Data Processing Terms

These Data Processing Terms (“DPT”) apply when Vordian processes personal data on Customer's behalf under the Terms of Service or an order (“Agreement”). Customer is the controller and Vordian is the processor for Customer Personal Data. Each party remains a separate controller for personal data it independently determines how and why to process, including its own business contacts and compliance records.

Terms such as controller, processor, data subject, personal data, process, personal data breach, and supervisory authority have the meanings in applicable data-protection law. “Customer Personal Data” means personal data submitted, connected, or generated for Customer through the service, excluding data Vordian processes as an independent controller.

Customer instructs Vordian to process Customer Personal Data to host, import, normalize, match, search, summarize, embed, generate coach-visible outputs, maintain provenance and audit records, provide support, prevent abuse, recover the service, and otherwise perform the Agreement. The Agreement, approved source choices, feature use, and documented support requests are Customer's complete instructions. Vordian will notify Customer if an instruction appears to infringe applicable data-protection law, unless law prohibits notice.

Customer warrants that it has authority to give the instructions, has provided required privacy information, has an Article 6 lawful basis and any required Article 9 condition, and will not submit data about children, HIPAA-regulated protected health information, or FTC personal-health-record data unless Vordian has first agreed in writing to the required safeguards.

Vordian will ensure that people authorized to process Customer Personal Data are bound by confidentiality and access it only as needed. Taking account of the state of the art, implementation cost, the nature and risk of processing, Vordian will maintain appropriate technical and organizational measures, including transport encryption, encrypted source credentials, workspace-scoped access, restricted production credentials, audit events, log redaction, dependency and vulnerability checks, backups, incident procedures, and recovery testing.

Customer is responsible for its account security, membership and source approvals, data minimization, client-facing controls, and use of available security features. Security measures may evolve without materially reducing overall protection.

Customer gives general written authorization for Vordian to use the providers on the Subprocessors page. Vordian will impose data-protection obligations that provide a materially equivalent level of protection and remains responsible for each subprocessor's performance of those obligations.

Vordian will publish a new subprocessor before it begins material processing. Customer may object on reasonable data-protection grounds by contacting privacy@vordian.app. The parties will try in good faith to resolve the objection. If no reasonable alternative is available, Customer may stop the affected feature or terminate the affected service before that provider begins processing.

Vordian will use an applicable adequacy regulation or lawful transfer mechanism for restricted transfers. For transfers from the UK where adequacy does not apply, the parties incorporate the then-current EU controller-to-processor Standard Contractual Clauses as modified by the UK International Data Transfer Addendum, with Customer as exporter and Vordian as importer, to the extent required. Vordian will conduct proportionate transfer-risk assessments and require downstream safeguards from subprocessors.

Taking account of the nature of processing, Vordian will provide reasonable assistance for Customer to respond to access, correction, erasure, restriction, objection, and portability requests. If Vordian receives a request concerning Customer Personal Data, it will direct the requester to Customer unless legally required to respond.

Vordian will provide information reasonably necessary for Customer's security, breach-notification, impact-assessment, and supervisory consultation duties. Assistance beyond standard service features may be charged at reasonable rates if the work is substantial and not caused by Vordian's breach.

Vordian will notify Customer without undue delay after confirming a personal data breach affecting Customer Personal Data. As information becomes available, notice will describe the nature and likely consequences, affected data and people where reasonably possible, measures taken or proposed, and a contact for follow-up. Vordian will take reasonable steps to contain, investigate, remediate, and preserve evidence. Customer is responsible for regulator and data-subject notices unless applicable law assigns that duty to Vordian.

During the service, Customer may use available source controls and request a copy or deletion through privacy@vordian.app. On termination or written instruction, Vordian will return or delete Customer Personal Data within a reasonable period, unless law requires retention. Data may remain isolated in encrypted backups until the ordinary backup cycle expires and will not be restored into active use except for disaster recovery.

Vordian will make information reasonably necessary to demonstrate compliance available to Customer. No more than once annually, unless a confirmed incident or authority requires more, Customer may request an audit. Audits must protect other customers, confidentiality, and service security, use existing reports first, occur during normal business hours, and avoid unreasonable disruption. Customer pays its audit costs unless the audit identifies Vordian's material breach.

Subject matter

Business coaching-operations software and connected-source features.

Duration

The Agreement plus the documented deletion and backup period.

Nature and purpose

Importing, storing, structuring, matching, searching, generating, displaying, securing, supporting, exporting, and deleting data to provide the service.

People

Customer users, coaching clients, prospects, staff, contractors, and people represented in Customer-approved sources.

Data types

Identity and contact data; account and workspace data; coaching notes and communications; dates, progress, training, nutrition, body measurements and wellbeing data; source metadata and content; derived events, actions, embeddings, outputs, provenance, and audit records.

Special categories

Customer source data may reveal health, injury, disability, medication, body-composition, nutrition, or wellbeing information.

If these DPT conflict with the Agreement on processing Customer Personal Data, these DPT control. Vordian may update them where needed for law, provider changes, or improved protection and will give reasonable notice of a material adverse change. Continued processing after the effective date is subject to the updated version unless the parties agree otherwise in writing.