1.1. This DPA is between the vetman customer Organization as controller and Telvo LLC, ID 205218334, as processor.
1.2. It forms part of the Terms of Service and applies to personal data processed by Telvo LLC on the Organization's behalf to provide vetman.
1.3. Telvo LLC is a controller where it determines purposes and means, including account administration, security, billing and support, as described in the Privacy Policy.
1.4. Terms have the meaning given by the Georgian Law on Personal Data Protection. Each party will comply with data-protection law applicable to it.
2.1. The Organization instructs Telvo LLC to process data only under the Terms, this DPA, actions taken in the platform and additional written instructions.
2.2. Annex A describes the subject matter, duration, nature, purposes, data subjects and data.
2.3. If an instruction clearly breaches applicable law, Telvo LLC will inform the Organization and suspend it unless processing is legally required.
Telvo LLC will process only on documented instructions and not for a different purpose; limit access to personnel with a work need and confidentiality obligations; apply Annex B measures; reasonably assist with data-subject requests, security, incidents and assessments; provide reasonable compliance information; and act under section 8 at termination. It does not sell Organization data, use it for behavioural advertising or expose it to another Organization.
The Organization will ensure a lawful basis for processing and transfer; provide required notices and obtain consent where needed; give lawful and necessary instructions; manage permissions, sharing links and consultants; maintain accuracy; and avoid special-category human data unless it is necessary, lawful and suitably protected. It is responsible for the content and legal basis of SMS and email sent through the platform, including direct-marketing rules.
5.1. The Organization generally authorizes providers in the current Subprocessor List.
5.2. A subprocessor is bound in writing by materially corresponding data-protection obligations. Telvo LLC remains responsible to the Organization within the limits of law and the parties' agreement.
5.3. By this agreement the Organization gives general authorization to engage subprocessors as follows:
a) An essential subprocessor is a provider vetman cannot operate without (hosting, network and security, system email, backups), including the replacement of such a provider. Engaging or replacing one needs no separate consent. Telvo LLC updates the Subprocessor List and informs the Organization in the app or by email before the change, or, in an emergency (a security threat or the provider stopping its service), after it. If the Organization does not agree with the change, it may terminate the service.
b) An optional-feature subprocessor is used only for a feature the Organization turns on itself (for example SMS). Before the feature is turned on, Telvo LLC shows the provider's name and purpose; by turning the feature on, the Organization agrees to that provider's use. Once the feature is turned off, no more data is sent to that provider.
c) In both cases the requirements of 5.2 apply.
Telvo LLC forwards requests concerning Organization-controlled data without undue delay and does not answer substantively unless authorized or legally required. Considering the nature and available functions, it reasonably assists with locating, copying, correcting, blocking, restricting and deleting data. Some requests may require manual work.
7.1. Each party applies measures appropriate to category, volume, purpose and risk. The Organization is responsible for its devices, users and access settings; Telvo LLC for the platform components under its control.
7.2. On discovering an actual or suspected incident affecting Organization data, Telvo LLC begins assessment, containment, recovery and documentation; notifies the Organization without undue delay; and progressively provides available information on nature, likely scope, consequences, contact and measures.
7.3. The Organization decides and makes regulator and data-subject notifications as controller, unless law provides otherwise. Telvo LLC provides reasonable assistance.
8.1. This DPA applies while Telvo LLC processes data for the Organization.
8.2. At termination the Organization may request reasonable assistance returning available data or deletion through the contact page.
8.3. Deletion is completed within a reasonable period subject to law, technical feasibility and backup cycles. Legally retained data is not processed for another purpose.
9.1. Main application infrastructure is in DigitalOcean's Frankfurt region, Germany. Other locations are stated in the current Subprocessor List.
9.2. Transfers outside Georgia use a basis and safeguards permitted by applicable law. If they cannot be established for an optional function, that function must not be enabled for Organization data.
10.1. On written request, Telvo LLC provides reasonable available compliance information once per year. An additional review is permitted after a significant incident or regulator request.
10.2. On-site or technical review requires advance agreement, must protect security and other customers, and is limited to relevant evidence. The requester bears external cost unless a material breach is found.
We generally give at least 30 days' notice of a material DPA change and request renewed acceptance where needed. This DPA prevails over the Terms on Organization-data processing. The Georgian text prevails if the English translation is inconsistent.
| Item | Description |
|---|---|
| Subject | Provision of the vetman platform to the Organization |
| Duration | Service term plus the time needed for return, deletion, mandatory retention and backup cycles |
| Nature | Collection through the interface, organization, storage, search, display, alteration, document creation, instructed disclosure, backup and deletion |
| Purpose | Management functions for veterinary clinics, shops, shelters, pet hotels and related operations |
| Data subjects | Clients and representatives, staff, consultants, supplier contacts and others whose data the Organization lawfully enters |
| Data | Identification, contact, financial, activity and technical data, and information and files in animal-related records |
Animal health records are not human special-category data. If the Organization enters human special-category data in free text or files, it is responsible for necessity, legal basis and safeguards.
Current measures include HTTPS and HSTS; password hashing and password-quality checks; account and IP sign-in rate limits; 8-hour inactivity and 24-hour absolute session limits with Secure, HttpOnly, SameSite=Lax; role-based access, tenant filtering and restricted consultant access; authorization checks before file delivery; AES-256-GCM encryption for SMTP and SMS secrets; audit of significant writes, sign-ins, sharing-link openings and administrator impersonation; and database/file backups with changes first checked in a test environment.
Measures are reviewed as risk, technology and the service change. This Annex does not represent a planned measure as already implemented.
Text fingerprint: 1cdea7aa779640233c40bc108b0c58b5a7fa97acfaca7bf1c8afffa33c09c599
Legal documents ·
Back to the system