Data Processing Addendum

Last updated: 23 September 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Terms") between Linvex Solutions Limited, trading as Vyera ("Vyera", "we", "us"), and the customer that has accepted the Terms ("Customer", "you"). It applies where, and to the extent that, Vyera processes Customer Personal Data on your behalf in providing the Service.

Capitalised terms not defined in this DPA have the meanings given in the Terms.

1. Definitions

"Data Protection Laws" means the UK GDPR, the Data Protection Act 2018 and, where applicable to the processing, the EU GDPR and any other law relating to the protection of personal data.

"controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in Data Protection Laws.

"Customer Personal Data" means personal data contained in Customer Content that Vyera processes on your behalf.

"Subprocessor" means any third party, including any affiliate of Vyera, that Vyera engages to process Customer Personal Data.

2. Roles and scope

2.1 For Customer Personal Data, you are the controller (or, where you act on behalf of another controller, a processor) and Vyera is your processor (or subprocessor).

2.2 This DPA does not apply to personal data for which Vyera is a controller, including account, billing, usage and support data, and publicly available data that Vyera collects to operate the Service, such as public web pages, search results and public reviews. Vyera handles that data as described in its Privacy Policy.

2.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

3. Instructions

3.1 Vyera will process Customer Personal Data only on your documented instructions, unless required to do otherwise by law, in which case Vyera will tell you before processing unless that law prohibits it. Your documented instructions are the Terms, this DPA, your configuration and use of the Service (including the agents, integrations and automations you enable) and any other written instructions you give that are consistent with the Terms.

3.2 Vyera will tell you promptly if, in its opinion, an instruction infringes Data Protection Laws. Vyera is not required to check your instructions for legal compliance.

3.3 Vyera will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the Service, or combine it with personal data from other sources except as needed to provide the Service.

3.4 Vyera will not use Customer Personal Data to train generalised AI models, and will not permit its Subprocessors to do so.

4. Your obligations

You are responsible for the lawfulness of Customer Personal Data and your instructions, for having a lawful basis for the processing, for giving any notices and obtaining any consents required, and for your compliance with Data Protection Laws as controller. You must not submit the categories of data prohibited by clause 12.4 of the Terms.

5. Confidentiality

Vyera will ensure that every person it authorises to process Customer Personal Data is bound by a written or statutory duty of confidentiality and processes it only as needed to provide the Service.

6. Security

6.1 Vyera will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including those described in Annex 2.

6.2 Vyera may update those measures from time to time, provided that the updates do not materially reduce the overall protection of Customer Personal Data.

7. Subprocessors

7.1 You give Vyera general written authorisation to engage Subprocessors. Vyera's current list of Subprocessors, including each one's function and location, is available to you on request to support@vyera.ai, before and after you accept the Terms. The categories of Subprocessor are set out in Annex 3.

7.2 Vyera will engage each Subprocessor under a written contract that imposes data protection obligations no less protective than those in this DPA, and remains responsible to you for each Subprocessor's performance of those obligations.

7.3 Vyera will notify your account owner by email at least 30 days before adding or replacing a Subprocessor. Where a change is urgently needed for security or to keep the Service running, Vyera will give notice as soon as reasonably possible.

7.4 You may object to a new Subprocessor on reasonable data protection grounds within 14 days of notice. If Vyera cannot reasonably accommodate your objection, you may cancel the affected part of the Service or, if it cannot be separated, your subscription, with effect from the date the change takes effect. This is your sole remedy for the objection.

8. Data subject requests

Taking into account the nature of the processing, Vyera will assist you by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects to exercise their rights. If Vyera receives such a request about Customer Personal Data directly, it will pass it to you without undue delay and will not respond to it except to direct the data subject to you or as required by law.

9. Personal data breaches

9.1 Vyera will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notification will describe, so far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Vyera will provide further information as it becomes available and will take reasonable steps to contain the breach and limit its effects.

