Annex A - Details of Processing

Annex A – Details of Processing

This Annex A forms an integral part of the Data Processing Agreement (DPA) and describes the subject matter, nature, and scope of the processing of personal data carried out by SKVID on behalf of the Controller.

1. Subject matter of processing

The subject matter of the processing is the provision of the Velim platform and related communication, collaboration, and customer interaction services, as configured and used by the Controller.

2. Duration of processing

Personal data are processed for the duration of the contractual relationship between the Controller and SKVID and for as long as required to provide the Velim services, unless a longer retention period is required by applicable law or agreed otherwise.

3. Nature of processing

The processing activities may include, as applicable:

• collection and recording of personal data;
• organization and structuring of data;
• storage and retention;
• transmission and communication of data;
• access, retrieval, and consultation;
• deletion or anonymization upon termination of services.

4. Purpose of processing

Personal data are processed solely for the purpose of enabling the Controller to use the Velim platform, including:

• facilitating communications and interactions with end users;
• providing platform functionality requested by the Controller;
• ensuring system security, availability, and performance;
• providing technical support and maintenance.

5. Categories of data subjects

Depending on the Controller’s use of the Velim platform, data subjects may include:

• end users, customers, or clients of the Controller;
• employees, contractors, and representatives of the Controller;
• other individuals whose personal data are processed through the platform.

6. Categories of personal data

The categories of personal data processed may include:

• identification and contact data (e.g., name, email address, phone number);
• account and role information;
• authentication and security data (e.g., access credentials, IP addresses, device identifiers);
• service usage and technical data (e.g., timestamps, logs, interaction metadata);
• communications data processed on behalf of the Controller (e.g., messages, attachments, call metadata, tickets), where applicable.

SKVID does not determine the content of communications processed on behalf of the Controller.

7. Special categories of personal data

The Velim platform is not intended for the processing of special categories of personal data within the meaning of Article 9 of the GDPR. The Controller remains responsible for ensuring that such data are not processed unless appropriate safeguards and a valid legal basis are in place.

8. Processing location

Personal data are primarily processed within the European Economic Area (EEA). Where processing involves transfers outside the EEA, such transfers are carried out in accordance with the safeguards described in the DPA.

9. Security measures

The technical and organizational measures implemented by SKVID are described in the DPA and in the Data Protection Notice. These measures include encryption in transit and at rest, access controls, logging, monitoring, and incident response procedures.

This Annex A may be updated from time to time to reflect changes in the Velim services, provided that such updates do not materially reduce the level of protection afforded to personal data.