Data Processing Agreement
Terms under which VR Master s.r.o. processes personal data of the Client’s customers (Art. 28 GDPR).
1. Parties and subject
This agreement is concluded between the Client as controller and VR Master s.r.o. as processor (the “Processor”). It forms part of the Terms of Service and the Client accepts it by signing up.
The Processor processes personal data that the Client collects from its customers through the Platform, for example in campaigns and contests (photos, videos, names, emails, consents, answers).
Regular use of experiences does not require customers’ personal data: the camera image is processed only on the customer’s device and statistics are anonymous counts. This agreement therefore applies mainly to features where customers submit data themselves.
If the Client sets up a connection to its systems (webhook, Make, Zapier), the Platform sends contacts and comments to the address the Client entered, on the Client’s instruction. The Client is responsible for processing by that recipient. After delivery the Platform deletes the sent content from its queue; undelivered content is deleted within 14 days.
2. Scope of processing
| Item | Details |
|---|---|
| Data subjects | the Client’s customers, participants in campaigns and contests, people the Client sends a review link to |
| Categories of data | photo or video, name, email, phone, consents, submission time, form answers, name and text of project comments |
| Purpose | running a campaign or contest on the Client’s instructions |
| Duration | for the period the Client sets for the form in the project (30 to 730 days), then automatic deletion; the Client may delete the data earlier at any time |
| Location | European Union |
3. Processor obligations
- processes data only on the Client’s documented instructions, which are the settings in the Platform and this agreement,
- binds persons with access to data to confidentiality,
- implements appropriate technical and organisational measures: encryption in transit, role-based access, change logs, backups,
- assists the Client with data subject requests and obligations under Articles 32 to 36 GDPR,
- provides on request the information needed to demonstrate compliance with this agreement.
4. Sub-processors
The Client agrees to the sub-processors Hetzner Online GmbH (server), Cloudflare, Inc. (network and storage) and [missing: poskytovateľ e-mailov] (email). The Processor informs the Client of any new or replaced sub-processor at least 30 days in advance; the Client may object on reasonable grounds and terminate the agreement.
5. Personal data breach
The Processor notifies the Client of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, together with the information the Client needs to meet its obligations.
6. Termination
When processing ends, the Processor returns (exports) or deletes the data at the Client’s choice. Copies in backups expire in the regular backup cycle, within 30 days at the latest.
7. Audit
The Client may request the information needed to verify compliance. On-site audits are possible by agreement, with reasonable notice and at the Client’s expense.
Effective from 1.11.2026.
In case of conflict between language versions, the Slovak version prevails.