GDPR Art. 28 · Talivio Technology OÜ
Data Processing Agreement
Last updated: July 10, 2026 · v1.1
When Does a DPA Apply?
A signed DPA is required when your organisation submits briefing documents or simulation inputs that contain personal data about identifiable individuals (e.g., named public figures, employees). This is separate from VoxSim's own data processing as described in the Privacy Policy.
1. Parties
This Data Processing Agreement ('DPA') governs the processing of personal data by Talivio Technology OÜ ('Processor') on behalf of the subscribing organisation ('Controller') in connection with the VoxSim service.
Controller
Your organisation
The entity that subscribes to VoxSim and determines the purpose of processing
Processor
Talivio Technology OÜ
Ahtri tn 12, 15551 Tallinn, Harju maakond · Estonia · VoxSim platform operator
2. Description of Processing
The following describes the personal data processing performed by the Processor under this DPA:
| Subject matter | LLM-assisted analysis of documents submitted to VoxSim |
| Nature | Collection, storage, analysis, and deletion |
| Purpose | Generating synthetic society simulation outputs for the Controller |
| Duration | For the term of the subscription, plus 30 days post-termination |
| Data types | Names, roles, or identifiers of public figures mentioned in briefing inputs (if provided by Controller) |
3. Processor Obligations
Talivio Technology OÜ shall:
- Process personal data only on documented instructions from the Controller
- Ensure that authorised personnel are bound by confidentiality
- Implement appropriate technical and organisational security measures
- Assist the Controller in fulfilling data subject rights requests
- Delete or return all personal data upon request or at end of term
- Notify the Controller without undue delay, and no later than 48 hours, after becoming aware of a personal data breach
4. Sub-processors
The Processor uses the following sub-processors, each covered by a DPA or SCCs. Stripe (payments) acts as an independent controller and Google Analytics is not a sub-processor of Controller data; both are described in the Privacy Policy and are therefore not listed here:
- Google LLC (Gemini paid API) — USA · EU-U.S. Data Privacy Framework + Standard Contractual Clauses (Google Cloud DPA); paid tier — no training use
- Wildbit LLC (Postmark) — USA · Standard Contractual Clauses (SCCs) applied
- Hetzner Online GmbH — Germany · Within EU
- Scaleway SAS — France · Within EU
5. International Transfers
Where personal data is transferred outside the European Economic Area (EEA), such transfers are made under Standard Contractual Clauses (SCCs) approved by the European Commission. The primary processing infrastructure is located within the EU.
6. Audit Rights
The Controller may audit the Processor's compliance with this DPA up to once per year, upon 30 days written notice, during normal business hours. Audit costs are borne by the Controller unless a material non-compliance is found.
Request a Signed DPA
If your organisation requires a countersigned DPA document (e.g., for procurement or compliance purposes), contact us and we will provide a signed copy within 5 business days.
Request signed DPAQuestions about this document? [email protected]