{"id":3230,"date":"2026-10-27T15:03:26","date_gmt":"2026-10-27T13:03:26","guid":{"rendered":"https:\/\/vits.ee\/?page_id=3230"},"modified":"2026-11-02T10:35:17","modified_gmt":"2026-11-02T08:35:17","slug":"terms-of-use","status":"publish","type":"page","link":"https:\/\/vits.ee\/en\/terms-of-use\/","title":{"rendered":"Terms of Use and Data Processing Terms"},"content":{"rendered":"<div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-1 fusion-flex-container nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1248px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-0 fusion_builder_column_1_1 1_1 fusion-flex-column\" style=\"--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:1.92%;--awb-margin-bottom-large:0px;--awb-spacing-left-large:1.92%;--awb-width-medium:100%;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\"><div class=\"fusion-column-wrapper fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-text fusion-text-1\"><style>.vits-legal h2{font-size:28px;line-height:1.25;margin:44px 0 20px}.vits-legal h3{font-size:22px;line-height:1.3;margin:32px 0 14px}.vits-legal h4{font-size:18px;line-height:1.35;margin:24px 0 10px;color:inherit}.vits-legal ul{margin:0 0 20px}.vits-legal [id]{scroll-margin-top:120px}.vits-legal-table{overflow-x:auto;margin:0 0 24px}.vits-legal-table table{width:100%;border-collapse:collapse;font-size:15px}.vits-legal-table th,.vits-legal-table td{border:1px solid #d9dde3;padding:8px 10px;vertical-align:top;text-align:left}.vits-legal-table th{background:#f3f5f8}<\/style>\n<div class=\"vits-legal\">\n<p><strong>Version 1.0<\/strong> \u00b7 Effective from 1 November 2026<\/p>\n<h2 id=\"terms-of-use\">Part I. Terms of Use<\/h2>\n<h3 id=\"clause-1\">1. General provisions and definitions<\/h3>\n<p><strong>1.1.<\/strong> These terms of use and data processing terms (the \u201cTerms\u201d) govern the use of the workplace safety and working environment management software of VITS solutions Eesti O\u00dc (registry code 16549739, address L. Koidula tn 16, 90502 Haapsalu, Estonia, e-mail info@vits.ee; \u201cVITS\u201d) and the processing of personal data that VITS carries out on behalf of the Customer when the software is used.<\/p>\n<p><strong>1.2.<\/strong> The Terms constitute an agreement between VITS and the Customer (the \u201cAgreement\u201d). If the Customer and VITS have concluded a Service Agreement, the Terms apply only to the extent that the Service Agreement refers to them. In matters concerning the processing of personal data, Part II of the Terms prevails over Part I.<\/p>\n<p><strong>1.3.<\/strong> The Platform is offered only to legal persons and institutions in the course of their economic or professional activities. Rights provided for consumers, including the right of withdrawal, do not apply to the Agreement.<\/p>\n<p><strong>1.4.<\/strong> The following definitions are used in the Terms:<\/p>\n<ul>\n<li><strong>Platform<\/strong> \u2013 VITS&#8217;s web-based workplace safety and working environment management software provided as a service (SaaS), including the employee portal and the mobile application.<\/li>\n<li><strong>Customer<\/strong> \u2013 a legal person or institution that uses the Platform under the Agreement.<\/li>\n<li><strong>Account<\/strong> \u2013 a separate environment opened in the Platform for one Customer.<\/li>\n<li><strong>User<\/strong> \u2013 a natural person who has been given access to an Account. A <strong>Main User<\/strong> is a User who has administrator rights on the Account.<\/li>\n<li><strong>Employee<\/strong> \u2013 an employee of the Customer or another person whose data the Customer processes in the Platform, including a user of the employee portal and the mobile application.<\/li>\n<li><strong>Customer Data<\/strong> \u2013 data that the Customer, Users or Employees enter into the Platform or that is generated through the use of the Platform, including personal data.<\/li>\n<li><strong>Trial Period<\/strong> \u2013 a free period beginning with the creation of the Account, intended for testing the Platform (clause 4).<\/li>\n<li><strong>Service Agreement<\/strong> \u2013 a separate agreement concluded between VITS and the Customer for the paid use of the Platform.<\/li>\n<li><strong>Party<\/strong> \u2013 VITS or the Customer, together the <strong>Parties<\/strong>.<\/li>\n<\/ul>\n<p><strong>1.5.<\/strong> If the Customer uses the Platform through a partner of VITS (the \u201cPartner\u201d) and the Partner has ordered the Customer&#8217;s Account from VITS, the provisions on the Trial Period (clause 3.1, Chapter 4, clause 10.1 and clauses 11.2\u201311.5) do not apply, regardless of whether the Account was opened by the Customer or by the Partner. In that case, the Customer accepts the Terms through the Partner. The Customer may use the Platform for as long as the Partner has ordered the Account from VITS, and the scope of the right of use and the fees are agreed between the Customer and the Partner. VITS treats the Partner&#8217;s instructions concerning the Account as instructions of the Customer until the Customer notifies VITS otherwise.<\/p>\n<p><strong>1.6.