This Data Processing Agreement (the “DPA”) forms part of the Terms of Service (the “Terms”) between The Scaling Company, a Delaware corporation doing business as Viro (“Viro” or “Processor”), and the customer that has accepted the Terms (“Customer” or “Controller”). It applies when Viro processes Customer Personal Data. If this DPA conflicts with the Terms, this DPA controls on data protection matters. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses control.
1. Definitions
Capitalized terms not defined here have the meanings in the Terms.
“Customer Personal Data” means personal data in Customer Data that Viro processes on Customer’s behalf.
“Data Protection Laws” means all data protection laws that apply to the processing, including the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the CCPA.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
“Standard Contractual Clauses” or “SCCs” means the clauses approved by European Commission Implementing Decision (EU) 2021/914.
“UK Addendum” means the International Data Transfer Addendum issued by the UK Information Commissioner.
“Subprocessor” means a third party Viro engages to process Customer Personal Data.
“Controller”, “processor”, “data subject”, “personal data”, “processing”, “business”, and “service provider” have the meanings given in Data Protection Laws.
2. Roles and Instructions
2.1 Roles
Customer is the controller of Customer Personal Data, and Viro is its processor. Where Customer is itself a processor for another controller, Viro is Customer’s subprocessor. Viro is an independent controller of account, billing, and Platform usage data, which its Privacy Policy covers.
2.2 Customer Instructions
Viro processes Customer Personal Data only on Customer’s documented instructions. The Terms, this DPA, and Customer’s configuration and use of the Platform, including its meeting mode, autonomy, and connected account settings, are Customer’s complete instructions. Viro will tell Customer if it believes an instruction breaches Data Protection Laws.
2.3 Customer Responsibilities
Customer is responsible for having a lawful basis for the processing, for giving all required notices and obtaining all required consents, including from Meeting Participants and the recipients of messages sent through the Platform, and for the accuracy and lawfulness of Customer Personal Data.
2.4 No Training
Viro will not use Customer Personal Data to train or improve AI models, whether its own or a third party’s, and requires its AI model Subprocessors not to do so.
3. Confidentiality
Viro ensures that everyone authorized to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide, secure, and support the Platform.
4. Subprocessors
4.1 Authorization
Customer gives Viro general authorization to engage Subprocessors. Viro’s current Subprocessors are listed on its Subprocessor List.
4.2 Obligations
Viro will impose data protection terms on each Subprocessor that protect Customer Personal Data to the same standard as this DPA, and remains responsible for its Subprocessors’ performance.
4.3 Changes
Viro will give at least 15 days’ notice by email before a new Subprocessor processes Customer Personal Data. Customer may object on reasonable data protection grounds within 10 days of notice. If the parties cannot resolve the objection, Customer may terminate the affected Subscription and receive a refund of prepaid fees for the unused period.
5. Security
Viro will implement and maintain the technical and organizational measures described in Annex II, appropriate to the risk. Viro may update them, provided the updates do not materially reduce the overall protection of Customer Personal Data.
6. Security Incidents
Viro will notify Customer without undue delay, and where possible within 72 hours, after becoming aware of a Security Incident. The notice will describe, as far as known, the nature of the incident, the categories and approximate number of data subjects and records affected, its likely consequences, and the measures taken or proposed. Viro will provide further information as it becomes available, take reasonable steps to contain and remedy the incident, and reasonably assist Customer with its own notification obligations. Notice of a Security Incident is not an admission of fault.
7. Assistance
Taking into account the nature of the processing, Viro will reasonably assist Customer, including through the Platform’s features, in responding to data subject requests, carrying out data protection impact assessments, and consulting regulators. If Viro receives a request directly from a data subject about Customer Personal Data, it will forward it to Customer within five business days and will not respond except to direct the data subject to Customer, unless the law requires otherwise.
8. Return and Deletion
After the Subscription ends, Customer has 30 days to export Customer Personal Data. Viro then deletes it from active systems within 30 days, and from backups as they are overwritten in the normal course, unless the law requires Viro to keep it. Viro will confirm deletion in writing on request.
