Data Processing Agreement

0. The Parties

Controller: the Customer named in the Individual Agreement (quote) (the "Controller").

Processor: Vilbergsson Viktor E.V., a Hungarian sole proprietorship (the "Processor").

Registered seat

Patakpart u. 19/2., 2111 Szada, Hungary

Registration no.

62901350

Tax no.

92435335-1-33

Privacy contact

Viktor Vilbergsson, viktor@vmv.hu, +36 20 232 0742

1. Subject matter and scope

1. 1.1.This agreement sets out the terms required by Article 28(3) GDPR. It applies whenever the Processor processes personal data on behalf of the Controller while performing services under the VMV General Terms and Conditions (ÁSZF) and the Individual Agreement (together, the "Main Agreement").
2. 1.2.Annex 1 sets out, for each service, the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.
3. 1.3.Terms defined in Article 4 GDPR (such as personal data, processing, controller, processor, data subject and personal data breach) have the same meaning in this agreement. "GDPR" means Regulation (EU) 2016/679, "Infotv." means Hungarian Act CXII of 2011, and the "AI Act" means Regulation (EU) 2024/1689.
4. 1.4.This agreement forms part of the Main Agreement. Where the two differ on the processing of personal data, this agreement prevails.

2. Rights and obligations of the Controller

1. 2.1.The Controller is responsible for:
   • having a legal basis for the processing;
   • informing data subjects under Articles 13–14 GDPR (the template in Annex 4 can help);
   • ensuring that its instructions to the Processor are lawful.
2. 2.2.The Controller's documented instructions are:
   • the Main Agreement and this agreement;
   • the settings the Controller enters in the portal (e.g. notification email address, practice details);
   • the Controller's written instructions, including instructions given by email.
   An instruction that requires a material change to the service is subject to a separate agreement.
3. 2.3.The Controller will not instruct the Processor to use the AI assistant to collect health data or any other special category data under Article 9 GDPR. It will not upload such data to the system, for example in a document.

3. Obligations of the Processor

1. 3.1.Processing on instructions. The Processor processes personal data only on the Controller's documented instructions, including with regard to transfers to third countries. The exception is processing required by Union or Member State law. In that case, the Processor informs the Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.
2. 3.2.Infringing instructions. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.
3. 3.3.Confidentiality. Only persons who have committed themselves to confidentiality, or who are under a statutory obligation of confidentiality, may access the personal data.
4. 3.4.Security. The Processor implements the technical and organisational measures required by Article 32 GDPR (Annex 2). It may update the measures as technology develops, provided the level of protection does not decrease.
5. 3.5.Data minimisation in the AI assistant.
   1. Before storage, the system automatically redacts any sentence in a visitor's message that mentions a symptom, complaint, medication, diagnosis or health condition, as well as Hungarian social security (TAJ) numbers.
   2. A medical filter removes such sentences or clauses before any model call. They therefore reach neither the answering model nor the model that extracts callback details.
   3. Conversations are deleted automatically 30 days after they are created.
   4. Callback notifications sent to the Controller contain no health data.
   5. Neither the Processor nor the model providers use the data to train AI models. Model calls are sent with a no-training setting, so they can only be routed to providers that do not train on requests.
   6. IP addresses are kept only as an irreversible identifier hashed with a daily-rotating salt, used to prevent abuse.
   The Parties acknowledge that the automatic filter relies on typical health-related expressions in Hungarian, English and German, so it may not recognise every mention of health data. The Processor keeps improving the filter, and the Controller asks data subjects in its privacy notice not to share health data in the chat.
6. 3.6.Data subject rights. The Processor uses appropriate technical and organisational measures to help the Controller respond to data subject requests. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller within 5 business days and does not answer it on the merits. On the Controller's instruction, the Processor exports, corrects or deletes the specified data within 10 business days.
7. 3.7.Assistance. The Processor helps the Controller meet its obligations under Articles 32–36 GDPR: security, breach notification, data protection impact assessments and prior consultation. The help reflects the nature of the processing and the information available to the Processor. For an impact assessment, it provides a description of the AI assistant and its data flows. The Parties agree in advance on the cost of assistance beyond the usual scope.
8. 3.8.Records. The Processor keeps the record of processing activities required by Article 30(2) GDPR.

4. Roles under the AI Act

The Processor develops the AI assistant and makes it available, so it is the provider under the AI Act. The Controller, which uses the system on its own website, is the deployer. The Processor designs the AI assistant to tell users at the start of each conversation that they are interacting with an AI system (Article 50(1)). It also marks the generated replies in a machine-readable format (Article 50(2)). Annex 3, point M3.5 of the ÁSZF sets out the division of tasks in detail.

5. Sub-processors

1. 5.1.The Controller gives general written authorisation to engage the sub-processors listed in Annex 3 (Article 28(2) GDPR).
2. 5.2.Before adding or replacing a sub-processor, the Processor notifies the Controller by email at least 15 days in advance. Within that period, the Controller may object in writing on reasonable grounds. The Parties will then consult in good faith. If they cannot agree, the Controller may terminate the affected service with effect from the date of the change, without penalty. In that case, the Processor refunds the unused part of any prepaid fees pro rata.
3. 5.3.If a sub-processor has to be replaced urgently, for security reasons or because its service ends, the Processor may make the change at the same time as notifying the Controller. The Controller may then exercise its right to object afterwards.
4. 5.4.By contract, the Processor imposes on each sub-processor the same data protection obligations that bind the Processor itself (Article 28(4) GDPR). The Processor remains fully liable to the Controller for the performance of its sub-processors.

