REFERENCE TO THE MASTER AGREEMENT
This Annex forms part of the Vitum Technologies, S.L. Master Agreement and applies only when incorporated by an Order. Terms defined in the Master Agreement have the same meaning here. In case of conflict, the Master Agreement’s order of precedence applies.
Clause 1. Roles and object (DPA)
The Customer is controller and Vitum is processor. Vitum shall process personal data solely per the Customer’s documented instructions and to provide the services.
Clause 2. Subject-matter, duration, nature and purpose
Subject-matter: provision of the Platform and related services. Duration: the term of the contract. Nature and purpose: asset traceability and management and the operations necessary for it.
Clause 3. Categories of data and data subjects
Data subjects: Customer users and, where applicable, transport/driver personnel. Categories: contact and identification data, credentials and, where applicable, location data linked to identifiable persons. No special categories are envisaged.
Clause 4. Capture channels (including WhatsApp)
Where data capture uses messaging channels (e.g. WhatsApp) with drivers or third parties who are not Platform users, they receive basic privacy information and a link to the Privacy Policy at first contact. The Customer, as controller, warrants the legal basis to contact such persons.
Clause 5. Processor obligations
Vitum shall: process only per instructions; ensure confidentiality of authorised personnel; adopt the Art. 32 security measures; and assist the Customer in meeting its obligations.
Clause 6. Sub-processors
The Customer authorises the use of sub-processors (e.g. hosting providers) bound by contract to equivalent guarantees. Vitum will inform of additions or changes and the Customer may object on reasonable grounds.
Clause 7. Security
Vitum shall apply appropriate technical and organisational measures: encryption in transit, access control, activity logging, backups and continuity, and periodic testing.
Clause 8. Data breaches
Vitum shall notify the Customer without undue delay and, at the latest within 48 hours of becoming aware, of any security breach, with the information needed for the Customer to meet its obligations.
Clause 9. International transfers
No transfers outside the EEA will occur without adequate safeguards (adequacy decision or Standard Contractual Clauses).
Clause 10. Data subject rights and return
Vitum shall assist the Customer with data-subject requests (access, rectification, erasure, etc.). On termination, at the Customer’s choice, it shall return or delete the data and copies, save any legal retention duty.
Clause 11. Audits
Vitum shall make available the information needed to demonstrate compliance and allow reasonable audits, with notice and without compromising other customers’ security.
Clause 12. SLA — Availability
Vitum shall target a monthly Platform availability of 99.5%, excluding scheduled maintenance windows and force-majeure or third-party events.
Clause 13. SLA — Support and response times
Support via [email protected] during business hours, 9am–6pm CET. Target response times: critical 4h, high 1 business day, normal 3 business days.
Clause 14. SLA — Maintenance and credits
Scheduled maintenance will be announced with reasonable notice, preferably out of hours. Repeated failure to meet the availability target may give rise to any service credits set in the Order.