Auftragsverarbeitungsvertrag
Dieses Dokument ist nur auf Englisch verfügbar.
1. When this agreement applies
This Data Processing Agreement (“DPA”) forms part of the service agreement between Elvoro Ltd (“Elvoro”) and the customer identified in the accepted order (“Client”) when Elvoro processes personal data on the Client's behalf. Elvoro Ltd is registered in England and Wales, company number 16617494, at 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE.
The Client acts as controller and Elvoro as processor for that processing. If the Client acts as a processor for another controller, the Client confirms that it is authorized to appoint Elvoro as subprocessor; references to the Client's instructions mean instructions it is authorized to give.
This DPA does not govern information Elvoro processes as an independent controller for its own billing, relationship management, legal compliance or other separately determined purposes. Those activities are described in the Privacy Policy. Roles depend on the actual activity, rather than solely on the service's name.
“Data Protection Law” means the data-protection legislation applicable to the processing, including the UK GDPR and Data Protection Act 2018, and the EU GDPR where applicable. “Personal Data,” “processing,” “controller,” “processor” and “personal data breach” have their meanings under that law. “Client Data” means Personal Data processed on the Client's behalf under this DPA.
2. Processing details and instructions
The processing record in Schedule 1 identifies the service, purposes, activities, duration, Personal Data and people concerned. The accepted service scope, authorized connections and written instructions together define the processing Elvoro may perform. The Client determines its purposes and is responsible for the lawful basis, notices and permissions for its instructions and supplied data.
Elvoro processes Client Data only on documented instructions, including instructions concerning international transfers, except where UK law requires otherwise under the UK GDPR, or Union or Member State law to which Elvoro is subject requires otherwise under the EU GDPR. Elvoro informs the Client of that legal requirement before processing unless the relevant law prohibits notice on important grounds of public interest. Other legal demands are assessed under applicable Data Protection Law and the relevant transfer instrument; this DPA does not independently authorize them. Elvoro promptly informs the Client if an instruction appears to infringe applicable Data Protection Law and may pause the affected processing while the parties resolve it.
Elvoro does not use Client Data for its own unrelated marketing, sell it or authorize a provider to use it to train general-purpose models for the provider's own purposes. Any proposed use outside the documented service purpose requires a separate lawful arrangement; it is not authorized by this DPA.
3. Confidentiality and security
Elvoro limits access to people who need Client Data for the agreed processing and ensures that authorized personnel are bound by confidentiality obligations or an equivalent statutory duty.
Elvoro implements appropriate technical and organizational measures under Article 32, taking account of the processing, risks to individuals, available technology and implementation costs. The agreed measures are recorded in Schedule 2. They address confidentiality, integrity, availability, resilience, restoration and regular assessment in a manner appropriate to the service.
Elvoro may improve the measures without reducing the overall protection of Client Data. A material change affecting the agreed processing or the Client's security requirements is communicated to the Client.
4. Subprocessors
Unless the Client's processing schedule expressly requires specific authorization, the Client grants Elvoro general written authorization to use the subprocessors identified in Schedule 3 and to add or replace subprocessors through the process below. Elvoro keeps Schedule 3 current and identifies each provider's contracting entity, processing purpose, locations and applicable transfer safeguard.
Elvoro gives the Client's designated privacy contact written notice at least 15 calendar days before a proposed new or replacement subprocessor first processes Client Data. The notice includes the information above. The Client may object within that period on reasonable data-protection grounds by explaining its concerns in writing. If no objection is received within that period, the change is authorized under this DPA.
If the Client objects in time, Elvoro does not allow the proposed subprocessor to process that Client's data while the objection remains unresolved. The parties seek a reasonable alternative. If no workable alternative is available, either party may end the affected service before the proposed change applies to that Client, with prepaid fees for its undelivered portion refunded. Other services continue where practicable, and existing rights and remedies remain unaffected.
Elvoro imposes materially equivalent data-protection obligations on each subprocessor and remains responsible to the Client for the subprocessor's performance of those obligations. Authorization of a provider for one service does not authorize unrelated processing. This process does not replace the international-transfer requirements in section 5.
5. International transfers
Elvoro transfers Client Data outside a legally protected territory only in accordance with the Client's documented instructions and applicable transfer requirements. Schedule 3 identifies the relevant processing locations and safeguard for each restricted transfer.
Where an adequacy decision or other recognized safeguard applies, Elvoro ensures that its conditions are met. Where standard contractual clauses, a UK International Data Transfer Agreement or UK Addendum are required, the parties or relevant recipient complete and incorporate the applicable instrument, including its annexes, before the transfer. This DPA alone is not a substitute for that instrument or an authorization for unrestricted transfers.
6. Requests from individuals
Taking account of the processing, Elvoro provides appropriate assistance so the Client can respond to individuals' rights requests. If Elvoro receives a request relating to Client Data, it forwards it to the Client without undue delay and does not independently respond on the Client's behalf unless instructed or required by law.
