Data Processing Agreement (summary)

This document summarizes the main terms of Vantrel's standard Data Processing Agreement (DPA). The full DPA is available on request and is signed together with the subscription agreement.

Roles of the parties

Under the General Data Protection Regulation (GDPR), the customer acts as the data controller and Vantrel acts as a data processor. Vantrel processes personal data only on documented instructions from the customer, for the purpose of providing Vantrel Plan.

Categories of personal data

The personal data processed in Vantrel Plan typically includes:

• User account data: name, business email address, job title, login and activity logs.
• Data entered by customers into their models, which may include employee data for workforce planning (for example salaries, cost centers or headcount).

Vantrel Plan is not designed to process special categories of personal data (such as health data), and customers are asked not to upload such data.

International data transfers

For customers hosted in the EU region, customer data is stored and processed in the European Union. Limited remote access by support staff located outside the EU may occur, in which case transfers are covered by the European Commission's Standard Contractual Clauses (SCCs) and a transfer impact assessment.

Vantrel Inc. (US) is covered by the EU-U.S. Data Privacy Framework.

Data subject rights

Vantrel assists customers in responding to requests from data subjects (access, rectification, erasure, portability) through product features and, where needed, through its support team. Requests received directly by Vantrel are forwarded to the customer without undue delay.

Personal data breach notification

Vantrel notifies the customer of any personal data breach affecting the customer's data without undue delay, and in any case within 48 hours after becoming aware of it. The notification includes the nature of the breach, the categories of data concerned, the likely consequences and the measures taken.

Return and deletion of data

At the end of the contract, the customer can export their data at any time during a 30-day grace period. Customer data is then deleted from Vantrel's production systems within 30 days after the end of the grace period, unless retention is required by law.

Audits

Customers can rely on Vantrel's SOC 2 Type II report and ISO 27001 certificate to verify compliance. On-site audits by the customer are possible once per year, with 30 days' prior notice, at the customer's expense, and for Enterprise customers only.

Sub-processors

Vantrel uses sub-processors listed in the Sub-processors document. Vantrel informs customers at least 30 days before adding or replacing a sub-processor, giving them the opportunity to object.