<\/strong> VITS is liable to a Customer using the Platform through a Partner only for damage caused intentionally or through gross negligence. This does not limit liability under Article 82 of the General Data Protection Regulation. If the Partner closes the Account and the Customer does not conclude a Service Agreement with VITS, the Account is locked and VITS shall, at the Customer&#8217;s request, provide the Customer with its data and shall delete the data within 35 days after the Account is closed.<\/p>\n<h3 id=\"clause-2\">2. Conclusion of the Agreement, Account and Users<\/h3>\n<p><strong>2.1.<\/strong> The Agreement enters into force when the Customer accepts the Terms upon creating the Account by ticking the mandatory checkbox, or in the manner set out in clause 1.5. The person accepting the Terms on behalf of the Customer confirms that they are authorised to represent the Customer.<\/p>\n<p><strong>2.2.<\/strong> VITS may refuse to open an Account or suspend the use of an Account for good reason.<\/p>\n<p><strong>2.3.<\/strong> One Account is intended for one legal person.<\/p>\n<p><strong>2.4.<\/strong> The Main User grants and removes the rights of Users. The Customer shall ensure that Users have access only to the data they need and that the access of persons who have left is removed without delay.<\/p>\n<p><strong>2.5.<\/strong> A user account is personal and must not be shared with others. Users shall keep their login credentials confidential. VITS recommends using the two-factor authentication offered in the Platform.<\/p>\n<p><strong>2.6.<\/strong> The Customer shall notify VITS without delay if it suspects that an unauthorised person has gained access to its Account. The Customer is responsible for the actions performed on the Account by its Users.<\/p>\n<p><strong>2.7.<\/strong> The Customer shall keep its own contact details and those of the Main User on the Account up to date, as VITS sends notices relating to the Agreement to them.<\/p>\n<h3 id=\"clause-3\">3. Content and availability of the service<\/h3>\n<p><strong>3.1.<\/strong> VITS grants the Customer a non-exclusive licence to use the Platform for testing purposes during the Trial Period.<\/p>\n<p><strong>3.2.<\/strong> VITS continuously develops the Platform and may add, change or replace functionality.<\/p>\n<p><strong>3.3.<\/strong> During the Trial Period, the Platform is provided as is. VITS does not guarantee that the Platform will operate without interruption or errors.<\/p>\n<p><strong>3.4.<\/strong> The Platform is a work tool. Its use does not replace the employer&#8217;s obligations under the Occupational Health and Safety Act and other legislation, nor the assessment of a competent person. The samples and templates in the Platform are general, and the Customer shall adapt them to its own working environment.<\/p>\n<p><strong>3.5.<\/strong> The Customer is responsible for the correctness of the content of documents prepared in the Platform and for their use.<\/p>\n<h3 id=\"clause-4\">4. Trial Period<\/h3>\n<p><strong>4.1.<\/strong> Upon creating the Account, the Customer receives a free Trial Period of 30 days. VITS may extend the Trial Period at the Customer&#8217;s request. The Customer shall submit the request to VITS in writing via the chat window of the Platform.<\/p>\n<p><strong>4.2.<\/strong> During the Trial Period, all functionality of the Platform is available, including features based on artificial intelligence. Some integrations and additional features (e.g. single sign-on and the interface with an occupational health service provider) are enabled by VITS at the Customer&#8217;s request.<\/p>\n<p><strong>4.3.<\/strong> The Trial Period is free of charge and does not automatically become paid. Paid use begins when the Customer and VITS conclude a Service Agreement and a data processing agreement.<\/p>\n<p><strong>4.4.<\/strong> VITS may terminate the Trial Period early by notifying the Customer by e-mail, in particular if the Account is used in breach of the Terms.<\/p>\n<p><strong>4.5.<\/strong> The functionality available after the Trial Period is agreed in the Service Agreement and may differ from the functionality used during the Trial Period.<\/p>\n<p><strong>4.6.<\/strong> VITS recommends using sample data, or only the data needed for testing, during the Trial Period. During the Trial Period, the Customer shall not enter health data or personal identification codes unless this is strictly necessary for testing. Health data and personal identification codes shall not be entered into features based on artificial intelligence, even for testing (clause 19.3).<\/p>\n<p><strong>4.7.<\/strong> The Trial Period may also take place in a separate trial environment of VITS. Data from that environment is not transferred when a Service Agreement is concluded and is deleted in accordance with clause 11.4.<\/p>\n<h3 id=\"clause-5\">5. Customer&#8217;s obligations and permitted use<\/h3>\n<p><strong>5.1.<\/strong> The Customer shall use the Platform in accordance with the law and the Terms. The Customer shall not:<\/p>\n<ul>\n<li>copy, modify or reverse engineer the Platform or create derivative works based on it;<\/li>\n<li>resell the right to use the Platform or make the Platform available to third parties;<\/li>\n<li>attempt to access the data of other customers or parts of the Platform to which it has no right;<\/li>\n<li>load the Platform in a way that disrupts its operation, including by making automated bulk requests without the permission of VITS;<\/li>\n<li>upload malware or unlawful content to the Platform.