Data processing agreement

1. The processor

TechVector LTD, 52 Velcho Atanasov str., apt. 2, 1505 Sofia, Bulgaria, company ID (ЕИК) 206231368, VAT BG206231368. Contact for data protection: hello@techvector.bg.

2. What is processed, and why

• Purpose: running the service for you: interviewing your employees, reading the documents you add, and drawing your Company schema.
• People concerned: your employees and others you invite or name; the people in your account.
• Data: names, work roles and teams, work email addresses, what people say in their conversations, and the content of documents you add. Not intended: special categories of personal data (health, beliefs and the like); you agree not to ask for them.
• Duration: as long as your account exists, then deletion under section 9.

3. Your instructions

We process the data only on your documented instructions, which are these terms and how you use the service, unless the law requires otherwise; then we tell you first unless the law forbids it. We tell you if we think an instruction breaks data protection law.

4. Confidentiality

Everyone at TechVector LTD who can reach the data is bound to keep it confidential.

5. Security

We protect the data with measures suited to the risk, including: encrypted connections (HTTPS) everywhere; a server in the EU with a firewall and access by key only; each company’s data separated from every other’s in the application; passwords stored as hashes; nightly backups kept on the same server for 14 days; and access limited to the people who run the service.

6. Sub-processors

You authorise these sub-processors:

• Hetzner Online GmbH — Hosting: the server, the database and the backups. Finland (EU).
• Anthropic PBC — The AI model that asks the interview questions and reads the answers. United States; covered by Anthropic's data processing addendum with the EU Standard Contractual Clauses.

We bind each to data protection duties at least as strict as these. We tell you at least 14 days before adding or replacing one; you may object on reasonable grounds, and if we cannot meet the objection you may end the service. We stay responsible for our sub-processors.

7. Transfers outside the EU

The data is stored in the EU (Finland). The AI model is run by Anthropic in the United States; that transfer is covered by the EU Standard Contractual Clauses in Anthropic’s data processing addendum. Anthropic may not train its models on this data, and deletes it on its side within the period its commercial policy sets.

8. Helping you

We help you answer requests from the people concerned (access, correction, deletion and the rest), with security, with impact assessments (a DPIA template is available on request) and with consulting a supervisory authority. We tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach that affects your data, with what we know.

9. At the end

When your account closes, or earlier at your request, we delete the personal data within 30 days, or return it to you first if you ask, unless the law requires us to keep it. Backups roll over within 14 days after that.

10. Showing that we comply

We give you the information needed to show we meet these duties and allow audits by you or an auditor you appoint, with reasonable notice, at your cost, and no more than once a year unless a breach or an authority requires it.

11. Order of precedence

Where this agreement and the terms of service differ about personal data, this agreement applies.