1. Parties and scope
1.1. This DPA is between the vetman customer Organization as controller and Telvo LLC, ID 205218334, as processor.
1.2. It forms part of the Terms of Service and applies to personal data processed by Telvo LLC on the Organization's behalf to provide vetman.
1.3. Telvo LLC is a controller where it determines purposes and means, including account administration, security, billing and support, as described in the Privacy Policy.
1.4. Terms have the meaning given by the Georgian Law on Personal Data Protection. Each party will comply with data-protection law applicable to it.
2. Instructions
2.1. The Organization instructs Telvo LLC to process data only under the Terms, this DPA, actions taken in the platform and additional written instructions.
2.2. Annex A describes the subject matter, duration, nature, purposes, data subjects and data.
2.3. If an instruction clearly breaches applicable law, Telvo LLC will inform the Organization and suspend it unless processing is legally required.
3. Telvo LLC obligations
Telvo LLC will process only on documented instructions and not for a different purpose; limit access to personnel with a work need and confidentiality obligations; apply Annex B measures; reasonably assist with data-subject requests, security, incidents and assessments; provide reasonable compliance information; and act under section 8 at termination. It does not sell Organization data, use it for behavioural advertising or expose it to another Organization.
4. Organization obligations
The Organization will ensure a lawful basis for processing and transfer; provide required notices and obtain consent where needed; give lawful and necessary instructions; manage permissions, sharing links and consultants; maintain accuracy; and avoid special-category human data unless it is necessary, lawful and suitably protected. It is responsible for the content and legal basis of SMS and email sent through the platform, including direct-marketing rules.
5. Subprocessors
5.1. The Organization generally authorizes providers in the current Subprocessor List.
5.2. A subprocessor is bound in writing by materially corresponding data-protection obligations. Telvo LLC remains responsible to the Organization within the limits of law and the parties' agreement.
5.3. We generally give 30 days' advance notice of a new subprocessor or material function change. The Organization may raise a reasoned objection based on a real data-protection risk. If no reasonable solution exists, the function will not be used or either party may end the service.
6. Data-subject requests
Telvo LLC forwards requests concerning Organization-controlled data without undue delay and does not answer substantively unless authorized or legally required. Considering the nature and available functions, it reasonably assists with locating, copying, correcting, blocking, restricting and deleting data. Some requests may require manual work.
7. Security and incidents
7.1. Each party applies measures appropriate to category, volume, purpose and risk. The Organization is responsible for its devices, users and access settings; Telvo LLC for the platform components under its control.
7.2. On discovering an actual or suspected incident affecting Organization data, Telvo LLC begins assessment, containment, recovery and documentation; notifies the Organization without undue delay; and progressively provides available information on nature, likely scope, consequences, contact and measures.
7.3. The Organization decides and makes regulator and data-subject notifications as controller, unless law provides otherwise. Telvo LLC provides reasonable assistance.
8. Return, deletion and term
8.1. This DPA applies while Telvo LLC processes data for the Organization.
8.2. At termination the Organization may request reasonable assistance returning available data or deletion through the contact page.
8.3. Deletion is completed within a reasonable period subject to law, technical feasibility and backup cycles. Legally retained data is not processed for another purpose.
9. International transfers
9.1. Main application infrastructure is in DigitalOcean's Frankfurt region, Germany. Other locations are stated in the current Subprocessor List.
9.2. Transfers outside Georgia use a basis and safeguards permitted by applicable law. If they cannot be established for an optional function, that function must not be enabled for Organization data.
10. Information and audits
10.1. On written request, Telvo LLC provides reasonable available compliance information once per year. An additional review is permitted after a significant incident or regulator request.
10.2. On-site or technical review requires advance agreement, must protect security and other customers, and is limited to relevant evidence. The requester bears external cost unless a material breach is found.
11. Changes and priority
We generally give at least 30 days' notice of a material DPA change and request renewed acceptance where needed. This DPA prevails over the Terms on Organization-data processing. The Georgian text prevails if the English translation is inconsistent.
Annex A — Processing details
| Item | Description |
|---|---|
| Subject | Provision of the vetman platform to the Organization |
| Duration | Service term plus the time needed for return, deletion, mandatory retention and backup cycles |
| Nature | Collection through the interface, organization, storage, search, display, alteration, document creation, instructed disclosure, backup and deletion |
| Purpose | Management functions for veterinary clinics, shops, shelters, pet hotels and related operations |
| Data subjects | Clients and representatives, staff, consultants, supplier contacts and others whose data the Organization lawfully enters |
| Data | Identification, contact, financial, activity and technical data, and information and files in animal-related records |
Animal health records are not human special-category data. If the Organization enters human special-category data in free text or files, it is responsible for necessity, legal basis and safeguards.
Annex B — Technical and organizational measures
Current measures include HTTPS and HSTS; password hashing and password-quality checks; account and IP sign-in rate limits; 8-hour inactivity and 24-hour absolute session limits with Secure, HttpOnly, SameSite=Lax; role-based access, tenant filtering and restricted consultant access; authorization checks before file delivery; AES-256-GCM encryption for SMTP and SMS secrets; audit of significant writes, sign-ins, sharing-link openings and administrator impersonation; and database/file backups with changes first checked in a test environment.
Measures are reviewed as risk, technology and the service change. This Annex does not represent a planned measure as already implemented.