Data Processing Addendum
Last revised: July 31, 2026
Execution copy — Last revised July 31, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between the Customer (the "Company") and Vistaly, Inc. (the "Processor") (together the "Parties"), whether that agreement is the Master Subscription Agreement (vistaly.com/msa) or the Terms of Service (vistaly.com/terms-of-service) (in either case, the "Principal Agreement").
For enterprise customers, this DPA may be executed as a standalone addendum to an existing Principal Agreement or is automatically incorporated when Customer signs an Order Form. For self-serve customers, this DPA is incorporated by reference into the Terms of Service and accepted by using the Services.
For HIPAA Covered Entities, a Business Associate Addendum may be requested at vistaly.com/baa. The BAA is not auto-incorporated into this DPA or the Principal Agreement and requires Vistaly's counter-execution to take effect.
WHEREAS
(A) The Company acts as a Data Controller with respect to Company Personal Data.
(B) The Company wishes to engage the Processor to process Company Personal Data in connection with the Services.
(C) The Parties seek to implement a data processing addendum that complies with the requirements of applicable Data Protection Laws, including the GDPR, the UK GDPR, and US State Privacy Laws.
(D) The Parties wish to lay down their rights and obligations.
IT IS AGREED AS FOLLOWS:
1. Definitions and Interpretation
1.1 Unless otherwise defined herein, capitalized terms and expressions used in this DPA shall have the following meaning:
1.1.1 "DPA" means this Data Processing Addendum and all Annexes;
1.1.2 "Company Personal Data" means any Personal Data processed by a Contracted Processor on behalf of Company pursuant to or in connection with the Principal Agreement;
1.1.3 "Contracted Processor" means the Processor or a Subprocessor;
1.1.4 "Data Protection Laws" means: (a) the GDPR; (b) the UK GDPR and the UK Data Protection Act 2018; (c) the Swiss Federal Act on Data Protection ("FADP"); (d) US State Privacy Laws; and (e) to the extent applicable, the data protection or privacy laws of any other country, state, or jurisdiction, in each case as amended, replaced, or superseded from time to time;
1.1.5 "EEA" means the European Economic Area;
1.1.6 "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation);
1.1.7 "UK GDPR" means the GDPR as retained in United Kingdom domestic law by the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019;
1.1.8 "US State Privacy Laws" means the consumer privacy laws of the states of the United States that apply to the Processing of Company Personal Data, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations ("CCPA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and the Texas Data Privacy and Security Act;
1.1.9 "Services" has the meaning given in the Principal Agreement;
1.1.10 "Subprocessor" means any person appointed by or on behalf of Processor to process Personal Data on behalf of the Company in connection with this DPA;
1.1.11 "Standard Contractual Clauses" or "SCCs" means (a) for transfers subject to the GDPR, the standard contractual clauses annexed to the European Commission's Implementing Decision (EU) 2021/914, Module Two (Controller to Processor), available at vistaly.com/sccs; (b) for transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner's Office, version B1.0, with Tables 1 to 4 completed as published at vistaly.com/uk-addendum ("UK Addendum"); and (c) for transfers subject to the Swiss FADP, the SCCs as recognized by the Swiss Federal Data Protection and Information Commissioner, in each case as amended or replaced from time to time;
1.2 The terms "Controller," "Data Subject," "Member State," "Personal Data," "Personal Data Breach," "Processing," and "Supervisory Authority" shall have the same meaning as in the GDPR (or, where applicable, the UK GDPR), and their cognate terms shall be construed accordingly. Section 15 sets out how those terms apply under US State Privacy Laws.
1.3 Capitalized terms used but not defined in this DPA (including "Authorized Users," "Fees," "Order Form," "Service Data," "Term," and "Usage Data") have the meanings given in the Principal Agreement. In this DPA, "Customer" means the Company and "Vistaly" means the Processor.
