Data Processing Agreement

Version 1.0 — effective 11 October 2026.

This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, our Terms of Service or any Master Services Agreement between you (the "Customer", the controller) and Računalniške storitve, Tadej Nitič s.p., registration number 9777300000, Štihova ulica 13, 1000 Ljubljana, Slovenia ("Nitech", the processor).

It takes effect when you accept the Terms and requires no signature. If your procurement process needs a signed counterpart, email info@nitech.si and we will countersign one.

1. Roles, and the honest scope of this DPA

For Customer Personal Data, the Customer is the controller and Nitech is the processor. Where the Customer is itself a processor for its own client — the agency case — Nitech is a subprocessor. For our own account, billing and security data we are a controller, governed by the Privacy Policy. Polar Software, Inc. is an independent controller of payment data as merchant of record, and that processing is outside this DPA.

Scope in practice. Vigil is a price-monitoring tool for products. The personal data it processes for a Customer is small and mostly incidental: the contact details of the Customer's own users, client name labels, and whatever personal data happens to appear on the public pages the Customer chooses to monitor or in the Customer's own store catalogue. The Customer must not use the Service to process special categories of personal data (Art. 9 GDPR), criminal offence data (Art. 10), or personal data of children.

2. Processing instructions

Nitech processes Customer Personal Data only on the Customer's documented instructions, including for transfers, unless EU or Member State law requires otherwise — in which case we inform the Customer first unless that law forbids it. The Terms, this DPA, and the Customer's configuration and use of the Service constitute the complete documented instructions. We will tell the Customer if, in our opinion, an instruction infringes data protection law, and may suspend the affected processing until it is amended or confirmed.

Nitech does not sell Customer Personal Data, use it for its own purposes, use it to train machine-learning models, or combine it with other sources except to produce aggregated, de-identified statistics that cannot be attributed to the Customer or any data subject.

3. Customer obligations

The Customer warrants that it has a lawful basis for the processing it instructs, has given any notice and obtained any consent required, and that its instructions comply with data protection law. The Customer is responsible for the accuracy of what it enters, the lawfulness of monitoring each URL it adds, who it gives share links to, and the security of its own credentials and its store's API credentials.

4. Confidentiality

Everyone authorised to process Customer Personal Data is bound by an appropriate obligation of confidentiality, is trained in their data protection responsibilities, and has access only to the extent their role requires.

5. Security

Nitech implements the technical and organisational measures in Annex II below, appropriate to the risk under Art. 32 GDPR, and may update them provided the level of protection is not reduced. Security is shared: the Customer is responsible for managing its own users, enabling two-factor authentication, controlling share links, scoping the API credentials it creates for its store, and revoking access it no longer needs.

6. Subprocessors

The Customer gives general written authorisation for Nitech to engage subprocessors. The current list is published here and forms Annex III. We give at least 30 days' notice before adding or replacing one. The Customer may object within that period on reasonable data-protection grounds, in writing with reasons; we will discuss it in good faith, and if we cannot offer a reasonable alternative the Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees. We impose on each subprocessor obligations no less protective than these, and remain fully liable for their performance.

7. International transfers

Customer Personal Data is stored in the European Union. Certain subprocessors are established in the United States. Those transfers are made under the Standard Contractual Clauses, Commission Implementing Decision (EU) 2021/914, Module Two or Module Three as applicable, incorporated by reference and completed as follows: Clause 7 (docking) applies; Clause 9 uses Option 2 with a 30-day notice period; the optional redress paragraph in Clause 11 does not apply; the competent supervisory authority is the Slovenian Information Commissioner; governing law is Slovenian and the forum is Ljubljana; and the SCC annexes are populated by the annexes below. For UK transfers the ICO's International Data Transfer Addendum applies; for Switzerland, references to the GDPR are read as references to the FADP.

8. Assistance

The Service gives the Customer direct access, correction, export and deletion capability. Where a data subject contacts us directly about Customer Personal Data, we do not respond substantively but forward the request to the Customer within 5 business days, and provide reasonable assistance at no charge for requests proportionate in volume. We also provide reasonable assistance with data protection impact assessments and prior consultation, and each party will notify the other without undue delay of any supervisory-authority communication about this processing.

9. Personal data breach

We notify the Customer of a personal data breach affecting Customer Personal Data without undue delay and in any event within 48 hours of becoming aware, describing what is known about the nature, scope, likely consequences, measures taken and a contact point, with further detail supplied in phases as established. We will not publicly identify the Customer as affected without consent unless legally required, and we assist with the Customer's own obligations under Arts. 33 and 34 GDPR. Notification is not an admission of liability.

