This data processing agreement (DPA) forms part of Varhugi's terms and applies automatically to every company that uses the service, regardless of subscription tier. It is made to satisfy the requirements of Article 28 of the General Data Protection Regulation (GDPR) and Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data for an agreement between controller and processor. Companies on the Pro tier or a custom agreement can request a signed copy via the Contact page.
1. Parties and roles
The processor is the operator of the Varhugi service as identified in section 1 of Varhugi's terms ("Varhugi"). The controller is the company that creates a workspace and uses the service for its staff ("the customer").
The customer is the controller of the personal data it enters into the service or has processed there, including data about its staff. Varhugi is the processor and processes the data only on the customer's behalf and in accordance with this agreement.
For the verification service of issued certificates Varhugi acts in a different role, see section 11.
2. Subject matter, nature and purpose of the processing
The processing consists of providing security-awareness training: maintaining staff lists and departments, assigning modules, sending invitations and reminders, recording quiz results, issuing certificates, receiving staff reports of suspicious messages, recording policy attestations and producing statistics and audit reports for the customer.
The processing lasts for as long as the customer has an active workspace, plus the deletion period under section 11.
3. Categories of data and data subjects
The following categories of personal data are processed:
- identity and organisation: name, email address, department, role and, where SCIM provisioning is used, identifiers from the customer's directory,
- training: assigned modules, progress, quiz results, issued certificates and records of leave from training,
- reports: staff reports of suspicious messages, including sender, subject line and whatever content the employee chooses to include,
- attestations: staff confirmations of company policies, with timestamp and IP address,
- technical records: sign-ins, administrator actions in the audit log, timestamps, IP addresses and browser type.
The data subjects are the customer's staff, administrators and department managers.
The service is not intended for special categories of personal data within the meaning of Article 9 GDPR and the customer shall not enter such data into it. The customer is responsible for the content its staff include in reports of suspicious messages.
4. Obligations of the controller
The customer is responsible for ensuring that:
- there is a legal basis for the processing and that it is authorised to register its staff in the service,
- data subjects are given the information about the processing that the law requires,
- its instructions to Varhugi are lawful,
- the information it enters is correct and up to date,
- and administrator access is limited to those who need it.
5. Instructions of the controller
Varhugi processes personal data only on the customer's documented instructions. Use of the service in accordance with the terms, settings in the dashboard and written requests count as such instructions.
If Varhugi considers that an instruction infringes data protection law, it informs the customer without delay and may suspend carrying it out until the matter is resolved.
Instructions that go beyond the ordinary functionality of the service are subject to agreement between the parties, and Varhugi may charge for the work involved.
6. Confidentiality
Everyone who processes personal data on Varhugi's behalf is bound by confidentiality, by contract or by law. Access to customer data is limited to those who need it to operate and support the system, and access by Varhugi staff to the production environment is logged.
7. Security of processing
Varhugi implements appropriate technical and organisational measures in accordance with Article 32 GDPR. These include encryption of data in transit (TLS) and at rest, role-based access control, separation of data between companies, least-privilege database access, rate limiting, an audit log of administrator actions and regular security updates. The measures are reviewed regularly having regard to the nature of the processing and the risk, and are described in more detail on Varhugi's security page.
8. Sub-processors
The customer gives general authorisation for the use of sub-processors. The current sub-processors are: Vercel (hosting and execution of the software and storage of issued certificates, Frankfurt), Neon (database, Frankfurt), Resend (email delivery), Stripe (payment processing, where a subscription is paid) and Upstash (cache for rate limiting and operational markers, Frankfurt). Each receives only the data its service requires and is bound by a data processing agreement with Varhugi.
Varhugi notifies customers of intended changes to the list 30 days in advance. The customer may object to a change on reasonable grounds before it takes effect; if no agreement is reached, either party may terminate the service without further obligation.
9. Assistance to the controller
Taking into account the nature of the processing and the information available to Varhugi, Varhugi assists the customer in responding to data subjects' requests for access, rectification, erasure and other rights under Chapter III GDPR and, where applicable, with data protection impact assessments and prior consultation with the supervisory authority. If Varhugi receives such a request directly from a data subject, it is referred to the customer unless it concerns certificates under section 11.
10. Notification of personal data breaches
If Varhugi becomes aware of a personal data breach affecting the customer's data, it notifies the customer's designated contact without undue delay and as a rule within 48 hours of becoming aware of it. The notification describes the nature of the breach, which data and individuals may be affected, the likely consequences and the measures taken, and is followed up as more becomes known. This enables the customer to meet its own obligation to notify the supervisory authority within 72 hours where applicable.
11. Deletion and return of data
When the service ends, the customer has 30 days to retrieve its data in a common machine-readable format. After that period, or earlier on request, Varhugi deletes the customer's personal data unless law requires longer retention, for example accounting legislation, or retention is necessary as evidence of the contractual relationship. Varhugi confirms the deletion in writing on request.
Issued certificates confirm the training of the individual and stay with that person even if they leave the customer or the customer stops using the service. The retention of certificates and the public verification page are a service to the certificate holder, for which Varhugi is an independent controller on the basis of its privacy policy. A certificate holder may request deletion of their certificates at any time, and the customer may request deletion on behalf of its staff when the service ends.
12. Audits and information
Varhugi provides the customer with the information reasonably required to demonstrate compliance with the obligations under Article 28 GDPR, including answers to written enquiries and Varhugi's security documentation.
The customer may request an audit, carried out by written enquiry or by an independent third party bound by confidentiality, with at least 30 days' notice and at most once a year, unless a personal data breach or a demand from a supervisory authority gives reason otherwise. An audit is at the customer's expense unless it reveals a material breach of this agreement by Varhugi. Audits take place during normal business hours and without disrupting service to other customers.
13. Transfers outside the EEA
The service's data is hosted within the European Economic Area. Some sub-processors are US companies, and any transfer of personal data outside the EEA, where it occurs, is based on the European Commission's Standard Contractual Clauses (SCC) or on the relevant party's participation in the EU-US Data Privacy Framework, in accordance with Varhugi's data processing agreement with each party.
14. Liability, term and precedence
This agreement applies for as long as Varhugi processes personal data for the customer. In the event of a conflict between this agreement and Varhugi's terms, this agreement prevails with respect to the processing of personal data.
The limitation of liability in Varhugi's terms also applies to this agreement as between the parties, to the extent permitted by law. It does not diminish the rights of data subjects under data protection legislation or liability that cannot be limited under mandatory law.
This agreement is governed by Icelandic law.