Data Processing Agreement

Version 2026-06-01. This DPA forms part of the Terms of Service and governs Vouli IQ’s processing of personal data on your behalf.

1. Roles

You are the controller; Vouli IQ Technologies Private Limited (operating as Vouli IQ) is the processor. Each party complies with the GDPR, the UK GDPR and other applicable data-protection law. Vouli IQ processes personal data only on your documented instructions, which include using the platform’s features as configured by you.

2. Scope & duration

Processing covers the subject-matter, nature, purpose, data subjects and categories of personal data set out in the in-product Record of Processing Activities. Processing lasts for the term of your subscription, after which data is returned or deleted per Section 8.

3. Confidentiality

Personnel authorised to process personal data are bound by confidentiality obligations.

4. Security

Vouli IQ implements appropriate technical and organisational measures, including tenant isolation via row-level security, encryption in transit and at rest, least-privilege access, audit logging and a tamper-evident hash-chained audit trail.

5. Sub-processors

You authorise the sub-processors listed in the in-product Sub-processor Register. Vouli IQ imposes data-protection terms on each sub-processor no less protective than this DPA and remains liable for their performance. You will be notified before a new sub-processor is engaged and may object on reasonable data-protection grounds.

6. International transfers

Where personal data is transferred outside the EEA or UK, the transfer is governed by the EU Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, incorporated by reference, supported by a transfer-impact assessment.

7. Data-subject requests & assistance

Taking into account the nature of processing, Vouli IQ assists you in responding to data-subject requests and in meeting your obligations under Articles 32–36, including breach notification without undue delay and not later than 72 hours after becoming aware of a personal-data breach.

8. Return & deletion

On termination, you may export all org-scoped data in a machine-readable format. Erasure schedules deletion 30 days out and cascades across all org-scoped records, unless retention is required by law.

9. Audit

Vouli IQ makes available information necessary to demonstrate compliance and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable confidentiality and frequency limits.

Contact

privacy@vouliiq.com