Business data processing agreement

Last updated: 17 October 2026.

This agreement governs personal data that a business customer instructs Vizu to process in its workspace. The processor is Phillip InfoSec, CVR 41892463, Sandbygårdvej 33, 1. tv, 2700 Brønshøj, Denmark (“Vizu”). The customer is the legal entity identified in the signed execution record (“Customer”). Contact [email protected] to complete and execute the agreement and annexes.

Execution and scope: This agreement becomes binding when authorized representatives of both parties accept this version and the completed annexes in a signed document or verified electronic execution record. The record must identify the parties, service account or workspaces, effective date, notification contacts and annexes. Reading this page, creating an account or accepting the privacy notice does not execute it. Business personal data must not be submitted before execution and verification of the safeguards for the selected scope. Any scope without the completed supplier and transfer arrangements remains unauthorized.

1. Roles, definitions and priority

“Customer Personal Data” means personal data processed on the Customer's behalf through the agreed Vizu workspace service. GDPR terms have their meaning under Regulation (EU) 2016/679. The Customer acts as controller or as a processor authorized by its controller to engage Vizu as a subprocessor; Vizu acts as processor or subprocessor accordingly. Where the Customer is a processor, it must identify its authority and ensure that its documented instructions and this agreement satisfy its controller's requirements.

Vizu's independent account administration, billing, support and security processing is outside Customer Personal Data's instructed-content scope and is described in the privacy notice. Separately consented campaign measurement uses only the consenting user's account activity metadata; it does not authorize Vizu to reuse instructed design content or other individuals' data. No service term reduces this agreement's data protection obligations. This agreement prevails over conflicting service terms for Customer Personal Data. A later amendment needs both parties' documented agreement; publishing a new version alone does not amend an executed agreement.

2. Processing and documented instructions

Vizu shall process Customer Personal Data only to supply the service and on the Customer's documented lawful instructions, including instructions concerning disclosure and transfers outside the EEA. The service agreement, completed Annex A, authorized workspace actions within that scope and verified written instructions constitute the instructions. Vizu shall not sell Customer Personal Data, use it to train its own AI models, or process it for an independent advertising purpose.

Where EU or Member State law applicable to Vizu requires other processing, Vizu shall inform the Customer of that requirement before processing unless that law prohibits notification on important public-interest grounds. Vizu shall immediately inform the Customer if an instruction appears to infringe GDPR or other EU or Member State data protection law, and shall suspend the affected instruction until a lawful instruction or required legal basis is established.

The Customer shall ensure its lawful basis, required notices and authority to submit the data and instruct Vizu. It shall identify authorized contacts and users, choose appropriate sharing and connected agents, and keep instructions within the agreed scope. Special-category or criminal-offence data, sensitive identification uses, new purposes and additional processing locations require a documented assessment, adequate safeguards and a written scope amendment before submission. Requested AI processing, including image generation, website analysis and ad composition, is included only if expressly authorized in the completed annexes.

3. Confidentiality and access

Vizu shall restrict access to persons who need it to provide, secure or support the instructed service. Before access, those persons shall be bound by enforceable confidentiality commitments or an appropriate statutory confidentiality duty. Access shall follow the agreed instructions, be reviewed when duties change and be removed when no longer required. Confidentiality continues after access or this agreement ends.

4. Security of processing

Vizu shall implement and maintain appropriate technical and organizational measures under GDPR Article 32, taking account of the processing, risks to individuals, available technology and implementation costs. The binding measures are documented in completed Annex B. They shall address confidentiality, integrity, availability and resilience, restoration after an incident, and regular assessment of effectiveness. Where appropriate to the agreed risks, they include encryption and pseudonymization.

The measures shall include workspace and asset access controls, protected authentication and secret management, separation between customers, restricted operator access, secure transport, safeguards for storage and recovery backups, controlled changes and patching, and an incident and rights-request process. Vizu shall provide the Customer with the actual deployment measures and relevant evidence before scope acceptance. Vizu may improve measures without reducing the agreed level of protection and shall inform the Customer of material changes that affect the agreed processing.

5. Subprocessors and international transfers

The Customer gives general written authorization only for the subprocessors and purposes identified in completed Annex C. Vizu shall perform appropriate checks before engagement, impose data protection obligations equivalent to this agreement on each subprocessor in a binding contract, verify sufficient guarantees for the agreed processing, and remain fully responsible to the Customer for that subprocessor's performance. Vizu shall maintain the current approved chain, including onward processors receiving Customer Personal Data, and supply relevant compliance information on request.

