Data Processing Agreement
Version 1.1 · Effective 21 August 2026
1. Parties
This DPA is between Vigilis (operated by Abhay Prakash, an Estonian entrepreneur-account holder (processor)) and the customer organisation (controller). Vigilis is a business name, not a separate legal entity; the contracting party is Abhay Prakash.
2. Subject matter
Vigilis processes personal data submitted by the controller during compliance assessments, solely for the purpose of delivering the contracted compliance assessment and reporting service.
3. Nature and purpose of processing
Storage and processing of assessment responses and company profile data to generate compliance scores, obligation maps, and audit reports.
4. Types of personal data
Assessment respondent’s name and email; company profile information. No special category personal data is stored unless voluntarily included in free-text fields.
5. Duration
Processing continues for the duration of the customer’s account. On the controller’s instruction, or when the engagement ends, personal data is deleted without undue delay (within 30 days), except where a longer retention period is required by law (e.g. payment records under accounting law). The controller can also request deletion at any time via the Manage your data tool or by email.
6. Sub-processors
Vigilis uses the following approved sub-processors: Supabase Inc. (database, EU, AWS Europe (Ireland) region), Resend (email). Payment is by bank transfer, so no payment processor handles personal data. The controller is notified of any sub-processor changes with 30 days notice.
7. Data subject rights
Vigilis will assist the controller in fulfilling data subject rights requests within 5 business days.
8. Security
Vigilis implements encryption in transit (TLS), encryption at rest, access controls, and audit logging for all personal data processing.
9. Processor location and governing law
Vigilis is operated from Estonia by Abhay Prakash, and processes data within the EU (Supabase EU, Ireland region, see §6). This DPA is governed by the laws of the Republic of Estonia.
For a countersigned DPA, contact contact@vigilis.eu