9.3 A notification is not an admission of fault or liability.

10. Assistance

Taking into account the nature of the processing and the information available to it, Vyera will provide reasonable assistance with your obligations under Articles 32 to 36 of the UK GDPR, covering security, breach notification, data protection impact assessments and prior consultation with regulators. Vyera may charge a reasonable fee for assistance that goes materially beyond what the Service ordinarily provides.

11. International transfers

11.1 You authorise Vyera and its Subprocessors to process Customer Personal Data outside the UK, provided that each restricted transfer is protected by a valid transfer mechanism under Data Protection Laws. These include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses and, where the recipient is certified, the UK Extension to the EU-US Data Privacy Framework.

11.2 Where the EU GDPR applies to your transfer of Customer Personal Data to Vyera, the transfer relies on the European Commission's adequacy decision for the United Kingdom. If that decision ceases to apply, the EU Standard Contractual Clauses (Module 2 where you are a controller, Module 3 where you are a processor) are incorporated into this DPA by reference, with the information in the Annexes to this DPA completing their appendices, Irish law as governing law, and the courts of Ireland as the chosen forum.

12. Audit

12.1 Vyera will make available the information reasonably necessary to demonstrate its compliance with this DPA. Vyera will first seek to meet audit requests through written responses to security questionnaires, documentation and any third-party reports or certifications it holds.

12.2 If that information is not sufficient, you, or an independent auditor bound by confidentiality who is not a competitor of Vyera, may audit Vyera's compliance with this DPA once in any 12-month period, on at least 30 days' written notice, during business hours, without disrupting the Service and without access to other customers' data. Each party bears its own costs. Additional audits may take place where a regulator requires one or following a personal data breach affecting Customer Personal Data.

13. Return and deletion

When the Terms end, you may export Customer Content during the 30-day window described in the Terms. Vyera will then delete Customer Personal Data within 30 days, and remove remaining copies from backups within 90 days, unless the law requires it to keep them. Vyera will confirm deletion in writing on request. Aggregated or anonymised data that does not identify any individual is outside this obligation.

14. Liability and precedence

14.1 Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms, except where Data Protection Laws do not allow liability to be limited.

14.2 If this DPA conflicts with the Terms in relation to the processing of personal data, this DPA prevails. If this DPA conflicts with any standard contractual clauses incorporated into it, those clauses prevail.

15. Term

This DPA takes effect when you accept the Terms and continues for as long as Vyera processes Customer Personal Data.

Annex 1: Details of processing

Subject matter. Provision of the Service to the Customer.

Duration. The term of the Terms, plus the export and deletion periods in section 13.

Nature and purpose. Hosting, storage, retrieval, analysis and AI-assisted generation of analysis, recommendations and content; publishing content to connected accounts on the Customer's instruction; support; security and service administration.

Categories of data subjects. The Customer's authorised users; the Customer's personnel, customers, prospects and other contacts whose personal data is contained in Customer Content; and any other individuals whose personal data the Customer chooses to include in Customer Content.

Types of personal data. Names, business contact details, job titles, professional information, content of messages and files, website and search performance data from connected accounts, and any other personal data the Customer chooses to include in Customer Content.

Special category data. None intended or permitted.

Frequency. Continuous for the duration of the Terms.

Annex 2: Technical and organisational security measures

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest, including databases, file storage and backups.
• Passwords stored using industry-standard one-way hashing; integration credentials and access tokens stored encrypted.
• Least-privilege access controls with role-based permissions and named individual accounts.
• Multi-factor authentication required for administrative and infrastructure access; two-factor authentication available to every customer user.
• Separation of production and non-production environments.
• Logging and monitoring of infrastructure activity, with audit trails of administrative actions and user-facing audit logs.
• Regular backups with defined retention and tested restoration.
• Timely application of security patches and dependency updates.
• Confidentiality obligations for all personnel, with access limited to what each role requires and revoked promptly on role change or departure.
• Protection against automated attacks and bot traffic at the network edge.
• A documented process for detecting, assessing and responding to security incidents and personal data breaches.

Annex 3: Categories of Subprocessor

The current named list is available on request under section 7.1.