1. When a DPA applies
If a customer uses Vutler to process personal data on behalf of that customer, the customer will generally act as controller and Vutler will generally act as processor for the relevant service data, subject to the contract and actual use case.
A separate DPA may be appropriate where the customer requires processor terms covering subject matter, duration, categories of personal data, security, confidentiality, subprocessors, assistance, audits, deletion, and international transfers.
2. Core processing commitments
- Process personal data on documented customer instructions, subject to applicable law.
- Ensure confidentiality obligations for personnel authorized to access relevant data.
- Apply appropriate technical and organizational security measures.
- Assist the customer with reasonable requests related to data subject rights, incidents, and compliance obligations where required and appropriate.
- Delete or return covered personal data at the end of the service relationship, subject to legal retention duties and agreed operational constraints.
3. Subprocessors and providers
Vutler relies on infrastructure and service providers to deliver the platform, and customers may also enable third-party AI providers or integrations. The applicable subprocessor position depends on whether those services are used by Vutler as part of the service or selected directly by the customer in its own configuration.
A current transparency page is available under Subprocessors. Customer-configured model providers and integrations may create additional data flows that the customer should review independently.
4. How to request
To request the current DPA template or discuss customer-required terms, contact privacy@starbox-group.com or legal@starbox-group.com with your company name, workspace, and procurement or legal contact details.