<\/li>\n<\/ul>\n<p><strong>5.2.<\/strong> The Customer is the controller of the personal data processed in the Platform. The Customer&#8217;s obligations in processing personal data are set out in Part II of the Terms.<\/p>\n<p><strong>5.3.<\/strong> The Customer is responsible for the correctness of the data entered into the Platform and for having the right to use the documents and other content uploaded to the Platform.<\/p>\n<p><strong>5.4.<\/strong> The Customer shall ensure that Users and Employees comply with the Terms.<\/p>\n<h3 id=\"clause-6\">6. User support<\/h3>\n<p><strong>6.1.<\/strong> VITS shall provide user support to Users on working days from 9:00 to 17:00 via the chat window of the Platform and by e-mail (info@vits.ee), and shall respond to each request within one working day at the latest.<\/p>\n<p><strong>6.2.<\/strong> User support covers advice on using the Platform and the resolution of errors in the Platform. Training of Users and entering Customer Data are not part of user support.<\/p>\n<p><strong>6.3.<\/strong> To resolve a request, VITS employees may access the Customer&#8217;s Account to the extent necessary for that purpose.<\/p>\n<h3 id=\"clause-7\">7. Customer Data and confidentiality<\/h3>\n<p><strong>7.1.<\/strong> Customer Data belongs to the Customer. VITS shall use Customer Data only to perform the Agreement.<\/p>\n<p><strong>7.2.<\/strong> In the processing of personal data, the Customer is the controller and VITS is the processor. VITS processes personal data in accordance with Part II of the Terms.<\/p>\n<p><strong>7.3.<\/strong> VITS may use anonymised and aggregated data from which neither the Customer nor any individual can be identified for developing the Platform, for statistics and for ensuring security. VITS shall not use the Customer&#8217;s personal data to train artificial intelligence models.<\/p>\n<p><strong>7.4.<\/strong> The Parties shall keep confidential the other Party&#8217;s trade secrets and any non-public information that has become known to them in the performance of the Agreement. This obligation applies during the term of the Agreement and for 3 years after its termination, and without time limit with regard to personal data.<\/p>\n<p><strong>7.5.<\/strong> The confidentiality obligation does not apply to publicly available information or to information whose disclosure is required by law.<\/p>\n<h3 id=\"clause-8\">8. Intellectual property<\/h3>\n<p><strong>8.1.<\/strong> All rights to the Platform, including the software, design, databases and content created by VITS (e.g. sample documents and instruction templates), belong to VITS or its licensors. The Agreement does not grant the Customer any rights other than those set out in clauses 1.5 and 3.1.<\/p>\n<p><strong>8.2.<\/strong> Content created by the Customer and Customer Data belong to the Customer. For the term of the Agreement, the Customer grants VITS the right to use such content to the extent necessary for providing the Platform service.<\/p>\n<p><strong>8.3.<\/strong> VITS may use the Customer&#8217;s feedback and development suggestions free of charge to develop the Platform.<\/p>\n<h3 id=\"clause-9\">9. Third-party services, integrations and artificial intelligence<\/h3>\n<p><strong>9.1.<\/strong> The Customer may connect the Platform to third-party services, e.g. an HR system, the information system of an occupational health service provider, a document archive or a single sign-on (SSO) service. A third-party service is subject to the terms of that service. VITS is not responsible for the operation of a third-party service.<\/p>\n<p><strong>9.2.<\/strong> The Customer may add third-party videos and links (e.g. YouTube, Vimeo) to content in the Platform. Viewing them is subject to the terms and privacy policies of the respective service.<\/p>\n<p><strong>9.3.<\/strong> The features of the Platform based on artificial intelligence (e.g. drafting and translating instructions) are optional and are not needed for using the core functions of the Platform. They use the language model of an external service provider. When such a feature is used, the text, files and images submitted to the feature are transmitted to the service provider. Sub-processors are listed in Annex 3.<\/p>\n<p><strong>9.4.<\/strong> Output generated by artificial intelligence may contain errors. The Customer shall have the output reviewed by a competent person before use and is responsible for its use.<\/p>\n<p><strong>9.5.<\/strong> Transactions on the course marketplace are subject to the terms displayed at the time of purchase.<\/p>\n<h3 id=\"clause-10\">10. Liability<\/h3>\n<p><strong>10.1.<\/strong> As the Trial Period is free of charge, VITS is liable during the Trial Period only for damage caused intentionally or through gross negligence. This does not limit liability under Article 82 of the General Data Protection Regulation.<\/p>\n<p><strong>10.2.<\/strong> VITS is not liable for damage arising from data entered by the Customer, from the actions of the Customer or Users, from the content of documents prepared in the Platform (clause 3.5) or from third-party services (clause 9).<\/p>\n<p><strong>10.3.