1
About This Addendum
This Data Processing Addendum ("Addendum") applies when a business customer ("Customer", "you") uses Vestra services to process personal data on its behalf. It forms part of the Vestra Terms of Service ("Terms") whenever you use our services as a business customer. No signature is needed.
If this Addendum conflicts with the Terms on the processing of Customer Personal Data, this Addendum takes precedence.
In this Addendum:
- "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR (Regulation (EU) 2016/679).
- "Customer Personal Data" means personal data that Vestra processes on your behalf when providing the services.
- Terms such as "controller", "processor", "personal data", "personal data breach" and "data subject" have the meanings given in Data Protection Law.
2. Roles of the Parties
For Customer Personal Data, you are the controller (or a processor acting for your own controller) and Vestra is your processor. Vestra is a controller for the account, billing and usage data it collects about you and your staff to run your account, as described in our Privacy Policy.
3. Details of the Processing
- Subject matter: providing the Vestra services you use, such as hosting, Vestra Drive storage, AI services and APIs, together with related support.
- Duration: for as long as you use the services, and afterwards until Customer Personal Data is deleted or returned under section 11.
- Nature: storage, hosting, transmission, retrieval, computation and other operations needed to provide, secure and support the services.
- Purpose: to provide the services under the Terms, follow your documented instructions, provide support, and keep the services secure.
4. Categories of Data and Data Subjects
You decide what personal data you upload to or process with the services. Depending on how you use them, this may include:
- Data subjects: your end users, customers, website visitors, employees, contractors and contacts.
- Personal data: names and contact details, account and profile data, files and other content, prompts and outputs sent to our AI services, and technical data such as IP addresses and logs generated by your services.
You should not use the services to process special category data or criminal offence data unless you have a lawful basis and appropriate safeguards in place.
5. Documented Instructions
Vestra processes Customer Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you before processing unless the law prohibits this. Your instructions are the Terms, this Addendum, and how you configure and use the services. We will tell you if we believe an instruction infringes Data Protection Law.
6. Confidentiality
We make sure that anyone authorised to process Customer Personal Data is bound by an appropriate duty of confidentiality, and only has access where they need it to provide or support the services.
7. Security
We take appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR and EU GDPR. These include:
- Encryption of data in transit to our websites and services (HTTPS/TLS)
- Passwords stored only as salted hashes
- Access controls that limit access to authorised personnel
- Network protection, including DDoS mitigation
- Logging and monitoring to detect and investigate security issues
We review these measures as our services change. We will not reduce the overall level of protection for Customer Personal Data.
8. Sub-Processors
You give general authorisation for Vestra to use sub-processors. Our current sub-processors are listed on our Sub-Processors page.
- We will notify you by email and/or Discord before adding or replacing a sub-processor, giving you a reasonable opportunity to object.
- You may object on reasonable data protection grounds by emailing [email protected] before the change takes effect. We will work with you in good faith to resolve the objection. If we cannot, you may stop using and cancel the affected services.
- Before a sub-processor handles Customer Personal Data, we will put written data protection obligations in place that are no less protective than the relevant obligations in this Addendum, and we remain responsible to you for that sub-processor's performance of those obligations.
9. Assistance
- Data subject requests: taking into account the nature of the processing, we help you, through appropriate technical and organisational measures where possible, to respond to requests from data subjects exercising their rights. If we receive a request directly that relates to Customer Personal Data, we will pass it to you and will not respond to it ourselves unless you ask us to or the law requires it.
- Other obligations: taking into account the nature of the processing and the information available to us, we help you meet your obligations on security, personal data breach notification, data protection impact assessments and prior consultation with supervisory authorities.
10. Personal Data Breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Our notice will include the information reasonably available to us to help you meet your own notification obligations, such as the nature of the breach, the categories and approximate number of data subjects and records affected, its likely consequences, and the measures taken or proposed. Where not all of this is available at once, we will provide it in phases as it becomes available.
11. Deletion or Return of Data
When you stop using the services, we will, at your choice, delete or return Customer Personal Data, and delete existing copies, unless the law requires us to keep it. You can download your data before cancelling, or contact [email protected] to ask for its return.
12. Audits and Information
We will make available to you the information reasonably necessary to demonstrate our compliance with Article 28 of the UK GDPR and EU GDPR. We will allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint, subject to reasonable advance notice, reasonable confidentiality obligations, and measures to protect other customers' data and the security of our services.
13. International Transfers
Vestra will not transfer Customer Personal Data outside the UK or the EEA to a destination without applicable adequacy regulations or a valid transfer mechanism. Depending on the destination, that mechanism may be the EU standard contractual clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU SCCs. The mechanism for a particular transfer must be identified in the applicable order, provider record, or separately executed terms; this Addendum does not claim that any particular safeguard is already in place. Contact [email protected] for the mechanism used for a particular transfer.
14. Your Responsibilities
You are responsible for having a lawful basis for the processing you instruct us to carry out, for giving any required notices to data subjects, and for making sure your instructions comply with Data Protection Law.
15. Liability
Each party's liability under or in connection with this Addendum is subject to the limitations and exclusions of liability in the Terms of Service, except where the law does not allow liability to be limited.
16. Term and Changes
This Addendum applies for as long as Vestra processes Customer Personal Data on your behalf. We may update it to reflect changes in law or in our services. Material changes are announced by email and/or Discord, in the same way as changes to our Terms.
17. Contact
Questions about this Addendum, sub-processor objections and data protection requests can be sent to Vestra at [email protected] or by phone on 07488 375664.