Data processing agreement
If you use our AI chat, follow-up or CRM, we process data of your customers on your behalf. This agreement sets out how we do that.
Parties and starting point
This data processing agreement belongs to the agreement between the Client and Mova XL, trading as Viva67, Stadhouderslaan 12D, 6171 KL Stein, the Netherlands (Chamber of Commerce 42106567), and to our general terms and conditions.
The Client is the controller. Viva67 is the processor within the meaning of article 28 of the General Data Protection Regulation (GDPR). This means: the Client decides why and for what purpose the data of its customers is processed, and Viva67 processes it on behalf of the Client.
Terms in this agreement, such as personal data, processing, data subject and personal data breach, have the meaning given to them by the GDPR. The terms Service and End users have the meaning given in the general terms and conditions.
1. Subject and duration
Viva67 processes personal data for the Client in order to provide the Service. This agreement applies for as long as Viva67 processes personal data for the Client, even if the main agreement has already ended and the data has not yet been deleted.
2. Nature and purpose of the processing
Viva67 processes the data in order to:
- answer questions from End users via the AI chat;
- record requests and conversations in the CRM;
- schedule appointments;
- send automatic follow-up messages by email.
Viva67 does not use the data for its own purposes. Viva67 does not sell the data, does not share it with advertisers and does not use it to train AI models.
3. Types of data and data subjects
Data
Name, contact details (email address, phone number), messages and chat conversations, appointment details, notes in the CRM, an approximate location (city and country based on the IP address) and technical data needed to make the Service work.
Data subjects
Visitors to the Client's website, (potential) customers of the Client and employees of the Client who use the CRM.
No special categories of data
The Client ensures that no special categories of personal data are requested via the Service, such as health data, or data about religion, ethnic origin or criminal matters. This is only possible if it has been agreed in writing in advance and extra measures have been taken.
4. Responsibilities of the Client
The Client guarantees that it has a valid legal basis for having the data processed, and that it informs its End users properly, for example in its own privacy statement. The Client mentions there that it uses Viva67 as a processor for the chat, the CRM and the follow-up. The Client is responsible for the content it supplies and for the messages it has sent via the Service.
5. Instructions from the Client
Viva67 only processes the data on the basis of the agreement and the written instructions of the Client, unless the law requires Viva67 to process it. In that case Viva67 informs the Client in advance, unless the law forbids this. If Viva67 believes that an instruction conflicts with the GDPR, it informs the Client immediately.
6. Confidentiality
Everyone who has access to the data on behalf of Viva67 is bound by confidentiality. That access is limited to the people who need the data for their work on the Service.
7. Security
Viva67 takes appropriate technical and organisational measures to protect the data against loss and unlawful processing, as referred to in article 32 GDPR. In doing so, Viva67 takes into account the state of the art, the costs and the risks for the data subjects. The main measures are:
- encrypted connections (HTTPS) for the website, the chat and the CRM;
- encrypted storage of the database;
- access to the CRM only with a personal account;
- collecting as little data as possible and not keeping it longer than necessary;
- carefully selected suppliers with written arrangements.
A more detailed explanation can be found on the page Security and AI.
8. Sub-processors
The Client gives Viva67 permission to engage the following sub-processors:
- Vercel Inc. (United States): hosting of the CRM, the chat and the form processing.
- Google (Firebase and Cloud Firestore): database and login, with storage in the Netherlands (europe-west4).
- OpenRouter Inc. (United States), with the AI model Claude by Anthropic (United States): drafting answers and messages.
- Resend: sending emails, via the EU region (Ireland).
- Upstash (QStash): scheduling follow-up messages, in the EU region (Frankfurt).
- Hostinger: the mailbox of Viva67, for contact with the Client and its End users.
- ipapi.co: converting an IP address into a city and country.
Viva67 imposes obligations on sub-processors comparable to those in this agreement. If Viva67 wants to add or replace a sub-processor, it announces this at least 30 days in advance by email. The Client may object with reasons. If we cannot reach an agreement together, the Client may cancel the agreement with effect from the date on which the change takes effect.
9. Transfers outside the EEA
If data is processed outside the European Economic Area, this only happens on the basis of the EU-US Data Privacy Framework (if the sub-processor is certified under it) or on the basis of the standard contractual clauses of the European Commission. Where possible, Viva67 chooses a European region.
10. Rights of data subjects
Under the GDPR, End users have, among other things, the right of access, rectification, erasure, restriction of processing, objection and data portability. The Client handles those requests. Viva67 assists, to the extent reasonable, for example by finding, exporting or deleting data in the CRM.
If Viva67 itself receives a request from a data subject, it forwards it to the Client within five working days and does not answer the request itself, unless the Client asks it to.
11. Other assistance to the Client
Viva67 assists the Client, to the extent reasonable, with a data protection impact assessment (DPIA) and with any prior consultation of the supervisory authority. If this assistance takes more than a few hours of work, we agree on the costs in advance.
12. Data breaches
If Viva67 discovers a personal data breach, it reports this to the Client without undue delay and no later than 48 hours after discovery. Viva67 provides all the information the Client needs to report the breach to the Dutch Data Protection Authority within 72 hours if necessary, and to inform data subjects, such as:
- what happened and when;
- which data and roughly how many data subjects are involved;
- what the possible consequences are;
- which measures Viva67 has taken or proposes.
Viva67 takes immediate measures to limit the consequences and keeps the Client informed. The Client decides whether the breach is reported to the supervisory authority and the data subjects.
13. Audits
Viva67 gives the Client all the information needed to demonstrate that it complies with this agreement. The Client may, at most once a year and after 30 days' notice, have an audit carried out by an independent expert who is bound by confidentiality. The costs are borne by the Client, unless the audit shows that Viva67 does not comply with this agreement on important points.
14. End and return of data
After the end of the agreement, Viva67 releases the data to the Client as soon as all outstanding amounts under the main agreement have been paid, as described in article 16 of the general terms and conditions. After the release, the Client can export its data within 30 days.
After that, and in any case no later than 90 days after the end of the agreement, Viva67 deletes the data, also at sub-processors, unless the law requires it to be kept. Until then the data remains secured and Viva67 does not use it for anything. On request, Viva67 confirms in writing that the data has been deleted.
15. Liability and other provisions
For liability, the provisions of the general terms and conditions apply. In case of conflict between this data processing agreement and the general terms and conditions, this data processing agreement prevails as far as the processing of personal data is concerned.
Viva67 announces changes to this agreement at least 30 days in advance. Dutch law applies to this agreement. In case of differences between translations, the Dutch text prevails.
Version 1.1, 13 October 2026.