<\/strong> A Party is not liable for a breach of an obligation caused by force majeure, meaning a circumstance that the Party could not influence or reasonably foresee (e.g. a natural disaster, military action, a large-scale cyberattack, or an outage of electricity, communications or cloud services). The Party shall notify the other Party of it without delay.<\/p>\n<h3 id=\"clause-11\">11. Suspension of the Account and end of the Trial Period<\/h3>\n<p><strong>11.1.<\/strong> VITS may temporarily suspend access to the Account or a User&#8217;s access if a User breaches clause 5 or endangers the security of the Platform, or if required by law or by a public authority. VITS shall give advance notice of the suspension, except in the case of an urgent security threat. Customer Data is retained during the suspension.<\/p>\n<p><strong>11.2.<\/strong> If no Service Agreement is concluded, the Agreement terminates at the end of the Trial Period and the Account is locked. The Data Processing Terms remain in force until the data is deleted.<\/p>\n<p><strong>11.3.<\/strong> During the Trial Period, the Customer can export data via the reports of the Platform. After the end of the Trial Period, VITS shall provide the Customer Data at the Customer&#8217;s request in a machine-readable format (e.g. XLSX or CSV), together with the files uploaded by the Customer, until the data is deleted.<\/p>\n<p><strong>11.4.<\/strong> VITS shall delete the locked Account and the Customer Data within 35 days after the end of the Trial Period. At the Customer&#8217;s request, VITS shall delete the data earlier.<\/p>\n<p><strong>11.5.<\/strong> If the Customer concludes a Service Agreement, the data entered during the Trial Period remains on the Account, and its processing is governed by the Service Agreement and the data processing agreement. This does not apply to the environment referred to in clause 4.7.<\/p>\n<h3 id=\"clause-12\">12. Amendment of the Terms and final provisions<\/h3>\n<p><strong>12.1.<\/strong> VITS may amend the Terms by notifying the Customer of the amendment by e-mail or in the Platform at least 30 days in advance. In the case of a material amendment that is unfavourable to the Customer, the Customer may terminate the Agreement with effect from the date on which the amendment enters into force. Continued use of the Platform after the amendment enters into force is deemed acceptance of the amendment. Changes of sub-processors are governed by clause 16.<\/p>\n<p><strong>12.2.<\/strong> The Terms in force are published on the VITS website together with their version and effective date.<\/p>\n<p><strong>12.3.<\/strong> The Customer may not transfer the rights and obligations arising from the Agreement without the written consent of VITS. VITS may transfer the Agreement to an acquirer of the Platform or of its business by notifying the Customer thereof.<\/p>\n<p><strong>12.4.<\/strong> Notices are sent by e-mail: to VITS at info@vits.ee and to the Customer at the e-mail address of the Main User indicated on the Account.<\/p>\n<p><strong>12.5.<\/strong> The Agreement is governed by Estonian law. Disputes are resolved by negotiation and, failing agreement, in Harju County Court.<\/p>\n<p><strong>12.6.<\/strong> If any provision of the Agreement proves to be invalid, this does not affect the validity of the remaining provisions.<\/p>\n<p><strong>12.7.<\/strong> The Terms enter into force on 1 November 2026.<\/p>\n<h2 id=\"data-processing-terms\">Part II. Data Processing Terms<\/h2>\n<h3 id=\"clause-13\">13. Subject matter and roles<\/h3>\n<p><strong>13.1.<\/strong> Part II of the Terms (the \u201cData Processing Terms\u201d) governs the processing of personal data that VITS carries out on behalf of the Customer in providing the Platform service. The Customer is the controller and VITS is the processor within the meaning of Article 28 of the General Data Protection Regulation (EU) 2016\/679 (the \u201cGDPR\u201d).<\/p>\n<p><strong>13.2.<\/strong> The Data Processing Terms do not apply to personal data that VITS processes as a controller: the contact details of the Customer&#8217;s contact persons and of Users for managing the customer relationship, invoicing and notifications, and the IP addresses of network traffic identified as attacks, which VITS transmits to the joint controller CrowdSec SAS (France) to protect its servers. The processing of such data is described in the VITS privacy policy.<\/p>\n<p><strong>13.3.<\/strong> The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1. VITS processes personal data during the term of the Agreement and thereafter in accordance with clause 20.<\/p>\n<p><strong>13.4.<\/strong> The Data Processing Terms remain in force for as long as VITS processes Customer Data, including after the termination of the Agreement until the data is deleted. If the Customer and VITS conclude a separate data processing agreement, it replaces the Data Processing Terms.<\/p>\n<h3 id=\"clause-14\">14. Obligations of VITS<\/h3>\n<p><strong>14.1.<\/strong> VITS shall process personal data only on the documented instructions of the Customer. The Customer&#8217;s instructions are the Agreement, the actions and settings of the Customer and Users in the Platform, and the Customer&#8217;s written instructions. If VITS considers an instruction to infringe legislation, it shall inform the Customer without delay.<\/p>\n<p><strong>14.2.