Data Processing Agreement

Standard contractual framework

Vigatra provides a standard GDPR Article 28 Data Processing Agreement that establishes Vigatra as your firm's Data Processor and your firm as the Data Controller. The DPA addresses:

• ✓Scope and subject matter — what data Vigatra processes on your behalf and for what purpose
• ✓Confidentiality obligations — Vigatra personnel are bound by confidentiality and may not access customer data without authorization
• ✓Security measures — encryption (AES-256-GCM), access controls, monitoring, incident response
• ✓Sub-processors — disclosed in advance with right to object (current list on the security page)
• ✓Data-subject requests — Vigatra's assistance obligations when employees exercise GDPR/CCPA rights
• ✓Breach notification — within 72 hours of awareness, as required by GDPR Article 33
• ✓International data transfers — Standard Contractual Clauses (SCCs) for EU→US transfers
• ✓Data return / deletion — at contract end, options to export or delete all customer data within 90 days
• ✓Audit rights — annual right to audit Vigatra's information-security controls (reasonable notice required)