The Client identifies its authorized privacy contact in Schedule 1. Elvoro may request the information reasonably needed to locate the relevant Client Data and carry out the instruction securely.
7. Incidents and compliance assistance
Elvoro notifies the Client without undue delay after becoming aware of a personal data breach affecting Client Data. The initial notice provides the information then available about the nature of the breach, affected categories and approximate number of individuals and records, likely consequences, measures taken or proposed, and a contact for further information. Missing information is provided in stages without undue delay.
Elvoro takes reasonable steps to contain, investigate and remedy the breach and preserves the information needed for the Client's response. Elvoro assists the Client with its security, breach-notification, impact-assessment and prior-consultation obligations, taking account of the processing and information available to Elvoro. Unless legally required, Elvoro does not notify individuals or a regulator on the Client's behalf without instruction.
8. Information and audits
Elvoro makes available the information reasonably necessary to demonstrate compliance with this DPA and Article 28, and allows and contributes to relevant audits and inspections by the Client or an independent auditor it appoints.
The parties coordinate the scope, timing and method to protect other clients' information, maintain security and avoid unnecessary disruption. Existing evidence may address a request, but does not replace an audit where that evidence is insufficient or an audit is legally required. Confidentiality requirements must not prevent a lawful regulatory disclosure. Any assistance charges must be agreed in advance and cannot prevent mandatory cooperation or require the Client to fund remediation of Elvoro's breach.
9. Return and deletion
At the end of the relevant service, the Client may choose return or deletion of Client Data. Elvoro carries out that instruction and deletes remaining copies, except to the extent retention is required by UK law where the UK GDPR applies, or Union or Member State law where the EU GDPR applies. Schedule 1 records the return method, deletion period and backup treatment agreed for the service.
Any data lawfully retained is isolated from ordinary processing and used only for the retention requirement. Data awaiting deletion from backups remains protected and outside normal use until removed under the agreed deletion cycle. On request, Elvoro confirms completion or identifies any legally retained data and the reason.
10. Responsibility and precedence
Each party remains responsible for its own obligations under Data Protection Law. Nothing in this DPA removes a data subject's rights or a regulator's powers. The service agreement's valid liability provisions apply between the parties without limiting liabilities or remedies that cannot lawfully be limited.
This DPA takes priority over conflicting service terms on the processing it governs. Mandatory transfer instruments take priority where they require it. Changes to this DPA require a written agreement or another valid amendment process under the service agreement; an updated website copy alone does not change an accepted DPA.
Schedule 1 — Service-specific processing record
The completed record is attached to the Client's order and identifies the authorized processing. Only the services selected for that Client apply.
| Service | Purpose and processing activities | Possible Personal Data and individuals |
|---|---|---|
| Marketing for Enterprise | Create, publish, manage and analyze the agreed social content and campaigns; access authorized accounts; prepare reporting and improvements. | Business contact details, authorized account identifiers, content featuring individuals, public audience interactions and campaign data. Client personnel, featured individuals, creators and people interacting with the campaign. |
| Strategic AI Agent — authorized company-data analysis | Retrieve and analyze the data the Client selects; connect it to the requested research; create and deliver briefings. | Relevant customer, sales, operational, financial or workforce data in authorized systems, limited to the agreed scope. Client personnel, customers, suppliers and other individuals represented in that selection. |
| AI Video Production and purchased campaigns | Process supplied materials, produce and review creative work, coordinate approved publishing and campaign reporting. | Names, contact details, likenesses, voices, business roles, creator information and campaign interactions included in the agreed brief. Client personnel, featured individuals, creators and audience members. |
| Account Creation & Warm-Up | Establish and prepare authorized business accounts and perform the agreed access and management arrangements. | Contact details, authorized account identifiers, recovery details and platform verification information only where required and handled through the agreed route. Authorized client representatives and account administrators. |
The completed record also specifies:
- Client legal identity, relevant service/order reference and authorized privacy contact.
- Selected purposes, data categories and individuals; any expressly authorized sensitive data or additional restrictions.
- Processing start, service duration, instructed retention, return method, deletion period and backup deletion cycle.
- Approved access methods, connected systems, processing locations and any Client-specific requirements.
Special-category data, criminal-offence data and children's data are excluded unless expressly identified in a lawful, separately agreed scope. Public research or platform processing for which Elvoro or a platform independently determines purposes is assessed separately; this schedule does not automatically classify it as processing on the Client's behalf.
Schedule 2 — Security measures
The service's attached security schedule records the actual measures applicable to Client Data in each of these areas:
- Authorized personnel, confidentiality and access permissions.
- Authentication, credential handling and removal of access.
- Protection of information in transit, storage and transfers.
- Separation of client information and restrictions on sharing.
- Logging, monitoring, vulnerability management and incident response.
- Backup, restoration and continuity arrangements.
- Data minimization, return, deletion and retention controls.
- Provider oversight and regular testing of the measures.
Specific technologies, locations, assurance reports or certifications form part of the agreement only where expressly recorded in that completed schedule.