<\/strong> VITS shall not process personal data for its own purposes or use it to train artificial intelligence models or for marketing. If VITS is required by legislation to process personal data, VITS shall inform the Customer before the processing, unless the law prohibits this.<\/p>\n<p><strong>14.3.<\/strong> Only those VITS employees and sub-processors who need personal data to perform their tasks and who are bound by confidentiality shall have access to it.<\/p>\n<p><strong>14.4.<\/strong> VITS employees shall access the Customer&#8217;s Account only to provide user support, to remedy errors or to ensure security, and only to the extent necessary.<\/p>\n<p><strong>14.5.<\/strong> VITS shall implement the technical and organisational measures described in Annex 2 and shall update them in line with technological developments and changes in risks. Such changes shall not reduce the level of protection.<\/p>\n<p><strong>14.6.<\/strong> VITS shall maintain a record of processing activities in accordance with Article 30(2) of the GDPR.<\/p>\n<h3 id=\"clause-15\">15. Obligations of the Customer<\/h3>\n<p><strong>15.1.<\/strong> The Customer is responsible for ensuring that the processing of personal data in the Platform is lawful. The Customer shall ensure that it has a legal basis for the processing and has informed the data subjects of the processing (Articles 13 and 14 of the GDPR), and shall enter into the Platform only the data necessary to achieve the purpose.<\/p>\n<p><strong>15.2.<\/strong> The Customer shall process health data (e.g. health check decisions and injury data) and personal identification codes in the Platform only to the extent necessary to fulfil its occupational health and safety obligations.<\/p>\n<p><strong>15.3.<\/strong> The Customer shall assign the rights of Users so that health data and other sensitive data are accessible only to the Users who need them.<\/p>\n<p><strong>15.4.<\/strong> The Customer shall respond to requests from data subjects. VITS shall assist the Customer in accordance with clause 18.<\/p>\n<p><strong>15.5.<\/strong> The Customer shall notify VITS without delay if it becomes aware of a personal data breach or a security vulnerability relating to the Platform.<\/p>\n<p><strong>15.6.<\/strong> If the Customer connects the Platform to a third-party system (e.g. an HR system or the system of an occupational health service provider), the Customer is responsible for the legal basis for transmitting the data. VITS is not responsible for the third-party system.<\/p>\n<h3 id=\"clause-16\">16. Sub-processors<\/h3>\n<p><strong>16.1.<\/strong> The Customer grants VITS a general authorisation to engage sub-processors. The current list of sub-processors is set out in Annex 3 and on the VITS website.<\/p>\n<p><strong>16.2.<\/strong> VITS shall notify the Customer of the addition or replacement of a sub-processor at least 14 days in advance by e-mail or in the Platform. The Customer may submit a reasoned objection within that period. If the Customer does not object, the change is deemed accepted. If the Parties do not find a solution following an objection, the Customer may terminate the Agreement with effect from the date on which the change enters into force.<\/p>\n<p><strong>16.3.<\/strong> VITS shall conclude a written agreement with each sub-processor imposing on it the same data protection obligations as those set out in the Data Processing Terms. VITS is liable to the Customer for the performance of the sub-processor&#8217;s obligations.<\/p>\n<p><strong>16.4.<\/strong> A third-party system that the Customer has itself connected to the Platform (clause 15.6) is not a sub-processor of VITS.<\/p>\n<h3 id=\"clause-17\">17. Security and personal data breaches<\/h3>\n<p><strong>17.1.<\/strong> VITS shall implement the security measures required by Article 32 of the GDPR, as described in Annex 2.<\/p>\n<p><strong>17.2.<\/strong> VITS shall notify the Customer of a personal data breach affecting Customer Data without undue delay and no later than 24 hours after becoming aware of it. The notification states the nature and time of the breach, the categories of data concerned, the approximate number of data subjects, the likely consequences, the measures taken and planned, and a contact person. Where it is not possible to provide all the information at the same time, VITS shall provide it in phases.<\/p>\n<p><strong>17.3.<\/strong> VITS shall take measures without delay to mitigate the consequences of the breach and shall document the breach.<\/p>\n<p><strong>17.4.<\/strong> The Customer decides whether to notify the Estonian Data Protection Inspectorate and the data subjects. VITS shall not notify them on the Customer&#8217;s behalf without the Customer&#8217;s consent, unless required by law.<\/p>\n<h3 id=\"clause-18\">18. Assistance to the Customer and audits<\/h3>\n<p><strong>18.1.<\/strong> VITS shall assist the Customer in ensuring the rights of data subjects: access, rectification, erasure, restriction, portability and objection. The Customer can view, rectify and export data in the Platform. Where the functions of the Platform are not sufficient to fulfil a request, VITS shall perform the necessary action on the Customer&#8217;s instruction.<\/p>\n<p><strong>18.2.