Vizu shall give at least 30 days' advance written notice to the verified Annex A notification contact before adding or replacing a subprocessor. The notice shall identify its legal entity, purpose, data, locations and relevant safeguards. The Customer may object on reasonable data protection grounds within that period. The parties shall seek a solution that avoids the disputed processing; Vizu shall not send affected data to the proposed subprocessor while a timely objection remains unresolved. If an agreed alternative cannot be provided, the Customer may terminate the affected processing without penalty and receive unused prepaid service fees for that affected scope, subject to mandatory law.

Vizu shall not transfer Customer Personal Data outside the EEA, or permit overseas access constituting a transfer, unless the Customer has authorized the destination and a valid GDPR Chapter V arrangement covers the actual entities, roles and processing. Completed Annex C shall identify that arrangement and access to its documentation. Where standard contractual clauses apply, the appropriate modules, annexes, assessment and supplementary measures must be completed separately. This Article 28 agreement is not an international-transfer instrument and does not itself establish provider acceptance or lawful transfer coverage. If safeguards cease to be effective, Vizu shall inform the Customer, stop affected transfers and agree corrective measures or termination of that scope.

6. Individual rights and controller assistance

Taking account of the processing, Vizu shall assist the Customer through appropriate technical and organizational measures to fulfill requests under GDPR Chapter III. Vizu shall forward a request concerning instructed Customer Personal Data to the verified Customer contact without undue delay, normally within five working days, and shall not independently answer on the Customer's behalf unless instructed or legally required. Vizu may handle requests about its own controller processing separately.

Vizu shall support identification, access, correction, restriction, return and erasure of the relevant data, including history and asset references, while protecting other individuals' information. Account exports require confirmation with a current password or a linked sign-in method for accounts without a password. Deletion receipts support applicable product actions; requests outside those actions use the verified support route. The Customer determines the response and lawful exceptions. Both parties shall verify request authority proportionately and avoid sending passwords or access credentials to support.

Taking account of the processing and information available to it, Vizu shall assist the Customer with security obligations, breach notifications, data protection impact assessments and prior consultation under Articles 32–36. It shall provide relevant processing, supplier, security and incident information in time for the Customer to meet its obligations. Operational arrangements in Annex B shall specify contacts and protected delivery; they must not prevent necessary statutory assistance.

7. Personal data breaches

Vizu shall notify the verified Customer incident contact without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It shall provide the nature of the breach, affected categories and approximate numbers where known, contact information, likely consequences and containment or proposed remedial measures. Where facts are incomplete, Vizu shall provide an initial notice and continuing updates without undue delay rather than wait for a complete investigation.

Vizu shall take reasonable measures to contain, investigate and remedy the incident, preserve narrowly necessary evidence, and assist the Customer's notifications to authorities and affected individuals. The Customer determines its own notification duties; neither a service term nor a support procedure extends a statutory deadline.

8. Compliance information and audits

Vizu shall make available all information necessary to demonstrate compliance with GDPR Article 28 and this agreement, including relevant measures, subprocessor arrangements and processing records. Vizu shall allow and contribute to audits and inspections by the Customer or an independent auditor it mandates. The parties shall agree practical timing, confidentiality and safeguards for other customers' data; ordinarily the Customer gives ten working days' notice. This does not restrict urgent incident checks, regulatory inspections or an audit needed to meet law.

Existing reports can reduce duplicate work where they meet the Customer's needs, but do not replace its right to a necessary audit or inspection. Vizu shall cooperate on findings and promptly address deficiencies. A confidentiality arrangement or scheduling process must not obstruct the Customer or competent authority in demonstrating compliance.

9. Duration, return and deletion

Processing lasts for the agreed service term and only for the authorized activities necessary to return or delete data afterward. The Customer may choose return or deletion and may change that choice in writing before processing ends. Unless its completed Annex A gives another lawful instruction, Vizu shall offer return through the account export or a verified protected delivery route, then delete Customer Personal Data and existing copies within 30 days after termination or a verified deletion instruction. Any shorter legal response deadline or agreed interval takes precedence.

