INVIE
Data Processing Agreement (DPA)
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the Customer and Lê Bùi Hoàng Viên (“INVIE”). It applies when INVIE processes personal data on the Customer’s behalf while providing the Service, and takes effect when the Customer accepts the Terms. Business customers who need a countersigned copy can contact legal@invie.net.
1. Definitions
“Customer Personal Data” means personal data in Customer Content that INVIE processes on the Customer’s behalf. “Data Protection Law” means applicable personal data protection law, including the GDPR (where it applies) and Vietnam’s Decree 13/2023/ND-CP. “Sub-processor” means a third party engaged by INVIE that may process Customer Personal Data. Other terms have the meaning given in Data Protection Law.
2. Roles
The Customer is the controller (or a processor acting for its own controller) and INVIE is the processor of Customer Personal Data. For account, billing and technical data, INVIE is an independent controller under the Privacy Policy. Public market data collected by INVIE itself is outside the scope of this DPA.
3. Instructions
INVIE processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use and configuration of the Service are the complete instructions. INVIE will tell the Customer if it believes an instruction infringes Data Protection Law, unless the law prohibits this. The Customer is responsible for having a lawful basis for the data it puts into the Service and for giving any notices and obtaining any consents data subjects require.
4. Confidentiality
INVIE ensures that people authorised to process Customer Personal Data are bound by confidentiality and have access only where needed to operate and support the Service or at the Customer’s request.
5. Security
INVIE applies the technical and organisational measures in Annex 2 and may update them provided the overall level of protection is not reduced.
6. Sub-processors
- The Customer gives general authorisation for INVIE to use Sub-processors in these categories: cloud infrastructure and network security; transactional email; payment processing; and, only when the Customer uses AI features, AI model providers.
- The current list of Sub-processors (name, function, location) is provided to the Customer on request at legal@invie.net, under a confidentiality agreement.
- INVIE binds each Sub-processor to data protection obligations no less protective than this DPA and remains responsible to the Customer for their performance.
- INVIE will give at least 30 days’ notice before adding or replacing a Sub-processor to Customers who have registered for notices at legal@invie.net. The Customer may object on reasonable data protection grounds. If no solution is found, the Customer may terminate the affected part of the Service and receive a refund of unused prepaid fees.
7. Assistance
Within reason, INVIE assists the Customer with data subject requests (access, rectification, erasure, restriction, portability), data protection impact assessments and dealings with authorities. If INVIE receives a request directly from a data subject of the Customer, it will forward it to the Customer and not respond itself unless the Customer authorises it or the law requires.
8. Personal data breaches
INVIE will notify the Customer without undue delay, and within 48 hours of confirming a breach affecting Customer Personal Data, with the information available on its nature, the categories and approximate volume of data concerned, likely consequences and measures taken or planned. INVIE will cooperate so the Customer can meet its own notification duties (for example 72 hours under the GDPR and Decree 13/2023/ND-CP).
9. Deletion or return
When the agreement ends, the Customer can export Project data with the Service’s export features or request an export within 30 days. INVIE then deletes Customer Personal Data from live systems within 30 days. Backups rotate and are deleted within a further 30 days, unless the law requires longer retention.
10. Audits
On reasonable request (no more than once a year unless there is an incident or an authority requires it), INVIE provides the information needed to demonstrate compliance with this DPA, such as a description of security measures and answers to security questionnaires. Any on-site audit must be agreed in advance as to scope, timing, confidentiality and cost.
11. International transfers
Data may be processed outside the Customer’s country as described in the Privacy Policy. Where Data Protection Law requires, the parties rely on a valid transfer mechanism such as the European Commission’s Standard Contractual Clauses, and INVIE completes the cross-border transfer formalities required by Vietnamese law.
12. Liability and precedence
Each party’s liability under this DPA is subject to the limits in the Terms, except where the law does not allow such limits. If this DPA and the Terms conflict on personal data protection, this DPA prevails.
Annex 1 – Processing details
| Subject matter | Storing and processing Customer Content to provide the market research Service |
|---|---|
| Duration | For the term of the Service, plus the deletion period in section 9 |
| Nature and purpose | Storage, display, search, aggregation and export; AI processing at the Customer’s request; backups |
| Data subjects | The Customer’s workspace members; individuals appearing in content the Customer adds (for example review authors, people in uploaded files) |
| Categories of data | Name, email, role; review text and notes; images, videos and PDFs uploaded by the Customer; other data the Customer chooses to add |
| Special categories | Not expected. The Customer should not add sensitive personal data to the Service. |
Annex 2 – Technical and organisational measures
- HTTPS/TLS for all connections; session cookies sent only over HTTPS and not readable by JavaScript.
- System keys and secrets stored encrypted, never in source code.
- Sign-in with expiring one-time links; only hashes of links and sessions are stored.
- Administrators use identities separate from application accounts, with mandatory two-factor authentication and short sessions; admin actions are logged.
- Role-based access (Owner, Editor, Viewer); data separated by workspace; access enforced server-side.
- Rate limiting, bot checks and usage limits; network-level protection against denial-of-service attacks.
- Automated backups with point-in-time recovery; releases deployed so the previous version can be restored immediately.
- Automated tests before every release; infrastructure access limited to responsible staff.