<\/strong> If a request from a data subject or a public authority concerning Customer Data reaches VITS, VITS shall forward it to the Customer without delay and shall not respond to it itself, unless required by law.<\/p>\n<p><strong>18.3.<\/strong> VITS shall assist the Customer in fulfilling the obligations set out in Articles 32 to 36 of the GDPR: security, notification of breaches, data protection impact assessment and prior consultation. The extent of the assistance depends on the nature of the processing and the information available to VITS.<\/p>\n<p><strong>18.4.<\/strong> VITS shall make available to the Customer the information necessary to demonstrate compliance with the Data Processing Terms.<\/p>\n<p><strong>18.5.<\/strong> The Customer or an auditor authorised by the Customer may audit the data processing of VITS by giving at least 30 days&#8217; notice. The audit shall be carried out during working hours and shall not disrupt the activities of VITS or endanger the data of other customers, and the auditor is bound by confidentiality. An audit may be carried out at most once a year, except after a personal data breach or at the request of a supervisory authority. The costs of the audit shall be borne by the Customer.<\/p>\n<p><strong>18.6.<\/strong> If the Customer needs assistance to a greater extent than usual, VITS may charge a reasonable fee for it by prior agreement. No fee is charged if the assistance is needed because of a breach by VITS.<\/p>\n<h3 id=\"clause-19\">19. Transfers of data outside the European Economic Area<\/h3>\n<p><strong>19.1.<\/strong> Customer Data and files are stored in the European Economic Area (EEA), except for the preview referred to in clause 19.4.<\/p>\n<p><strong>19.2.<\/strong> VITS shall transfer personal data outside the EEA only to the sub-processors indicated in Annex 3 and on the basis of safeguards in accordance with Chapter V of the GDPR, except for the preview referred to in clause 19.4. The safeguard is an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework) or the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021\/914).<\/p>\n<p><strong>19.3.<\/strong> Features based on artificial intelligence are optional and are not needed for using the core functions of the Platform. If a User uses such a feature, the text, files and images submitted to the feature are transmitted to the language model service provider named in Annex 3 in the USA. The Customer shall not enter health data or personal identification codes into these features.<\/p>\n<p><strong>19.4.<\/strong> To display a preview of certain file types (e.g. .doc, .ppt, .pptx, .odt, .rtf and .txt, and in a mobile browser also PDF), the file is transmitted to the Google or Microsoft file viewer, which may be located outside the EEA.<\/p>\n<h3 id=\"clause-20\">20. Retention, return and deletion<\/h3>\n<p><strong>20.1.<\/strong> During the term of the Agreement, the Customer can export data from the Platform. After the termination of the Agreement, VITS shall provide the Customer Data at the Customer&#8217;s request in accordance with clause 1.6 or 11.3.<\/p>\n<p><strong>20.2.<\/strong> After the termination of the Agreement, VITS shall delete the Customer Data in accordance with clause 1.6 or 11.4, unless legislation requires it to be retained, and shall confirm the deletion in writing at the Customer&#8217;s request.<\/p>\n<p><strong>20.3.<\/strong> Data in backups is deleted through the regular replacement of backups no later than 35 days after deletion. Until then, it is not used and is protected in the same way as other Customer Data.<\/p>\n<p><strong>20.4.<\/strong> Login history is retained for up to 12 months, and change history is retained together with the Customer Data. Both are deleted together with the Customer Data. Application log files are retained on the server and in the logging service for up to 30 days, error and security event logs on the server for up to 90 days, and in the log archive (EU) for up to 6 months.<\/p>\n<p><strong>20.5.<\/strong> The Customer is responsible for complying with the statutory retention periods for documents.<\/p>\n<h3 id=\"clause-21\">21. Liability<\/h3>\n<p><strong>21.1.<\/strong> The Parties are liable for any breach of the Data Processing Terms in accordance with Article 82 of the GDPR and clauses 1.6 and 10.<\/p>\n<h3 id=\"annex-1\">Annex 1. Description of the processing<\/h3>\n<p><strong>Subject matter and purpose.<\/strong> VITS processes personal data to provide the Platform service, so that the Customer can organise occupational health and safety and meet the requirements of the Occupational Health and Safety Act. This includes the functions of the Platform, notifications sent by e-mail and SMS, the generation of PDF documents, authentication (including Smart-ID, Mobile-ID and ID card), integrations ordered by the Customer, optional features based on artificial intelligence, user support, ensuring security, and backups.<\/p>\n<p><strong>Nature.<\/strong> Collection through input and imports by the Customer, storage, organisation, display, queries, transmission through notifications and integrations, extracts and deletion.<\/p>\n<p><strong>Duration.<\/strong> The term of the Agreement and the period thereafter set out in clause 20.<\/p>\n<p><strong>Data subjects.