Deletion includes live content, relevant design history, generation recovery content and assets that have no other lawful authorized reference. The Customer must identify shared content or another controller's instructions where deleting an account does not by itself erase personal data in a separately owned workspace. Vizu shall assist with those cases and communicate the scope; it shall not use shared references as a reason to retain unrelated copies.

Recovery backups shall remain access-restricted, be used only for recovery and expire within the verified lifetime in Annex B; the adopted database policy is seven days. Vizu shall reapply erasures before a restored system serves customers and shall cause authorized subprocessors to return or delete data under their applicable obligations. Vizu shall confirm completion and identify any pending cleanup. Only EU or Member State law requiring retention can justify keeping instructed-content copies after deletion; Vizu shall inform the Customer of the basis and duration unless prohibited and restrict further use accordingly.

The parties may suspend unlawful or inadequately safeguarded processing and terminate the affected scope if it cannot be corrected. Clauses concerning confidentiality, cooperation, audits necessary to verify completed processing, return and deletion remain effective until their obligations are fulfilled. Mandatory liabilities, authority powers and individuals' rights remain unaffected. Danish law applies to the extent permitted, without displacing mandatory data protection law.

Annex A — execution record and processing instructions

Complete and retain this annex with the accepted agreement version. The service operator verifies the representative's authority and countersigns or records its verified electronic acceptance before accepting business personal data.

Field	Required execution information
Customer and authority	Legal name, address, registration details, controller or authorized processor role; representative and authority; controller instruction evidence where applicable.
Associated agreement	Service terms version, designated service account/workspaces, agreement version, effective date and both parties' signatures or verified electronic acceptance.
Contacts	Verified instruction, rights and incident contacts; monitored email for subprocessor changes; replacement contact procedure.
Purpose and nature	Provide the customer's design workspace: receive, store, organize, revise, retrieve, render, share with authorized users/agents, export and delete. Specify whether separately approved image generation, website analysis or ad composition is included.
Data and individuals	Design text, comments, annotations, screenshots, images, fonts, asset metadata, submitted business and campaign information, website-analysis results, generated creatives and relevant author/access references; customer users, staff, collaborators, clients and people identified or depicted in lawful submitted content. Narrow the actual categories and exclude unsupported sensitive processing.
Duration and ending instruction	Service term; chosen return/deletion instruction and delivery route; agreed completion interval no longer than 30 days unless applicable law permits and the Customer expressly instructs otherwise.

Annex B — verified security and recovery measures

Product measures include workspace-scoped authorization, private asset access, salted password derivation, OS-keychain protection for desktop credentials, revision and document-integrity controls, and diagnostics that exclude customer content and credentials. Export/deletion routes require identity confirmation using a current password or a linked sign-in method for accounts without a password; deletion revokes access and provides a secret status receipt. Physical deletion failures remain pending until cleanup completes.

Before execution, attach the actual deployment's transport and storage/backup encryption, region and recovery-copy lifetime, operator access/MFA, confidentiality and support access, secret management, patch/change procedures, incident coverage, restoration test, erasure journal storage and rights-request delivery process. Record the actual supplier measures and evidence date. These deployment facts are execution requirements; this page does not claim an uninspected deployment already meets them. Agree suitable measures for the selected data and risks and prohibit processing while material measures remain unverified.

Annex C — approved processing chain and transfers

Before execution, attach each approved direct and onward legal entity's name, address/contact, purpose, data categories, country and overseas access locations, binding processing arrangement, and international-transfer mechanism where applicable. Only completed and approved entries authorize processing. The following suppliers identify the intended service chain, not a completed authorization:

Supplier	Intended purpose	Scope requiring approval
Railway Corporation	Application hosting and workspace database	European deployment, actual backup/support locations, contractual processing scope and verified security.
Hetzner Online GmbH	Private asset storage	Selected European country, versions/backups/support, contractual processing scope and verified security.
OpenRouter, Inc. and its actual approved onward AI provider entities	Optional requested image generation, website analysis and ad composition	US processing, actual onward legal entities and roles, logging/data-use/retention controls, binding processor/subprocessor coverage and Chapter V safeguards. This scope remains excluded until completed and expressly authorized.

Include any support or storage supplier receiving instructed content. Stripe's independent payment processing is not automatically a workspace subprocessor. Contact Vizu for the completed annexes and a copy of the agreement that you can retain.

Reference: GDPR, including Articles 28 and 32–36. This is Vizu's contract template rather than an unchanged Commission standard-clause instrument.