Vemploy

Data processing agreement

Agreement under Article 28 of Regulation (EU) 2016/679 ("GDPR") between the customer that uses Vemploy for its business ("Controller") and Velion S.r.l., Via del Coroneo 19, 34133 Trieste (TS), Italia, tax and VAT number 01421440320 ("Processor"). It is part of the terms of service and applies to company accounts and to anyone using Vemploy for their trade or profession. Version of 2 November 2026. Draft, to be reviewed before public launch. The Italian version prevails.

1. Subject

The Processor processes on behalf of the Controller only the personal data needed to provide the Vemploy service, described in section 2, on the Controller's documented instructions: the terms of service, this agreement and the Controller's use of the service's settings.

2. The processing

  • Nature and purpose: forwarding the Vemploy app's requests to the AI model provider and returning the answer to the computer that sent them; recording usage per person and computer, applying spend limits, invoicing usage; keeping, to give support, the reports a person of the Controller chooses to send to support and the app's error reports.
  • Data: the personal data that requests to the model may contain (texts, data read from the screen or from the documents the Controller gives Vemploy); for the people of the account, email address, role, linked computers and usage data; the descriptions, screenshots and technical details a person of the Controller chooses to send to support, after seeing their preview; the app's error reports, technical only (the error's type, message and places, the version, channel, Windows version and time).
  • Data subjects: the people the Controller adds to its account; the people whose data appear in requests to the model (for instance the Controller's customers, suppliers and employees).
  • Retention: requests to the model are not kept by the Processor, which forwards them and returns their answer. Account and usage data are kept while the account exists. Reports to support and error reports are kept 90 days from the last one sent, deleted earlier with the account, read only by support staff and used only for support.
  • What stays with the Controller: chats, documents, knowledge, procedures, credentials and screenshots stay on the Controller's computers and are not processed by the Processor, except what a person of the Controller chooses to send to support.

3. The Processor's obligations

The Processor:

  • processes the data only on the Controller's documented instructions, including for transfers to third countries, unless the law requires otherwise, in which case it informs the Controller before processing where the law allows;
  • ensures that the people authorised to process the data are bound to confidentiality;
  • takes the security measures of section 5;
  • assists the Controller, by appropriate technical and organisational measures, in responding to data subjects' requests: from the Account page the Controller can export data, remove people and delete the account;
  • assists the Controller with the obligations of Articles 32–36 GDPR, taking into account the nature of the processing and the information available;
  • notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach affecting it, with the information needed for any notifications;
  • makes available to the Controller the information needed to demonstrate compliance with this agreement and allows audits, with reasonable notice, during business hours and without compromising the confidentiality of other customers and the security of the service.

4. Sub-processors

The Controller gives general authorisation for the following sub-processors:

  • Microsoft Ireland Operations Ltd (Azure: the service's infrastructure and Azure OpenAI models, in the European Union);
  • the email provider through which the service's messages are sent.

If the Controller turns on web search, searches are run by Microsoft Bing, which Microsoft does not cover with its data processing agreement: the Controller decides whether to turn it on. Stripe processes payment data as an independent controller. The Processor imposes on sub-processors obligations equivalent to those of this agreement and informs the Controller at least 30 days in advance of adding or replacing a sub-processor; the Controller may object on reasonable grounds and, if the disagreement remains, terminate the contract.

5. Security

The Processor takes measures appropriate to the risk, including: encryption of communications in transit; no retention of requests to the model; access to systems on the principle of least privilege, with strong authentication for critical systems; separation of environments; timely updating of systems; backups and restore procedures; recording and handling of incidents. The Processor is adopting an information security management system that complies with ISO/IEC 27001.

6. Transfers

Data are processed in the European Union. A transfer outside the European Economic Area takes place only with the safeguards of Chapter V GDPR.

7. End of processing

When the service ends or the account is deleted, the Processor deletes the personal data processed on the Controller's behalf, except those the law requires it to keep (for instance invoicing data). Before deletion the Controller can export them from the Account page.

8. Liability and precedence

Liability is governed by the terms of service, within the limits allowed by Article 82 GDPR. Where this agreement and the terms of service conflict, this agreement prevails on the processing of personal data.