Data exporter: the Customer identified in the Agreement, acting as Controller (or Processor) of the Service Data. Contact, address, and role as set out in the Agreement.

Data importer: the viggoVet entity identified in the Legal Entities document for the Customer’s region, acting as Processor (or Subprocessor). For EEA, UK, and rest-of-world customers this is Viggo Software OÜ (Estonia). Contact: the contact form at viggo.vet/legal/contact.

B. Description of transfer

C. Competent supervisory authority

The Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), consistent with viggoVet’s EU establishment. For UK and Swiss transfers, the Information Commissioner’s Office and the Swiss Federal Data Protection and Information Commissioner apply respectively.

Exhibit B, Technical and organisational security measures

• Security programme: documented information-security policies, reviewed regularly.
• Encryption: Service Data encrypted in transit and at rest.
• Access control: role-based, least-privilege access; managed authorisation; strong authentication for administrative access.
• Data residency: Service Data stored in encrypted databases mapped to the customer’s region.
• Network security: firewalls, intrusion prevention, and segregation of environments.
• Malware protection: anti-malware controls on relevant systems.
• Logging and monitoring: access logging, audit trails, and monitoring with incident detection.
• Physical security: hosting facilities with controlled access and environmental controls (provided by infrastructure subprocessors).
• Personnel: confidentiality obligations and ongoing security training; equivalent standards required of subprocessors.
• Resilience: backup, disaster-recovery, and business-continuity measures, periodically tested.

Exhibit C, Subprocessors

viggoVet uses vetted subprocessors to provide the services, primarily for cloud hosting and infrastructure, and for supporting operational functions. Because the specific providers may change, the current authoritative list, with the data processed and locations, is made available to the Customer on request or through the platform, and changes are notified as set out in Section 7. Third-Party Modules enabled by the Customer are not viggoVet subprocessors.