9. Audits
Viro will make available information reasonably needed to demonstrate compliance with this DPA, including responses to reasonable security questionnaires. If that information is not enough to meet Customer’s obligations, or a regulator requires it, Customer may audit Viro once a year, on at least 30 days’ notice, during business hours, under confidentiality obligations, and at Customer’s cost, in a way that does not unreasonably disrupt Viro’s operations or compromise other customers’ data.
10. International Transfers
10.1 Transfer Mechanism
Customer Personal Data may be processed in the countries listed on the Subprocessor List and where Viro’s personnel are located. To the extent Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the SCCs are incorporated into this DPA as follows: Module 2 applies where Customer is a controller and Module 3 where Customer is a processor; Clause 7 (docking) applies; under Clause 9, option 2 (general authorization) applies with the notice period in Section 4.3; the optional language in Clause 11 does not apply; under Clauses 17 and 18, the governing law and courts are those of Ireland; and Annexes I and II of this DPA complete the SCC Annexes.
10.2 UK and Switzerland
For transfers subject to the UK GDPR, the UK Addendum applies, completed with the information in this DPA, and either party may end it as permitted by its Section 19. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to Swiss law, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.
11. Government Requests
If a government authority asks Viro for Customer Personal Data, Viro will try to redirect the request to Customer, notify Customer promptly unless the law forbids it, and disclose only what it is legally required to. Viro will not voluntarily disclose Customer Personal Data to a government authority.
12. U.S. State Privacy Laws
Where the CCPA or similar U.S. state laws apply, Viro is Customer’s service provider or processor. Viro will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Platform; or combine it with personal data from other sources except as those laws permit. Viro will comply with those laws, provide the same level of privacy protection they require, and notify Customer if it can no longer meet its obligations. Customer may take reasonable steps to stop and remedy unauthorized use.
13. Liability
Each party’s liability under this DPA, including under the SCCs to the extent the law allows, is subject to the limitations of liability in the Terms.
14. Term
This DPA lasts as long as Viro processes Customer Personal Data.
Annex I: Details of Processing
A. Parties
Data exporter (Controller): Customer, as identified in its Viro account. Contact: the account owner’s email. Activities: use of the Platform for its sales and revenue operations.
Data importer (Processor): The Scaling Company, doing business as Viro, 1111B South Governors Avenue, Dover, DE 19904. Contact: legal@meetviro.com. Activities: providing the Platform.
B. Description of Transfer
Data subjects: Customer’s Authorized Users; Customer’s prospects, customers, and business contacts; Meeting Participants; and other individuals whose data appears in connected email, calendars, files, or records.
Categories of data: names, business contact details, job titles, company information, email and message content, calendar events, meeting audio, transcripts, and meeting chat, deal and activity records, notes, voice memos sent to Iris, and Platform usage data.
Special categories: none intended. Special categories may incidentally appear in meetings or emails. Protected by the measures in Annex II.
Frequency: continuous, for the length of the Subscription.
Nature and purpose: hosting, storage, transcription, AI processing, meeting attendance and capture, drafting and sending communications, updating records, and support, to provide the Platform to Customer.
Retention: for the Subscription, then deleted as set out in Section 8.
Subprocessor transfers: as listed on the Subprocessor List, for the same purposes and duration.
C. Competent Supervisory Authority
The authority determined under Clause 13 of the SCCs. Where Customer has no EU establishment, the authority of the Member State where Viro’s EU representative is located.
Annex II: Technical and Organizational Measures
- Encryption of data in transit.
- Encryption of data at rest through Viro’s infrastructure providers.
- Access to production systems and Customer Personal Data limited to personnel who need it.
- Multi-factor authentication for administrative access to infrastructure and core systems.
- Logical separation of each customer’s data within the Platform.
- Written confidentiality and data protection obligations for all personnel and contractors.
- Data protection terms with all Subprocessors, including no-training terms with AI model providers.
- A documented incident response process and breach log.
- Customer controls to delete recordings, transcripts, and records, and to turn off meeting capture.