2. Processing of Company Personal Data
2.1 Processor shall: (a) comply with all applicable Data Protection Laws in the Processing of Company Personal Data; and (b) not Process Company Personal Data other than on the Company's documented instructions, unless required by applicable law, in which case the Processor shall (to the extent permitted by law) inform the Company of that legal requirement before Processing.
2.2 The Company instructs Processor to process Company Personal Data as described in Annex I (Description of Processing).
3. Processor Personnel
Processor shall take reasonable steps to ensure the reliability of any employee, agent, or contractor who may have access to Company Personal Data, ensuring that access is strictly limited to those individuals who need access as strictly necessary for the purposes of the Principal Agreement, and that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
4. Security
4.1 Processor shall implement and maintain technical and organizational security measures as described in Annex II (Technical and Organizational Measures) to protect Company Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, theft, alteration, or disclosure. These measures shall be appropriate to the risk and shall include, as appropriate, the measures referred to in Article 32(1) of the GDPR.
4.2 In assessing the appropriate level of security, Processor shall take into account the risks presented by Processing, in particular from a Personal Data Breach.
5. Subprocessing
5.1 Processor is authorized to use the sub-processors listed at vistaly.com/sub-processors (the "Sub-Processor List").
5.2 Processor shall provide the Company with at least fourteen (14) calendar days' prior written notice before engaging any new sub-processor not on the Sub-Processor List, including the name, location, and nature of processing. If the Company objects on legitimate data protection grounds within that period, the Parties shall negotiate in good faith for seven (7) working days. If no resolution is reached, the Company may terminate the affected Order Form upon written notice, and Vistaly shall refund a pro-rata portion of prepaid Fees for the unused remainder of the Term.
5.3 Processor shall ensure that each sub-processor is bound by data protection obligations at least as protective as those in this DPA. Processor shall remain liable for the acts and omissions of its sub-processors.
6. Data Subject Rights
6.1 Taking into account the nature of the Processing, Processor shall assist the Company by implementing appropriate technical and organizational measures for the fulfillment of the Company's obligations to respond to Data Subject requests under applicable Data Protection Laws.
6.2 Processor shall: (a) promptly notify the Company if it receives a request from a Data Subject; and (b) not respond to that request except on the Company's documented instructions or as required by applicable law (in which case Processor shall inform the Company before responding, to the extent permitted by law).
7. Personal Data Breach
7.1 Processor shall notify the Company without undue delay (and in any event within 72 hours) upon becoming aware of a Personal Data Breach affecting Company Personal Data, providing sufficient information for the Company to meet its obligations under Data Protection Laws.
7.2 Processor shall cooperate with the Company and take reasonable steps as directed by the Company to assist in the investigation, mitigation, and remediation of each Personal Data Breach.
8. Data Protection Impact Assessment
Processor shall provide reasonable assistance to the Company with data protection impact assessments and prior consultations with Supervisory Authorities required under Articles 35 or 36 of the GDPR (or equivalent provisions of other Data Protection Laws), solely in relation to Processing of Company Personal Data.
9. Deletion or Return of Company Personal Data
9.1 Upon termination or expiration of the Principal Agreement, the Company may export Company Personal Data for sixty (60) days as described in the data export provisions of the Principal Agreement (the "Export Period"). Processor shall delete all Company Personal Data from its live systems within thirty (30) days after the end of the Export Period, or within thirty (30) days after the Company's written request if the Company asks for deletion sooner, unless retention is required by applicable law. The Company's ability to export Company Personal Data during the Export Period constitutes the return of Company Personal Data for the purposes of this DPA.
9.2 Company Personal Data contained in Processor's encrypted backup recovery points cannot be selectively edited without compromising the integrity of the backup, and is therefore deleted on Processor's documented backup retention schedule rather than on demand — in each case within sixty (60) days of the corresponding deletion from Processor's live systems. Such data is isolated from ordinary processing, is not restored into the live service, and remains subject to the technical and organizational measures described in Annex II until it is deleted.
