Data Processing Agreement
Last updated 23 October 2026
Who we are. Vitrio is a trading name of Vitrio Limited, a company registered in England and Wales under company number 17515286. We are based in Sheffield, United Kingdom. You can reach us at ebujoe007@gmail.com.
This Data Processing Agreement (DPA) forms part of the Terms of Service (or the Order Form) between Vitrio and the Customer. It applies when Vitrio processes personal data on the Customer's behalf and reflects Article 28 of the UK GDPR and the EU GDPR and the equivalent provisions of the Nigeria Data Protection Act 2023. It takes effect when the Customer accepts the Terms. A countersigned copy is available on request.
1. Meaning of terms
Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meaning given in data protection law. Customer Personal Data means personal data in the Customer's workspace that Vitrio processes for the Customer. Data Protection Law means the UK GDPR, the Data Protection Act 2018, the EU GDPR, the Nigeria Data Protection Act 2023 and any other law on personal data that applies to the processing.
2. Roles
For Customer Personal Data the Customer is the controller and Vitrio is the processor. Vitrio is a controller of the personal data described in its Privacy Policy (for example account sign-in and billing contacts), and this DPA does not apply to that data.
3. Instructions
Vitrio will process Customer Personal Data only on the Customer's documented instructions, which are these terms, the Terms of Service, the Customer's use of the Service's features and settings, and any further written instruction we agree. Vitrio will tell the Customer if it believes an instruction breaches Data Protection Law, and may pause that processing until the instruction is confirmed or changed. The subject matter, duration, nature, purpose, data types and data subjects are in Annex 1.
4. Customer's responsibilities
The Customer is responsible for having a lawful basis to put Customer Personal Data into the Service, for giving any required notices to its staff and others, for the accuracy of the data, and for not entering patient data or special category data the Service is not designed for (see the Acceptable Use Policy).
5. Confidentiality and personnel
Vitrio will make sure that people who can access Customer Personal Data are bound by confidentiality, are given data protection training suited to their role, and can access it only where their work needs it.
6. Security
Vitrio will keep technical and organisational measures that are appropriate to the risk, at least those in Annex 2, and will keep them under review. Vitrio may update the measures provided it does not reduce the overall level of protection.
7. Sub-processors
The Customer gives Vitrio general authorisation to use the sub-processors on the Subprocessors page. Vitrio will bind each one to data protection terms no less protective than this DPA and remains responsible for their performance. Vitrio will give at least 30 days' notice (by updating that page and emailing the Customer's administrators) before adding or replacing a sub-processor that processes Customer Personal Data. If the Customer objects on reasonable data protection grounds within that period, the parties will work together in good faith to resolve it; if they cannot, the Customer may end the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
8. International transfers
Vitrio may transfer Customer Personal Data to countries outside the UK, the EEA and Nigeria only where it is permitted by Data Protection Law, for example under an adequacy decision or regulation, or under appropriate safeguards. Where the safeguards are standard contractual clauses, the parties agree that: for transfers from the UK, the International Data Transfer Addendum issued by the UK Information Commissioner to the EU Standard Contractual Clauses applies; for transfers from the EEA, the EU Standard Contractual Clauses (Module Two, controller to processor, and Module Three where relevant) apply; and in each case the details in Annexes 1 and 2 are the details those clauses require. Vitrio will give the Customer a copy of the clauses on request.
9. Helping the Customer
Taking into account the nature of the processing, Vitrio will give the Customer the help it reasonably needs to respond to requests from data subjects (the Service lets the Customer export, correct and delete most records itself), to carry out data protection impact assessments and consult regulators, and to meet its security and breach obligations. If a data subject contacts Vitrio about Customer Personal Data, Vitrio will refer them to the Customer unless the law requires otherwise.
10. Personal data breaches
Vitrio will tell the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, what happened, the data and people affected, the likely consequences and the steps taken or proposed, and Vitrio will keep the Customer updated and help it meet its own notification duties. Vitrio will take reasonable steps to contain and fix the breach.
11. Return and deletion
The Customer can export its data from the Service at any time. When the agreement ends, Vitrio will for 30 days make a full export available on request, and will then delete Customer Personal Data from live systems within 90 days of the end date. Copies in backups are overwritten on the 30-day backup cycle. Vitrio may keep data where the law requires, and will protect and limit its use to that purpose. On request Vitrio will confirm in writing that deletion has taken place.
12. Audit and information
Vitrio will give the Customer the information needed to show it is complying with this DPA, including on request a summary of its current security measures and the results of its most recent dependency and vulnerability checks. Where that is not enough, and no more than once a year (or sooner after a breach or where a regulator requires), Vitrio will allow the Customer, or an auditor bound by confidentiality, to audit its compliance on 30 days' written notice, during working hours and without disrupting other customers. The Customer will bear its own audit costs.
13. Liability and law
Each party's liability under this DPA is subject to the limits and exclusions in the Terms of Service. This DPA is governed by the law of England and Wales. If there is a conflict between this DPA and the Terms of Service about the processing of Customer Personal Data, this DPA prevails.
Annex 1. Details of the processing
| Subject matter | Providing the Vitrio laboratory operations service to the Customer. |
|---|---|
| Duration | The term of the agreement, then the return and deletion period in section 11. |
| Nature and purpose | Hosting, storing, retrieving, displaying, backing up, securing, supporting and transmitting data so the Customer can run stock, purchasing, equipment and quality workflows; producing reports and alerts; and, only where the Customer allows it, sending requests to an outside AI provider. |
| Data subjects | The Customer's staff and Authorised Users; staff of the Customer's suppliers and marketplace sellers; and other individuals whose names appear in operational records (for example an engineer named on a maintenance ticket). |
| Types of personal data | Name, work email, phone number, job title, role, laboratory, profile photo, sign-in and audit data (including IP address), the identity of the person who performed or approved an action, and free-text entered in notes, comments and messages. No patient data is intended. |
| Special category data | None intended. The Service is not designed to process health data about patients. |
| Frequency | Continuous, for the term. |
Annex 2. Technical and organisational measures
- Separation of customers. Every record belongs to one laboratory and every query is limited to the signed-in person's laboratory; this is checked by automated tests, including tests that try to reach another laboratory's records. API fields that refer to other records only accept records from the caller's own laboratory.
- Access control. Role-based permissions per account, least privilege for Vitrio staff, administrator access restricted by network address, and a record of administrator actions.
- Authentication. Salted password hashing, a 12-character minimum length, lockout after repeated failures by network address and by account, optional two-factor authentication with encrypted secrets and single-use sign-in codes, expiring password-reset links, and idle timeout for platform administrators.
- Encryption. HTTPS everywhere with HTTP Strict Transport Security; data encrypted at rest by the database and file-storage providers; sensitive tokens encrypted by the application.
- Audit trail. Changes to operational records are logged with who, what and when, in a tamper-evident chain, retained for two years by default.
- Application security. Output escaping and a content security policy, CSRF protection, rate limiting on sign-in and public forms, validation and content checks on uploads, server-side request controls for any fetch of an outside address, and signed-webhook verification.
- Vulnerability management. Dependencies are scanned for known vulnerabilities and updated, releases go through automated tests, and weaknesses can be reported under the Vulnerability Disclosure Policy.
- Resilience. Automated database backups on a 30-day cycle, restore procedures, and live status reporting.
- Data minimisation for AI. Outside AI can be switched off per laboratory; each call is metered and recorded; patient data is not intended to be sent.
- People. Confidentiality obligations and security awareness for everyone with access.
- Incident response. A documented process to contain, assess and notify, with customer notice within 48 hours of becoming aware of a breach affecting Customer Personal Data.