6. Transfers to third countries

1. 6.1.Data is stored primarily in the European Union: the database runs in Ireland and the application in Frankfurt (Annex 3).
2. 6.2.Data is transferred outside the European Economic Area only under the conditions of Chapter V GDPR. One such condition is an adequacy decision, including the EU–US Data Privacy Framework (DPF) for certified recipients. Another is the European Commission's standard contractual clauses (SCCs, Decision (EU) 2021/914), with supplementary measures where needed. Annex 3 states the transfer mechanism for each recipient.
3. 6.3.The Controller approves the transfers listed in Annex 3.

7. Personal data breaches

1. 7.1.The Processor notifies the Controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it. The notice goes to the contact email address the Controller has provided and, where available, also by phone.
2. 7.2.To the extent available, and in phases if necessary, the notification describes:
   • the nature of the breach;
   • the categories and approximate number of data subjects and records concerned;
   • the likely consequences;
   • the measures taken or proposed;
   • a contact point.
3. 7.3.The Processor cooperates in investigating the breach and mitigating its effects, and documents the breach. It notifies authorities or data subjects on the Controller's behalf only on the Controller's instruction or where the law requires it.

8. Information and audits

1. 8.1.On request, the Processor makes available the information needed to demonstrate compliance. This includes, for example, this agreement, the description of the measures in Annex 2, the sub-processor list and the sub-processors' available certifications.
2. 8.2.The Controller, or an independent auditor it appoints who is bound by confidentiality, may carry out one audit per calendar year. More frequent audits are allowed after a breach or at an authority's request. Audits must be announced at least 30 days in advance. They take place during business hours, without disproportionate disruption, and primarily remotely or on the basis of documents. The Controller bears the cost of the audit. Sub-processors are audited on the basis of their reports and certifications.

9. Liability

The Parties are liable to data subjects under Article 82 GDPR. Between the Parties, the liability rules of the Main Agreement (ÁSZF, section 8) apply, except for liability that cannot be limited by law.

10. Term, termination and return or deletion of data

1. 10.1.This agreement remains in force for as long as the Processor processes personal data on the Controller's behalf under the Main Agreement.
2. 10.2.When the Main Agreement ends, the Processor acts as the Controller chooses. On request, it exports the personal data in a machine-readable format within 15 days. Within 30 days after termination, it deletes all personal data, including copies, unless Union or Member State law requires storage. Data held in sub-processors' backups is deleted at the end of the backup cycle. On request, the Processor confirms the deletion in writing.
3. 10.3.The obligations of confidentiality and deletion survive termination until they are fulfilled.

11. Final provisions

1. 11.1.This agreement may be amended in writing. The exception is Annex 3, which is updated under section 5.
2. 11.2.This agreement is governed by Hungarian law. This English version is a translation for convenience; if the versions differ, the Hungarian text prevails.

A) AI assistant – chatbot

B) AI assistant – voice assistant

The voice assistant is under development, and no processing currently takes place under this service. Before launch, the Processor will add the service's details to this annex and notify the Controller under section 5. The addition will cover the phone number, audio and transcripts, call recording, retention periods and sub-processors.

C) Website hosting and maintenance

TOM Security measures

1. 1.Infrastructure. The database runs in AWS's Ireland region (eu-west-1), operated by Supabase. The server side of the application runs in Vercel's Frankfurt region (fra1).
2. 2.Encryption. All connections are encrypted (HTTPS/TLS). The database is encrypted at rest by the provider.
3. 3.Access.
   • Only the server-side application can reach the database, using a key held in the hosting provider's encrypted environment variables. There is no direct database access from browsers.
   • Every record carries the practice identifier and every query filters on it, so each practice's data is kept separate.
   • The Customer's portal opens with a per-practice 192-bit random key or with an expiring login link sent by email.
   • Only the Processor can access the administration interface.
   • Provider accounts (hosting, database, code repository, email) are protected by two-factor authentication. Keys are rotated whenever compromise is suspected.
4. 4.Data minimisation. The filtering and redaction described in section 3.5, and the no-training setting. The chat sets no cookies; the browser keeps the conversation identifier only until the tab is closed.
5. 5.Deletion.
   • A daily automatic job deletes conversations older than 30 days.
   • Trial demos are deleted with all their data when they expire.
   • Permanently deleting a practice removes all of its data in a single transaction. The deletion is logged without personal data.
6. 6.Abuse prevention. Rate limits by pseudonymised IP, a daily message cap per practice and per-conversation limits. Bot protection, and embedding restricted to the practice's own domain. Suspicious messages are checked by a filter.
7. 7.Monitoring. Automatic health checks every 5 minutes, with email alerts. Error logs contain no message content. Alerts flag unusual traffic, such as reaching 80% of the daily cap or a burst of rejected messages.
8. 8.Model use. Model calls go through Vercel AI Gateway, pinned to each model's own provider and sent with the no-training setting. The gateway does not store request content.
9. 9.Development. Version-controlled code, with automated tests run before every release. No secret keys are stored in the code repository.
10. 10.Organisation.
    • Only the Processor, a sole proprietor, has access to the personal data. Any future staff or subcontractors will be bound to confidentiality in writing.
    • A written procedure governs breach handling (assessment, containment, notification within 48 hours, documentation) and data subject requests.
    • The measures and the sub-processors are reviewed annually.
    • Work devices use encrypted storage and a screen lock, and are kept up to date.

List Sub-processors engaged

We update this list at least 15 days before any change and notify Customers by email (section 5 of the agreement). Sub-processors for the voice assistant will be published before that service launches.

Template Online assistant (chat)

The Controller may insert the following text into its privacy notice. The parts in square brackets must be completed.