<\/strong><\/p>\n<ul>\n<li>Employees of the Customer, including former employees and employees who are temporarily absent.<\/li>\n<li>Users: the Customer&#8217;s administrators, working environment specialists and managers, and employees of the Customer&#8217;s service providers.<\/li>\n<li>Persons in other roles: instructors, working environment representatives, and representatives of the employer and of employees.<\/li>\n<li>External persons: external auditors, non-employees injured in an incident (e.g. an employee of a subcontractor or a visitor), witnesses, persons reporting an incident, external persons notified of an incident, and physicians conducting health checks.<\/li>\n<\/ul>\n<p><strong>Types of personal data.<\/strong><\/p>\n<div class=\"vits-legal-table\">\n<table>\n<thead>\n<tr>\n<th>Area<\/th>\n<th>Personal data<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Employees<\/td>\n<td>Name, personal identification code, employee code, access card code, gender, citizenship, language, e-mail, phone, home address, position, department, workplace, working time (FTE), manager, start and end date of employment, period of temporary absence, roles (e.g. working environment representative, first aider), notes<\/td>\n<\/tr>\n<tr>\n<td>Users<\/td>\n<td>Name, e-mail, phone, personal identification code for ID card login, language, rights, two-factor authentication data, last login<\/td>\n<\/tr>\n<tr>\n<td>Instruction and training<\/td>\n<td>Instruction and training data, test answers and results, time and method of confirmation, IP address and device used for confirmation, time spent reading, instructor&#8217;s data<\/td>\n<\/tr>\n<tr>\n<td>Courses and competencies<\/td>\n<td>Participation and progress, test and assignment results, feedback, certificates, documents proving competence<\/td>\n<\/tr>\n<tr>\n<td>Equipment<\/td>\n<td>Equipment issued, quantities, sizes (e.g. clothing and footwear sizes), dates of issue and return<\/td>\n<\/tr>\n<tr>\n<td>Health checks<\/td>\n<td>Date of the check, date of the next check, decision on continuing work, need for glasses, physician&#8217;s recommendations and restrictions, decision document, appointment times, examination packages, attendance<\/td>\n<\/tr>\n<tr>\n<td>Incidents and occupational accidents<\/td>\n<td>Description, time and place, reporter, injured person&#8217;s data (including personal identification code, date of birth, address, citizenship), type of injury and body part, medical care, incapacity for work and death, written statements, witnesses, investigation and action plan data, photos and attachments<\/td>\n<\/tr>\n<tr>\n<td>Risk assessments, action plans and audits<\/td>\n<td>Responsible persons, deadlines, solutions, comments, photos, external auditor&#8217;s name, organisation, e-mail and IP address<\/td>\n<\/tr>\n<tr>\n<td>Remote work risk assessment<\/td>\n<td>Employee&#8217;s answers, including complaints related to working with display screens, and photos of the workplace<\/td>\n<\/tr>\n<tr>\n<td>Safety climate surveys<\/td>\n<td>Answers, department, year of birth, gender, length-of-service group, manager status, free-text comments<\/td>\n<\/tr>\n<tr>\n<td>Documents and communication<\/td>\n<td>Uploaded documents and photos, messages, announcements, comments, content of notifications<\/td>\n<\/tr>\n<tr>\n<td>Logs<\/td>\n<td>Logins (IP address, device, login method), change history, security logs<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><strong>Special categories of personal data.<\/strong> Health data is contained in the data on health checks, incidents and occupational accidents, and remote work risk assessments. Free-text fields, documents and photos may also contain health data.<\/p>\n<p><strong>Personal identification code.<\/strong> The personal identification code is processed to identify employees and injured persons, at login, in confirmations of instruction and training, when booking health checks, and in the Customer&#8217;s reports (e.g. an occupational accident report to the Labour Inspectorate).<\/p>\n<h3 id=\"annex-2\">Annex 2. Technical and organisational security measures<\/h3>\n<h4>Hosting and reliability<\/h4>\n<ul>\n<li>The Platform runs in the Amazon Web Services cloud in the European Union. The servers, database and files are located in Sweden (Stockholm), and database backups also in Germany (Frankfurt). In providing the service, AWS complies with the requirements of the ISO 27001 standard.<\/li>\n<li>The servers and services of the development and production environments are separated. Production data is not used or copied in development or test environments. Only test data is used in automated tests. The trial environment referred to in clause 4.7 is also located in AWS in the EU; its database is encrypted and its files are stored separately.<\/li>\n<li>A backup of the database is made every day and a full backup once a week. Backups are retained in the EU (in Sweden and Germany) for 35 days. Previous and deleted versions of files are retained for 35 days. Restoration is tested at least once every six months and the result is documented. If data is restored from a backup, data that had been deleted before the restoration is deleted again.<\/li>\n<li>In the event of a failure, the application restarts automatically.