Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between MB "Wetapoint" (the “Processor”) and the customer organisation that subscribes to the Service (the “Controller”). It governs the processing of personal data we carry out on your behalf.

This DPA is incorporated into the agreement accepted by your authorised representative during registration or in an agreed order form; a website visit alone is not acceptance. It applies to personal data we process on your behalf under the EU GDPR, UK GDPR or other applicable data-protection law. It prevails over conflicting provisions of the Terms concerning that processing. The language rule in section 16 of the Terms also applies to this DPA.

1. Scope

Processing consists of collecting, recording, organising, storing, retrieving, transmitting, making available, securing, exporting, and deleting personal data as needed to provide account management, operational coordination, communications, location-enabled features, media handling, notifications, support, and security. Processing lasts for the subscription and the deletion periods stated in the Terms and Privacy Policy, unless law requires longer retention.

2. Processor obligations (Art. 28 GDPR)

• Process personal data only on your documented instructions (the Terms, your configuration of the Service, or additional written instructions), including for international transfers, unless law requires otherwise. Where legally permitted, we will inform you of that requirement before processing.
• Ensure authorised personnel are under an appropriate confidentiality obligation.
• Implement the technical and organisational security measures described in Section 7.
• Assist you in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection).
• Assist with your obligations under Articles 32–36 GDPR (security, breach notification, impact assessments).
• At termination, delete or return all personal data as you choose, except where retention is required by law.
• Inform you promptly if, in our opinion, an instruction infringes applicable data-protection law.

Optional features you switch on are part of your documented instructions. In particular, enabling Stream recording in your organisation's settings is your instruction to us to store the live video broadcasts your personnel make, and to keep them for the recording-retention period your plan carries. The feature is off until an administrator of your organisation turns it on. Switching it off stops new recordings; recordings already made are retained and expire on that schedule unless you delete them sooner.

3. Categories of data

• Identifiers (name, email, phone, role, organisation).
• Authentication data (password hash, MFA secret).
• Real-time location data (latitude, longitude, altitude, accuracy, heading, speed, network type, time recorded, related operation or event identifier(s), device identifier).
• Operational content (tasks, incidents, messages, push-to-talk radio transmissions, live video streams, camera feeds, media uploads).
• Stored video and audio recordings of live broadcasts, together with the location track captured during the broadcast and embedded in the recording — only where you enable Stream recording. That embedded track is retained with the recording and is not governed by the location-history retention you configure.
• Device and session telemetry (IP, user-agent, app version, device push tokens for APNs and Firebase Cloud Messaging).

Data subjects: your employees, contractors, volunteers, and other personnel who use the Service; other individuals whose data your personnel record in the system.

Where you enable Stream recording, a broadcast may also capture people who are not your personnel and who are present where your operator is filming. Informing recorded individuals and bystanders, establishing the lawful basis for recording them, handling their requests, and assessing whether the recording is lawful in the place it happens are your responsibilities as controller. The Service shows your broadcaster a recording indicator and shows viewers a recording badge; that is a signal inside the Service, not notice to anyone outside it.

4. Sub-processors

You grant us general authorisation to engage sub-processors for personal data processed on your behalf. Providers acting as independent controllers for their own purposes are not our sub-processors for that processing. Provider roles and the current list are published at /legal/subprocessors.

We will notify you at least 7 days before adding or replacing a sub-processor. You may object on reasonable data-protection grounds; if we cannot accommodate your objection, you may terminate with a pro-rated refund.

We remain responsible for the acts and omissions of our sub-processors as if they were our own and impose on each sub-processor, by contract, data-protection obligations that provide at least the same level of protection required by this DPA for the processing it performs.

5. International transfers

Primary processing of customer data takes place in the EEA. Where a sub-processor receives data through a restricted transfer, we require the applicable lawful safeguard in that provider's data-processing terms, such as an adequacy decision or recognised framework, or the European Commission's Standard Contractual Clauses. The UK Addendum and proportionate supplementary measures apply where required. Provider-specific destinations, safeguards and links to the relevant terms are described in the provider register. You may request information about the safeguards applicable to your data and a copy of them from privacy@wetapoint.com, subject to necessary redaction of confidential information.

6. Breach notification

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting your data. The notification will include the information required by Article 33(3) GDPR to the extent then available.

7. Security measures

We maintain measures appropriate to the risk, including access and confidentiality controls; protection of data in transit and where appropriate at rest; account and credential safeguards; separation of customer data; logging and monitoring; backup, restoration, and continuity controls; vulnerability and change management; incident response; personnel confidentiality; and periodic review of these measures. We may update the measures without materially reducing the overall level of protection.

We do not currently hold a third-party security certification (SOC 2, ISO 27001 or equivalent). If that changes we will say so on this page and link the relevant report.

8. Audits

We will make available the information necessary to demonstrate compliance with this DPA. The standard route is a proportionate written security questionnaire covering the measures in section 7, which we will answer on reasonable written notice.

In addition, you (or an independent auditor you mandate, provided it is not a competitor of ours and is bound by confidentiality) may conduct audits, including inspections, where required by applicable data-protection law. Audits are subject to reasonable prior written notice, confidentiality undertakings, and normal business hours; they normally take place at most once per 12 months, but that limit and the notice arrangements do not prevent an audit required by law, a supervisory authority, a breach affecting your data, or reasonable evidence of material non-compliance. If excluding a competitor would prevent a legally required audit, we will agree appropriate confidentiality safeguards instead. You bear the reasonable costs of audits you initiate, except to the extent mandatory law requires otherwise.

9. Return / deletion at termination

At the end of our processing services, you choose whether we return your personal data and delete remaining copies, or delete it without return, except where law requires storage. Send instructions to the data-protection contact below. The ordinary retrieval period is 30 calendar days after workspace termination or deactivation, using available in-product tools and assisted export where necessary. For provider switching, section 9a of the Terms applies: the retrieval period runs for 30 calendar days after the transition, and closure must be coordinated accordingly. Without different documented instructions, we make the data available for return during that period and then delete it from primary storage. We retain only records for which we have a separate lawful basis as controller, as explained in the Privacy Policy; that does not authorise retention of workspace content for our own purposes. The retained audit records are pseudonymised, not anonymised: identifiers are removed from them on the categorised schedule described in the Privacy Policy, and the records are used only for security investigations, compliance with applicable law, and the establishment, exercise or defence of legal claims. Copies in encrypted off-site backups age out on the rolling snapshot schedule described in the Privacy Policy (up to approximately six months) and are not restored except for disaster recovery. If a backup is restored, our retention and deletion processes are re-applied to the restored data.

During the subscription, removal of individual users follows the layered model in the Privacy Policy: disabling a user revokes access immediately without deleting historical activity; deleting a user's profile removes profile data while content contributed to your workspace remains under your retention instructions and may be displayed as contributed by a deleted user. For workspace content you remain the controller and we delete it on your documented instructions; we act as controller only for our own account, billing, and platform-security records.

10. Liability

Each party's liability under this DPA is subject to the limitations in the Terms of Service to the extent lawful. Neither those limitations nor this DPA restrict a data subject's rights under Article 82 GDPR, the powers of a supervisory authority, or any liability that applicable law does not permit the parties to limit.

11. Contact

Data Protection contact: privacy@wetapoint.com.
MB "Wetapoint", Papiškių g. 19-1, LT-06282 Vilnius, Lithuania.