10. Audit Rights
10.1 Upon request and no more than once per year, Processor shall provide the Company with a copy of its most recent SOC 2 Type II report (or equivalent third-party audit report) covering the Services. If such report does not reasonably address the Company's data protection concerns, or in the event of a Personal Data Breach or reasonable evidence of non-compliance, the Company (or its designated independent auditor, subject to reasonable confidentiality obligations) may conduct an audit of Processor's processing activities with at least thirty (30) days' prior written notice. Audits shall be conducted during normal business hours and shall not unreasonably interfere with Processor's operations. The Company shall bear the costs of any such audit unless the audit reveals material non-compliance by Processor.
11. International Data Transfers
11.1 The Company acknowledges that Vistaly, Inc. is certified under the EU-U.S. Data Privacy Framework ("DPF"), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework, as administered by the U.S. Department of Commerce. Vistaly's current DPF certification can be verified at dataprivacyframework.gov. Transfers of Company Personal Data from the EEA, United Kingdom, or Switzerland to the United States shall be made in reliance on the DPF and the applicable adequacy decisions of the European Commission, UK Secretary of State, or Swiss Federal Council, as applicable.
11.2 In the event that the DPF (or any relevant adequacy decision) is invalidated, suspended, or otherwise ceases to provide a lawful basis for transfers of Company Personal Data, the Standard Contractual Clauses shall automatically apply to such transfers as follows:
(a) For transfers subject to the GDPR: Module Two (Controller to Processor) of the SCCs shall apply, with the Company as data exporter and Processor as data importer. For Clause 7, the optional docking clause shall apply. For Clause 9, Option 2 (general written authorization with 14-day notice) shall apply. For Clause 11, the optional language shall not apply. For Clause 17, the SCCs shall be governed by the laws of the EU Member State in which the Company is established. For Clause 18, disputes shall be resolved before the courts of the EU Member State in which the Company is established.
(b) For transfers subject to the UK GDPR: the UK Addendum to the EU SCCs shall apply, with its mandatory information Tables 1 to 4 completed as published at vistaly.com/uk-addendum, which is incorporated into this DPA by reference. For Clause 17, the laws of England and Wales shall apply, and for Clause 18, the courts of England and Wales, in each case in substitution for the elections in Section 11.2(a) above.
(c) For transfers subject to the Swiss FADP: the SCCs shall apply with the modifications required by the Swiss Federal Data Protection and Information Commissioner.
11.3 Processor shall maintain its DPF certification for the duration of this DPA. In the event Processor's DPF certification lapses or is withdrawn, Processor shall promptly notify the Company, and the SCCs shall apply as set forth in Section 11.2 above.
11.4 Processor shall conduct and document a transfer impact assessment where required by the SCCs (Clause 14) and shall implement supplementary measures as necessary to ensure an essentially equivalent level of protection for Company Personal Data.
12. General Terms
12.1 Confidentiality. Each Party must keep this DPA and information it receives about the other Party confidential. Where the Principal Agreement includes confidentiality obligations, those obligations shall apply to this DPA. Where the Principal Agreement does not include specific confidentiality obligations, each Party shall treat the other Party's Confidential Information with at least the same degree of care it uses to protect its own confidential information, but in no event less than reasonable care.
12.2 Notices. All notices under this DPA shall be given in accordance with the notice provisions of the Principal Agreement.
12.3 Limitation of Liability. The liability of the Processor under this DPA is subject to, and not in addition to, the limitations set forth in the Principal Agreement. Where the Principal Agreement provides for an Enhanced Cap applicable to data protection obligations, such Enhanced Cap shall apply to this DPA.
13. Governing Law and Jurisdiction
13.1 This DPA is governed by the laws of the Commonwealth of Virginia, USA; provided that, to the extent required by mandatory provisions of applicable Data Protection Laws, the relevant Data Protection Law shall apply.
13.2 Disputes under this DPA shall be resolved in accordance with the governing law and jurisdiction provisions of the Principal Agreement.
