This Data Processing Agreement (“DPA”) is part of the Terms & Conditions between LazyLines Kft. (LazyLines Ltd.), company registration number 13-09-234348, tax number 32570784-2-13, Mikla Pál utca 32/a, 2233 Ecser, Hungary (“Vamos”, “we”), and the business customer that uses Vamos (“Customer”, “you”).

It applies when you use Vamos for business purposes and, in doing so, Vamos processes personal data for which you are the controller. It takes effect when you accept the Terms, and needs no separate signature. If you need a signed copy, write to contact@getvamos.ai.

1. Definitions

“GDPR” means Regulation (EU) 2016/679 and, where it applies, the UK GDPR. “Personal data”, “controller”, “processor”, “processing”, “data subject”, “personal data breach” and “supervisory authority” have the meanings the GDPR gives them. “Customer Personal Data” means the personal data Vamos processes for you under this DPA, as described in Annex 1. “Sub-processor” means another processor we engage to process Customer Personal Data.

2. Roles

You are the controller of Customer Personal Data, and Vamos is your processor. Vamos is a separate controller for the data it needs to run its own business: your account, billing, security and usage data, and the public social media data it collects for the service. Our Privacy Policy covers that data.

3. Your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA and the way you configure and use Vamos. If the law requires us to process it otherwise, we’ll tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we’ll tell you.

You are responsible for having a lawful basis for the data you put into Vamos and the accounts you connect, and for telling the people concerned what they need to know.

4. Confidentiality

Everyone at Vamos who can access Customer Personal Data is bound by confidentiality.

5. Security

We apply the technical and organisational measures in Annex 2, and we may improve them over time without lowering the overall level of protection.

6. Sub-processors

You give us general authorisation to use sub-processors. The current list is at getvamos.ai/subprocessors. Each sub-processor is bound by a written contract with data protection obligations at least as strong as this DPA’s, and we remain responsible to you for its work.

Before we add or replace a sub-processor, we update the list and email customers who have asked to be notified at least 30 days in advance. To ask, write to contact@getvamos.ai with the subject “Sub-processor updates”. You can object on reasonable data protection grounds within that time. If we can’t resolve your objection, you can end the affected service and we refund any fees you prepaid for the time after it ends.

7. Helping you

Taking into account what we process and the information available to us, we help you:

• answer requests from data subjects who use their GDPR rights, mainly through the tools in Vamos for viewing, exporting and deleting data. If a data subject contacts us directly about your data, we pass the request on to you.

• with security, data protection impact assessments and consultations with supervisory authorities.

8. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we tell you without undue delay, and within 48 hours. We give you what we know about its nature, the data and people affected, its likely consequences, and what we’re doing about it, and we keep you updated.

9. Deletion at the end

When your account is deleted, we delete Customer Personal Data within 30 days, unless the law requires us to keep it. Before that you can export your docs from Vamos, or ask us for a copy.

10. Audits

We give you the information you reasonably need to show that we meet this DPA, including answers to security questionnaires. Where that isn’t enough, or a supervisory authority requires it, you can audit us once a year, at your cost, with 30 days’ notice, during business hours, under confidentiality and in a way that doesn’t expose other customers’ data.

11. Transfers outside the EU

Where a sub-processor processes Customer Personal Data outside the European Economic Area, in a country without an adequacy decision, we rely on the EU-US Data Privacy Framework where the sub-processor is certified, or on the European Commission’s Standard Contractual Clauses, which are incorporated into this DPA as needed.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limits in the Terms, as far as the law allows. If this DPA and the Terms conflict on the protection of personal data, this DPA wins.

13. Governing law

This DPA is governed by Hungarian law, and the courts of Hungary have jurisdiction, as in the Terms.

Annex 1: Details of the processing

Subject matter and purpose: providing Vamos to you: AI research and writing about social media content, your brand workspace, and reports from the social media accounts you connect.

Duration: for as long as you use Vamos, and until deletion under section 9.

Nature of the processing: collecting, storing, organising, analysing with AI models, displaying, sending by email and deleting.

Categories of data subjects:

• your staff and the team members you invite.

• people named or described in what you put into Vamos, such as your clients, contacts or audience.

• the audience of the accounts you connect, which reaches us only as totals.

Types of personal data:

• names and email addresses of your users.

• whatever personal data you include in chats, uploaded files, brand profiles and other content.

• the posts, statistics and audience totals of the accounts you connect.

Special categories of data: none intended. Don’t put special category data into Vamos.

Annex 2: Security measures

• Encryption in transit (TLS) for all traffic to and from Vamos.

• Encryption at rest by our main hosting and database providers.

• Access tokens for connected accounts stored encrypted, with read-only access only.

• Sign-in through Google Firebase, with each workspace’s data kept separate from other workspaces’.

• Access to production systems limited to the people who need it to run Vamos, with individual accounts.

• Database backups by our database provider.

• Logs and monitoring to detect errors and abuse.

• Sub-processors chosen for their security, under written data protection contracts.

Annex 3: Sub-processors

The current list is at getvamos.ai/subprocessors.