GDPR

At viggoVet, data privacy is part of how we build, not a checkbox. We collect only what is needed, process it transparently, and give you control. We apply GDPR-level standards across our platform globally, not only for customers in the European Economic Area.

1. What the GDPR is

The General Data Protection Regulation (GDPR) is the European Union privacy law in force since May 25, 2018. It gives individuals strong rights over their personal data and sets strict rules on how organisations collect, store, and use it. It applies to any organisation that processes the personal data of people in the EEA, wherever the organisation is based. The UK GDPR and the Swiss Federal Act on Data Protection (FADP) provide equivalent regimes, which we also follow.

2. Who we are and our roles

viggoVet is operated by a group of companies. The entity responsible for your data depends on your region and is identified in our Legal Entities document. We act in two roles: as a controller for data we decide how to use (such as website, account, and billing data), and as a processor for the data our customers put into the platform about their patients, clients, and staff. Our Privacy Policy explains both roles in full.

3. What personal data is

Personal data is any information relating to an identified or identifiable individual, for example a name, email or postal address, phone number, IP address or device identifier, and financial details. Special categories of data (such as health or biometric data) receive extra protection. In a veterinary context, clinical records primarily concern animals, but associated owner and staff information is personal data and is protected accordingly.

4. How we meet our GDPR obligations

• Privacy by design and by default: privacy is built into new features, with data minimisation, granular permissions, audit trails, and retention controls.
• Governance: a Data Protection Officer is in place, supported by trained staff and privacy leads across teams.
• Records and assessments: we maintain records of processing and run Data Protection Impact Assessments for higher-risk processing.
• Vendor and subprocessor diligence: subprocessors are assessed and bound by data-protection terms; we keep a current list available to customers.
• Security: encryption in transit and at rest, role-based least-privilege access, strong authentication, logging, and monitoring.
• Data residency: customer data is stored in encrypted databases mapped to the customer’s region.
• Retention and cleanup: data is kept only as long as needed, then securely deleted or anonymised.
• Breach notification: we notify affected customers without undue delay and support regulator notification within 72 hours where required.
• Audits: we review our systems, processes, and security regularly and remediate findings.

5. Our core data commitments

• No AI training on your data: we never use personal data or customer Service Data to train, fine-tune, or develop AI models, our own or third parties’.
• Anonymised analytics only: any internal analysis uses only anonymised, aggregated technical and operational data (such as usage, load, storage size, latency, and errors).
• No sale or sharing: we do not sell personal data and do not share it except to provide the service or as you instruct.
• You own your data: customers own and control their Service Data, with export and deletion available.

6. International data transfers

Where personal data is transferred across borders, we rely on appropriate safeguards, including the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and Swiss FADP amendments, together with the regional data-residency measures above. Customers can request copies of the relevant safeguards.

7. Your rights

If you are in the EEA, UK, or Switzerland you have rights to access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent and to complain to your supervisory authority. Equivalent rights for other regions (including the United States, UAE, Saudi Arabia, Australia, and Canada) are described in our Privacy Policy. To exercise any right, contact the contact form at viggo.vet/legal/contact.

8. Data Processing Agreement

Business customers who need a signed Data Processing Agreement can use our DPA, which incorporates the EU Standard Contractual Clauses and sets out our processing, security, subprocessing, transfer, and breach-notification commitments. Request a signed copy at the contact form at viggo.vet/legal/contact.

9. Contact

For GDPR questions or to reach our Data Protection Officer, contact the contact form at viggo.vet/legal/contact. The entity responsible for your region is identified in the Legal Entities document.

This page is a statement of our practices and commitments. It does not by itself create contractual obligations beyond those in the agreements that reference it.