<\/li>\n<\/ul>\n<h4>Data protection<\/h4>\n<ul>\n<li>The database can be accessed only from the application servers through closed security groups or through an encrypted connection. The application&#8217;s database account has only the minimum necessary privileges.<\/li>\n<li>The database and files are encrypted at rest. The content of messages between employees and authentication secrets are additionally stored in encrypted form.<\/li>\n<li>Data communication with the Platform and database connections are encrypted.<\/li>\n<\/ul>\n<h4>Access control<\/h4>\n<ul>\n<li>User rights are assigned by role and by area. Personal data and health data have separate rights, which can be restricted by department.<\/li>\n<li>The data of each Customer is logically separated from the data of other customers, and access rights are checked on the server.<\/li>\n<li>Passwords are stored using a strong hashing algorithm, and complexity requirements apply to passwords.<\/li>\n<li>Two-factor authentication is available to all Users, and the Customer can make it mandatory on its Account.<\/li>\n<li>Users can also log in with single sign-on (SAML 2.0, OpenID Connect) and with Smart-ID, Mobile-ID and ID card.<\/li>\n<li>Repeated failed login attempts are limited, and inactive sessions expire.<\/li>\n<\/ul>\n<h4>Access by VITS employees<\/h4>\n<ul>\n<li>Only VITS employees authorised for this purpose can access a Customer&#8217;s Account, and every access is logged.<\/li>\n<li>Only employees who need access to personal data have it, and they are bound by confidentiality.<\/li>\n<li>VITS employees use two-factor authentication on AWS accounts. Platform superusers who have access to Customers&#8217; Accounts are required to use two-factor authentication. The servers can be accessed only with an SSH key from permitted IP addresses, and the database only through an encrypted SSH tunnel.<\/li>\n<\/ul>\n<h4>Logging and monitoring<\/h4>\n<ul>\n<li>Change history is kept for important data (e.g. employees, users, instruction, training, equipment, incidents and action plans).<\/li>\n<li>Logins are logged, and Users of the Platform can see their recent logins.<\/li>\n<li>Malicious requests are detected automatically and their sources are blocked.<\/li>\n<li>VITS monitors the operation of the database and application servers and responds to suspicious activity without delay.<\/li>\n<\/ul>\n<h4>Organisational measures<\/h4>\n<ul>\n<li>Data processing agreements have been concluded with sub-processors.<\/li>\n<li>Personal data breaches are recorded and handled in accordance with an established procedure.<\/li>\n<\/ul>\n<h3 id=\"sub-processors\">Annex 3. Sub-processors<\/h3>\n<p>VITS uses the following sub-processors in providing the Platform service.<\/p>\n<div class=\"vits-legal-table\">\n<table>\n<thead>\n<tr>\n<th>Sub-processor<\/th>\n<th>Purpose<\/th>\n<th>Location<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Amazon Web Services EMEA SARL<\/td>\n<td>Servers, database, file storage and encryption key management<\/td>\n<td>EU, Sweden (Stockholm); database backups also in Germany (Frankfurt)<\/td>\n<\/tr>\n<tr>\n<td>Mailgun Technologies, Inc. (Sinch)<\/td>\n<td>Sending e-mails<\/td>\n<td>EU, Germany and Belgium<\/td>\n<\/tr>\n<tr>\n<td>Messente Communications O\u00dc<\/td>\n<td>Sending SMS messages<\/td>\n<td>EU, Germany and Finland<\/td>\n<\/tr>\n<tr>\n<td>eID Easy O\u00dc<\/td>\n<td>Login and confirmation with Smart-ID, Mobile-ID and ID card<\/td>\n<td>EU<\/td>\n<\/tr>\n<tr>\n<td>Better Stack, Inc.<\/td>\n<td>Collection of application logs and error monitoring<\/td>\n<td>EU, Germany; standard contractual clauses<\/td>\n<\/tr>\n<tr>\n<td>CORDNET O\u00dc (Featurebase)<\/td>\n<td>User support chat and feedback in the Platform<\/td>\n<td>EEA (Netherlands, Germany, Ireland); e-mail delivery and artificial intelligence processing partly in the USA, standard contractual clauses<\/td>\n<\/tr>\n<tr>\n<td>Anthropic, PBC<\/td>\n<td>Optional artificial intelligence features: drafting and translating instructions<\/td>\n<td>USA, standard contractual clauses<\/td>\n<\/tr>\n<tr>\n<td>Zone Media O\u00dc<\/td>\n<td>Receiving employee lists sent by e-mail<\/td>\n<td>EU, Estonia and the Netherlands<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>Integrations chosen by the Customer itself are not sub-processors of VITS (clause 16.4). These include, for example, HR systems, the information system of an occupational health service provider, a document archive, Slack and the single sign-on (SSO) service.<\/p>\n<\/div>\n<\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"100-width.php","meta":{"footnotes":""},"class_list":["post-3230","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/vits.ee\/en\/wp-json\/wp\/v2\/pages\/3230","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vits.ee\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/vits.ee\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/vits.ee\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/vits.ee\/en\/wp-json\/wp\/v2\/comments?post=3230"}],"version-history":[{"count":2,"href":"https:\/\/vits.ee\/en\/wp-json\/wp\/v2\/pages\/3230\/revisions"}],"predecessor-version":[{"id":3237,"href":"https:\/\/vits.ee\/en\/wp-json\/wp\/v2\/pages\/3230\/revisions\/3237"}],"wp:attachment":[{"href":"https:\/\/vits.ee\/en\/wp-json\/wp\/v2\/media?parent=3230"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}