10. Deletion and return

On termination, and at the Customer's choice, we delete or return Customer Personal Data. Data can be exported at any time during the term and for 30 days afterwards; after that we delete it from active systems within 30 days, and backup copies are overwritten on a rolling cycle not exceeding 30 days. We may retain data where law requires, only for as long as required, and will certify deletion in writing on request.

During the term, monitoring history is deleted after 6 months and snapshot files are kept only for the two most recent captures per monitored URL. Export anything you need to keep longer.

11. Audit

We make available all information reasonably necessary to demonstrate compliance with Art. 28 GDPR, including Annex II, the Privacy Policy and any third-party audit reports we hold. We do not currently hold a SOC 2 or ISO 27001 certification. If that information is insufficient, the Customer may audit — itself or through an independent auditor who is not a competitor and who signs a confidentiality undertaking — no more than once in any 12-month period, on 30 days' notice, during business hours, without unreasonable disruption, and limited to systems and documentation relevant to that Customer's data. Additional audits are permitted where a supervisory authority requires one or after a confirmed breach affecting the Customer. The Customer bears its own costs and reimburses ours, unless the audit reveals material non-compliance.

12. Liability, term and precedence

Liability under this DPA is subject to the limitations in the Terms or the Master Services Agreement, except where the GDPR does not permit them to be limited. Nothing displaces the direct rights of data subjects. This DPA applies for as long as we process Customer Personal Data. In case of conflict the order is: the Standard Contractual Clauses, this DPA, the Master Services Agreement, then the Terms of Service. It is governed by Slovenian law, with the courts of Ljubljana having exclusive jurisdiction. We may update it to reflect changes in law or the Service provided the protection afforded is not reduced, notifying material changes at least 30 days in advance.

Annex I — Description of the processing

Categories of data subjects: the Customer's own users and administrators; individuals recorded as a client label or share-link recipient; individuals whose personal data appears incidentally on a monitored public retail page; individuals identified in the Customer's own store catalogue data.

Categories of personal data: identity and contact data (name, email); account and authentication data (hashed password, hashed tokens, 2FA secret, role, login timestamps, lockout counters); technical data (IP address, user agent, request logs); business content (monitored companies, domains and URLs, client labels, own prices and floors, repricing rules, encrypted store credentials, catalogue data, audit logs); and incidental page content (screenshots, compressed HTML, extracted product data).

Sensitive data: none — the Customer must not submit special-category or criminal-offence data. Frequency: continuous, for the duration of the subscription. Nature and purpose: hosting, storage, retrieval, automated page capture and extraction, change detection, alerting, reporting, and — where the Customer enables it — automated writing of prices to the Customer's own store, solely to provide the Service. Duration: the subscription term plus the retention periods above; monitoring history is deleted after 6 months. Competent supervisory authority: Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, Slovenia.

Annex II — Technical and organisational measures

Access control and authentication. Argon2id password hashing, never plaintext; optional TOTP two-factor authentication; short-lived access tokens with rotating refresh tokens stored as hashes in httpOnly, SameSite cookies; automatic lockout after repeated failed logins; administrative functions separated into a distinct role and route namespace; least-privilege production access limited to named administrators.

Encryption. TLS on all production connections; store API credentials encrypted at rest with AES-256-GCM using a key held only in environment configuration; reset, refresh and share-link tokens stored only as hashes; encryption at rest at the database and object-storage layers.

Application security. Security headers, CORS restricted to our own origin, rate limiting on sensitive endpoints, schema validation of all request input, SSRF protection blocking private and internal address ranges and non-HTTP(S) schemes before any fetch, HMAC verification of webhook payloads, row-level security on every database table, and application-level authorisation on every route.

Segregation. Every record is scoped to a user id and every query filtered by it; production and development run in separate database projects with separate credentials.

Availability. Managed PostgreSQL with provider-operated automated backups and point-in-time recovery; object storage independent of container filesystems; a job queue with retry and idempotency for background processing.

Logging. Application and access logs retained for up to 30 days, including failed-login and rate-limit events.

Organisational. Confidentiality obligations for anyone with production access; data protection and security awareness training; documented subprocessor due diligence and written data processing agreements; an incident response process with the 48-hour notification commitment above.

Data minimisation. Card data is never received or stored; monitoring history is pruned after 6 months; snapshot files are kept only for the two most recent captures per URL.

Annex III — Subprocessors

The current list is maintained at /subprocessors and forms part of this DPA.

See also our Terms of Service, Privacy Policy and Subprocessors.