Data processing addendum

You are the controller of the personal data in your workspace. [Legal entity name], registered at [registered address], is the processor. This addendum forms part of the terms of service and applies whenever we process personal data on your behalf.

Where we process data about your staff for our own purposes, such as billing or support, we act as a controller and the privacy notice applies instead.

Only what is needed to run VeoCue for you: your users’ names and work email addresses, the competitors you choose to track, the public page content we collect about them, the signals derived from it, and the questions your team asks. Some of that public content mentions named people, typically executives in a press release or a job posting.

We process it to provide the service, to support you and to keep the system secure. We act only on your instructions, and using the product is an instruction. We do not use your workspace content to train models of our own.

VeoCue staff sign in through a separate Amazon Cognito user pool from customers, and access to customer data is limited to the people who need it to operate or support the service. Staff are under a duty of confidentiality. [Background check policy to be confirmed.]

Annex B below sets these out. They describe what is in place today rather than an aspiration, and the trust and security page lists what we have not done, including the certifications we do not hold.

Annex C lists them. You authorise those subprocessors. If we appoint another we will update the list and tell account holders, giving [notice period] in which you may object. [Objection and termination mechanics to be confirmed on legal review.]

Customer data is held in our AWS account in [AWS region]. Classification and answering involve OpenAI, which processes content outside the United Kingdom and the European Economic Area. [Transfer mechanism, such as the EU standard contractual clauses with the UK addendum, to be attached as Annex D.]

If someone contacts us about data in your workspace, we will pass it to you rather than answer it ourselves, and we will help you respond. Most of the work is doable in the product: signals are listed per competitor, and deleting a tracked competitor deletes the signals gathered for it.

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any event within [notification window, for example 72 hours] of becoming aware, with what we know, what we are doing and what we suggest you do. We will not wait until we have a complete picture before telling you.

We hold no third-party audit report, so we cannot satisfy an audit request by sending one. We will answer a reasonable written security questionnaire, and we will talk to your security team. [Audit rights and frequency to be agreed.]

You can delete workspace content at any time from inside the product. On termination we will delete customer data within [deletion period] of the account closing, except where the law requires us to keep something, and backups age out on their own schedule [backup retention period]. We will confirm deletion in writing if you ask.

The liability provisions in the terms of service apply to this addendum too.