14. Amendments
14.1 This DPA may only be amended by written agreement of both Parties, except as set out in this Section 14.1. Such amendments will comply with applicable Data Protection Laws. Vistaly may update this DPA without the Company's agreement, upon thirty (30) days' written notice to the Company, where the update (a) is required by applicable Data Protection Laws or by a binding decision of a competent authority, or (b) does not reduce the protection this DPA gives to Company Personal Data. Any other update binds the Company only if the Company agrees to it in writing.
15. US State Privacy Laws
15.1 Application. This Section 15 applies to Company Personal Data that is subject to US State Privacy Laws. For such data: (a) the Company is a "business" or "controller" and the Processor is a "service provider" or "processor," as those terms are defined in the applicable US State Privacy Law, and references in this DPA to the Controller and the Processor shall be read accordingly; (b) "Personal Data" includes "personal information" and "personal data" as defined in the applicable US State Privacy Law, and "Data Subject" includes "consumer"; and (c) if this Section 15 conflicts with any other provision of this DPA, this Section 15 prevails.
15.2 Business Purpose. The Company discloses Company Personal Data to the Processor, and the Processor processes it, solely for the limited and specified business purposes of providing, securing, maintaining, and supporting the Services as described in the Principal Agreement and Annex I (the "Business Purposes").
15.3 Restrictions. The Processor shall not: (a) sell or share Company Personal Data, as "sell" and "share" are defined in the CCPA, or process it for targeted advertising; (b) retain, use, or disclose Company Personal Data for any purpose, including any commercial purpose, other than the Business Purposes or as otherwise permitted of a service provider or processor by US State Privacy Laws; (c) retain, use, or disclose Company Personal Data outside the direct business relationship between the Processor and the Company; or (d) combine Company Personal Data with personal information that the Processor receives from or on behalf of another person, or collects from its own interactions with the consumer, except as permitted of a service provider by US State Privacy Laws.
15.4 Compliance. The Processor shall comply with its obligations under US State Privacy Laws and shall provide Company Personal Data the same level of privacy protection as US State Privacy Laws require of the Company. The Processor shall notify the Company without undue delay if it determines that it can no longer meet its obligations under US State Privacy Laws.
15.5 Company Rights. The Company may, upon notice, take reasonable and appropriate steps (a) to ensure that the Processor uses Company Personal Data in a manner consistent with the Company's obligations under US State Privacy Laws, including through the information and assessments described in Section 15.8; and (b) to stop and remediate any unauthorized use of Company Personal Data, including by directing the Processor to cease the relevant Processing.
15.6 Consumer Requests. Section 6 applies to requests from consumers exercising their rights under US State Privacy Laws. The Company shall inform the Processor of any such request with which the Processor must comply, and the Processor shall comply with it as required of a service provider or processor.
15.7 Subprocessors. The Processor shall engage a subprocessor to process Company Personal Data only under a written contract that binds the subprocessor to obligations no less protective than those in this Section 15, and shall engage a new subprocessor only after giving the Company notice and an opportunity to object as set out in Section 5.2.
15.8 Information and Assessments. The Processor shall make available to the Company, upon reasonable request, the information in its possession necessary to demonstrate its compliance with US State Privacy Laws, and shall allow and cooperate with reasonable assessments by the Company or its designated assessor. The Processor may instead arrange for a qualified and independent assessor to assess its policies and technical and organizational measures against an appropriate and accepted control framework, and provide the Company with the resulting report as described in Section 10.1.
15.9 Deidentified Data. Where the Processor holds deidentified data derived from Company Personal Data, the Processor shall take reasonable measures to ensure that the data cannot be associated with a consumer or household, hereby publicly commits to maintain and use it only in deidentified form and not to attempt to reidentify it (except to test whether its deidentification processes meet the requirements of US State Privacy Laws), and shall contractually require any recipient of the data to do the same.
15.10 Confidentiality and Deletion. Sections 3 (Processor Personnel) and 9 (Deletion or Return of Company Personal Data) apply to Company Personal Data subject to US State Privacy Laws.
