Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the agreement between you (the "Business customer", acting as data controller, "Controller") and [COMPANY LEGAL NAME], registration number [ORGANISATION NUMBER], registered address [REGISTERED ADDRESS, COUNTRY] ("Vilura", acting as data processor, "Processor"), whenever Vilura processes personal data on your behalf as part of the Service described in our Terms of Service. It reflects Article 28 GDPR and applies equally, with the necessary changes, under UK GDPR.
1. Subject matter and duration
Vilura processes personal data on the Controller's behalf for as long as the Controller has an active Vilura account, and for a limited period afterward strictly as needed to comply with Section 13 (deletion) and any legal retention obligation.
2. Nature and purpose of processing
Vilura processes personal data to provide the Service: operating an AI assistant that responds to the Controller's own customers and contacts (via text, voice, or an AI receptionist), storing and organizing CRM data the Controller enters, and any other feature of the Service the Controller actively uses that involves personal data about the Controller's own customers, contacts, or employees.
3. Categories of data subjects and data
| Data subjects | Typical personal data |
|---|---|
| The Controller's own customers/contacts | Name, phone number, email, address, conversation/call content, notes the Controller records about them |
| Callers to an AI receptionist configured by the Controller | Voice content (transcribed, not retained as audio by Vilura — see Privacy Policy Section 3.3), phone number, call outcome |
| The Controller's own employees/users added to the account | Name, email, login activity |
| End customers of a website the Controller has us build, where a domain is registered on their behalf | Registrant name, address, and contact details submitted to the domain registry — see Section 7 |
We don't expect this processing to typically involve special categories of data (GDPR Art. 9) — the Controller is responsible for not entering such data into the Service unless they have their own valid legal basis and have confirmed appropriate safeguards with us in writing first.
4. Controller's instructions
Vilura will only process personal data on the Controller's documented instructions — which include the ordinary operation of the Service as configured by the Controller — unless required to do otherwise by EU, UK, or member state law, in which case Vilura will inform the Controller of that legal requirement first, unless the law prohibits this. The Controller is responsible for ensuring it has a valid legal basis for the personal data it puts into the Service.
5. Processor's obligations
- Vilura will ensure personnel authorized to process the data are bound by confidentiality.
- Vilura will implement appropriate technical and organizational measures (Section 9).
- Vilura will not engage a sub-processor without the authorization described in Section 6.
- Vilura will assist the Controller with data subject requests and its own compliance obligations (Sections 10–12).
- Vilura will notify the Controller of a personal data breach without undue delay (Section 11).
- Vilura will return or delete data on termination, per Section 13.
6. Sub-processors
The Controller provides general authorization for Vilura to engage the sub-processors listed below, and any future sub-processor Vilura adds after giving the Controller reasonable advance notice (at minimum, updating this page and its effective date) and an opportunity to object on reasonable data-protection grounds.
| Sub-processor | Role | Location |
|---|---|---|
| Anthropic | AI language model (understanding and generating replies) | United States |
| Groq | Speech-to-text transcription | United States |
| Cartesia | Text-to-speech | United States |
| Google Cloud | Text-to-speech (fallback); place/business lookups | United States / global |
| Stripe | Payment processing | United States / Ireland |
| Fly.io | Application hosting | Stockholm, Sweden |
| Tigris | Encrypted backup storage | Distributed / via Fly.io |
| ipwho.is | IP-based location lookup (fallback only) | EU |
| 46elks (only if the Controller connects this) | SMS delivery for the AI receptionist feature | Sweden |
| Openprovider (planned, not yet active) | Domain registration — see Section 7 | Netherlands |
This list is the same, single source of truth as our Privacy Policy's sub-processor tables — kept in sync, not maintained twice.
7. Domain registration and WHOIS — special notice
This section exists because of a specific, deliberate decision, not boilerplate. If the Controller purchases a website through Vilura that includes registering a domain name, that domain is registered through Openprovider, our registrar. Domain registration requires submitting the registrant's name, address, and contact details to the relevant domain registry, which by default publishes them in the public WHOIS record — visible to anyone who looks up the domain — unless WHOIS privacy protection is available and applied for that specific domain extension.
Who is the controller for the WHOIS entry: the Controller (as the registrant) is the data controller for their own WHOIS data; Vilura acts as the intermediary that submits it to the registrar on the Controller's instruction, in a processor-like capacity for this specific step.
What we commit to: before any purchase that includes domain registration, the Controller will be told explicitly, before payment, that their (or their designated registrant's) details will be published in this way — never disclosed only after the fact. We will offer WHOIS privacy protection by default wherever Openprovider supports it for the chosen domain extension; where it isn't available for that extension, this pre-purchase notice is the safeguard instead.
This feature is not yet live (see Section 6) — this clause is included now so the commitment is in place before it launches, not added as an afterthought once it does.
8. International transfers
Where a sub-processor listed in Section 6 is located outside the EEA/UK, Vilura relies on that provider's Standard Contractual Clauses or an equivalent recognized transfer mechanism. [LAWYER REVIEW — see the closing note in Section 13: each sub-processor's actual, current transfer mechanism should be confirmed and cited specifically.]
9. Security measures
Summarized here; full detail in our Privacy Policy, Section 13: encryption in transit (TLS) and at rest for sensitive credentials, hashed passwords, per-customer data isolation, and access limited to what operating the Service requires.
10. Assisting with data subject requests
If one of the Controller's own customers contacts Vilura directly to exercise a data subject right (access, deletion, etc.) about data the Controller controls, Vilura will promptly forward the request to the Controller and provide reasonable technical assistance to fulfil it — recognizing that the Controller, not Vilura, is generally best placed to respond, since it's their relationship with that individual.
11. Personal data breach notification
Vilura will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available at the time, so the Controller can meet its own 72-hour notification obligation to its supervisory authority where applicable.
12. Audit rights
On reasonable written request, no more than once per year (or more often if required following a confirmed breach), Vilura will provide the Controller with information reasonably necessary to demonstrate compliance with this DPA, and will allow for, and contribute to, audits including inspections conducted by the Controller or an auditor mandated by the Controller, subject to reasonable confidentiality and scheduling terms to be agreed in good faith.
13. Return and deletion on termination
On termination of the underlying agreement, at the Controller's choice, Vilura will delete or return all personal data processed on the Controller's behalf, subject to the same honest limitation described in our Privacy Policy, Section 12: live systems are cleared immediately; encrypted disaster-recovery backups age out on a rolling 30-day window rather than being purged instantly. This DPA does not promise a technical capability that does not exist — see that section for the full explanation.
14. Signatures
No electronic signature flow exists yet for this document — until one is built, please countersign by replying to kontakt@vilura.se with your company details below, or by returning a signed copy through whatever channel we agree on.