Data Processing Agreement

Last updated: November 4, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service (or another written agreement for Visivo Cloud) between Visivo LLC, 66 Prescott Drive, Hudson, Ohio 44236, United States ("Visivo"), and the customer that agreed to those terms ("Customer"). It applies when Visivo processes Customer Personal Data on behalf of Customer in providing Visivo Cloud.

1. Definitions

• Data Protection Laws means all laws on the processing of personal data that apply to the processing under this DPA, which can include the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law ("UK GDPR"), the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended ("CCPA").
• Customer Personal Data means personal data within the Customer Data (as defined in the Terms) that Visivo processes on behalf of Customer.
• Sub-processor means a third party that Visivo engages to process Customer Personal Data.
• Security Incident means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

"Controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR.

2. Roles of the parties

For Customer Personal Data, Customer is the controller (or a processor acting for its own controller) and Visivo is the processor (or sub-processor). Visivo is an independent controller for the personal data it uses to run its business, such as account, billing and website usage data, as described in the Privacy Policy. This DPA does not apply to that data.

3. Processing on instructions

Visivo processes Customer Personal Data only on Customer's documented instructions, unless a law to which Visivo is subject requires otherwise. In that case Visivo will tell Customer before it processes the data, unless that law forbids it. The Terms, this DPA and Customer's use and configuration of Visivo Cloud are Customer's complete instructions. Visivo will tell Customer if, in its opinion, an instruction breaks Data Protection Laws. Annex I gives the details of the processing.

4. Confidentiality

Visivo makes sure that each person it authorizes to process Customer Personal Data is bound by an obligation of confidentiality.

5. Security

Visivo implements and maintains the technical and organizational measures in Annex II, which are designed to protect Customer Personal Data against Security Incidents, as required by Article 32 of the GDPR. Visivo may update these measures, but it will not reduce the overall level of protection. Visivo does not currently hold third-party security certifications.

6. Sub-processors

Customer gives Visivo general written authorization to engage Sub-processors. The current Sub-processors are listed in Annex III. Visivo will:

• impose on each Sub-processor, by written contract, data protection obligations that give at least the same level of protection as this DPA;
• stay responsible to Customer for each Sub-processor's performance of those obligations;
• update Annex III and give Customer notice at least 30 days before a new Sub-processor starts to process Customer Personal Data.

Customer can object to a new Sub-processor on reasonable data protection grounds by writing to info@visivo.io within that notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may end the affected part of Visivo Cloud and get a pro-rata refund of prepaid fees for it.

7. Data subject requests

Taking into account the nature of the processing, Visivo will help Customer, by appropriate technical and organizational measures, to respond to requests from data subjects to exercise their rights under Data Protection Laws. If Visivo receives such a request directly, it will send it to Customer and will not respond itself, except to tell the data subject to contact Customer.

8. Security Incidents

Visivo will notify Customer without undue delay, and where feasible within 72 hours, after it becomes aware of a Security Incident. The notice will describe the incident, its likely consequences and the measures taken or proposed, as far as that information is known. Visivo will take reasonable steps to contain and remediate the incident and will give Customer reasonable help to meet its own notification obligations.

9. Assistance

Taking into account the nature of the processing and the information available to it, Visivo will give Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities under Articles 35 and 36 of the GDPR.

10. Deletion and return

When Visivo Cloud ends, Visivo will delete Customer Personal Data, unless a law requires Visivo to keep it. Before that, Customer can export its project configuration and data with the export features of Visivo Cloud. Data in backups is deleted when the backups expire in the normal backup cycle.

11. Audits

Visivo will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, for example by answering a reasonable security questionnaire once a year. If that information is not enough to satisfy an obligation under Data Protection Laws, Customer may audit Visivo, at Customer's cost, with at least 30 days' written notice, during business hours, no more than once a year and subject to reasonable confidentiality terms.

12. International transfers

Visivo stores and processes Customer Personal Data in the United States. Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country that does not have an adequacy decision, the parties agree that:

• the SCCs, Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, are incorporated into this DPA, with Customer as data exporter and Visivo as data importer. Clause 7 (docking clause) applies. In Clause 9, Option 2 (general written authorization) applies with the notice period in section 6. The optional language in Clause 11 does not apply. In Clauses 17 and 18, the governing law and courts are those of Ireland. Annexes I to III of this DPA complete the annexes of the SCCs;
• for transfers from the United Kingdom, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner applies;
• for transfers from Switzerland, the SCCs apply with the changes needed for the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

If the SCCs conflict with this DPA, the SCCs control.

13. CCPA

Where the CCPA applies, Visivo acts as Customer's service provider. Visivo will not sell or share Customer Personal Data, will not retain, use or disclose it for any purpose other than providing Visivo Cloud, and will not combine it with personal data it receives from other sources, except as the CCPA permits.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitations of liability in the Terms. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA controls.

Annex I: Details of processing

• Data exporter: Customer, as identified in its Visivo Cloud account. Role: controller or processor.
• Data importer: Visivo LLC, 66 Prescott Drive, Hudson, Ohio 44236, United States. Contact: info@visivo.io. Role: processor.
• Subject matter and purpose: providing Visivo Cloud: storing and running Customer's projects, querying Customer's data sources on Customer's instruction, storing and showing query results and dashboards, running the AI agent, and supporting Customer.
• Nature of processing: collection, storage, retrieval, querying, transformation, transmission and deletion.
• Duration and frequency: continuous, for the term of the Terms and until deletion under section 10.
• Categories of data subjects: Customer's members and users of Visivo Cloud, and any individuals whose personal data is in the data sources that Customer connects.
• Categories of personal data: member names, email addresses and activity in Visivo Cloud; any personal data in Customer's project configuration, query results, uploaded files and agent conversations, as Customer decides.
• Special categories: none are intended. Customer must not use Visivo Cloud to process special categories of personal data unless it has a lawful basis and appropriate safeguards.

Annex II: Technical and organizational measures

• Encryption in transit: Visivo Cloud is served over HTTPS, and the application redirects HTTP requests to HTTPS.
• Encryption at rest: Customer Data is stored on Google Cloud Platform, which encrypts data at rest by default.
• Source credentials: stored as write-only secrets in Google Cloud Secret Manager, never in the application database. The API does not return a secret value after it is saved. Values are injected only into the job that runs the project, and are masked out of that job's logs.
• Isolation: each Customer's data is scoped to its account, and project runs execute as separate jobs.
• Access control: Workspace roles control what each member can do. Access to production systems is limited to authorized Visivo personnel.
• Availability: the production database runs in a high-availability configuration with a replica in a second region.
• Monitoring: application errors and logs are collected for monitoring and incident response.

Annex III: Sub-processors

Contact

Questions about this DPA: info@visivo.io.