15.11 Certification. The Processor certifies that it understands the restrictions in this Section 15 and will comply with them.
Annex I — Description of Processing
| Element | Description |
|---|---|
| Subject Matter | Processing of Personal Data in connection with the provision of the Vistaly platform for organizing product strategy and customer feedback. |
| Duration | For the Term of the Principal Agreement, plus the Export Period and the deletion period in Section 9.1, plus the expiry of backup recovery points under Section 9.2 within sixty (60) days after deletion from live systems. |
| Nature and Purpose | Storage, organization, retrieval, and display of Company Personal Data as necessary to provide the Services; authentication and access management; product analytics on Usage Data, which carries user and account identifiers but from which Company Personal Data entered into the Services is suppressed, and which can be disabled per account; backup and disaster recovery. |
| Types of Personal Data | Name, email address, job title, profile photo, IP address, browser/device information, authentication credentials (hashed), and any Personal Data that Customer or Authorized Users input into the Services. |
| Categories of Data Subjects | Customer's employees, contractors, and agents who are Authorized Users; individuals whose Personal Data is included in Customer's Service Data (e.g., customer feedback participants, interviewees). |
| Data Exporter | The Company (Customer), acting as Controller. |
| Data Importer | Vistaly, Inc., acting as Processor. |
Annex II — Technical and Organizational Security Measures
| Measure | Description |
|---|---|
| Encryption | Data encrypted in transit (TLS 1.2+) and at rest (AES-256). Encryption keys are managed in AWS: the primary database is encrypted with an AWS Key Management Service key controlled by Vistaly, and other data stores use AWS server-side encryption. |
| Access Controls | Role-based access controls with principle of least privilege. Multi-factor authentication required for all employees with access to production systems. Access reviews conducted quarterly. |
| Network Security | Web application firewall (WAF) with managed rule sets and rate limiting in blocking mode, managed threat detection (Amazon GuardDuty), and network segmentation between production and non-production environments. Regular vulnerability scanning. |
| Data Backup & Recovery | Automated daily backups retained for 30 days, with monthly recovery points retained for 60 days. Backups are encrypted. Database and file-storage recovery points are also copied to a second AWS region in a separate, purpose-limited AWS account, and EU-hosted data is copied only to another EU region; other data stores are replicated to a second region and keep their recovery points in the source account and region. Recovery Point Objective (RPO): 24 hours. Recovery Time Objective (RTO): 12 hours. |
| Incident Management | Documented incident response plan with defined roles, escalation procedures, and post-incident review. Breach notification procedures aligned with 72-hour requirement. |
| Personnel Security | Background checks on employees with access to Personal Data. Mandatory security awareness training upon hire and annually thereafter. Confidentiality agreements for all personnel. |
| Physical Security | Cloud infrastructure hosted by Amazon Web Services (AWS) data centers that maintain ISO 27001, SOC 2 Type II, and SOC 3 certifications, among others. Vistaly does not maintain physical data center infrastructure; physical security controls — including facility access, surveillance, and environmental protections — are managed entirely by AWS in accordance with its compliance programs. |
| Business Continuity | Documented business continuity and disaster recovery plans. Redundant infrastructure to minimize single points of failure. |
| Vendor Management | Third-party risk assessments conducted before engaging sub-processors. Sub-processors required to maintain security standards at least as protective as those described herein. |
Acceptance
Self-serve customers: This DPA is accepted by using the Services. By creating an account or continuing to use the Services, Customer agrees to be bound by the terms of this DPA. No separate signature is required.
Enterprise customers: To execute this DPA as a standalone addendum, please contact legal@vistaly.com to request a countersigned copy.
This DPA is executed by the Parties' authorized representatives below and forms part of the Principal Agreement.
Execution
| Party | Name | Address |
|---|---|---|
| Vistaly | Vistaly, Inc. | 225A E Main Street, Charlottesville, VA 22902 |
| Customer |
Effective Date: