Data Processing Agreement
Effective from 4 November 2026.
1. SCOPE AND PARTIES
1.1. This Data Processing Agreement (DPA) forms part of the Terms of Service between Customer and OVERVIS OÜ (“Overvis”). It applies where Overvis processes personal data on behalf of Customer in providing the System. Terms defined in the Terms of Service have the same meaning in this DPA.
1.2. Customer is the controller, or a processor acting on behalf of its own controller, of the personal data that Customer or its Agents submit to the System or that the System collects from Customer’s equipment (“Customer Personal Data”). Overvis is the processor, or the sub-processor, of Customer Personal Data.
1.3. This DPA does not apply to personal data that Overvis processes as a controller, such as account, billing and usage data. That processing is described in the Privacy Policy.
1.4. “GDPR” means Regulation (EU) 2016/679. The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them in the GDPR.
1.5. Where this DPA and the Terms of Service differ on the processing of Customer Personal Data, this DPA prevails.
2. DETAILS OF THE PROCESSING
2.1. Subject matter: the provision of the System under the Terms of Service.
2.2. Duration: the term of the Terms of Service, and the period after it until Customer Personal Data is deleted under section 10.
2.3. Nature and purpose: hosting, storing, transmitting, displaying, analysing and deleting data as needed to provide the System, including reading and writing values on Customer’s equipment, running automations, sending notifications and answering requests to the AI assistant.
2.4. Types of personal data: names, email addresses, phone numbers and other contact details of users and recipients of notifications; the content of messages to the AI assistant, files, dashboards and other content created in the System; activity history and logs; and any personal data contained in readings from equipment or otherwise entered by Customer.
2.5. Categories of data subjects: Customer’s employees, contractors and other users invited to its workspaces, recipients of notifications, and any other persons whose personal data Customer enters into the System.
2.6. Customer will not submit to the System special categories of personal data under Article 9 GDPR or personal data relating to criminal convictions and offences.
3. INSTRUCTIONS
3.1. Overvis processes Customer Personal Data only on Customer’s documented instructions, including with regard to transfers to third countries, unless required to do so by European Union or Member State law. In that case Overvis informs Customer of that legal requirement before the processing, unless that law prohibits it.
3.2. The Terms of Service, this DPA, and Customer’s use and configuration of the System, including the settings, automations and requests made through its account, the API or the AI assistant, are Customer’s complete instructions. Additional instructions require Overvis’s written agreement.
3.3. Overvis informs Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.
3.4. Customer is responsible for the lawfulness of the processing, including having a legal basis for it and giving data subjects the information required by law.
4. CONFIDENTIALITY
4.1. Overvis ensures that the persons it authorises to process Customer Personal Data are bound by confidentiality, and gives them access only as needed to provide the System, support Customer, keep the System secure or comply with the law.
5. SECURITY
5.1. Overvis implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. Overvis may change these measures, provided that the overall level of security is not reduced.
5.2. Customer is responsible for the security of its account, the sign-in methods and API keys of its users, the roles it assigns, and its own equipment and networks.
6. SUB-PROCESSORS
6.1. Customer gives Overvis general authorisation to engage sub-processors. The current sub-processors are listed in Annex 1.
6.2. Overvis informs Customer of any intended addition or replacement of a sub-processor by updating Annex 1 before the change takes effect. Customer may object to the change on reasonable data protection grounds by writing to support@overvis.com before it takes effect. If the Parties cannot resolve the objection, Customer’s sole remedy is to stop using the System and delete its account.
6.3. Overvis imposes on each sub-processor data protection obligations that are in substance the same as those in this DPA, and remains liable to Customer for the performance of its sub-processors’ obligations.
7. INTERNATIONAL TRANSFERS
7.1. Overvis transfers Customer Personal Data outside the European Union or the European Economic Area, including to the providers of AI models described in section 6 of the Terms of Service, only where the conditions of Chapter V GDPR are met, for example under an adequacy decision, including the EU-U.S. Data Privacy Framework, or under the Standard Contractual Clauses adopted by the European Commission.
8. ASSISTANCE
8.1. Taking into account the nature of the processing, Overvis assists Customer by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights. Customer can view, export, correct and delete most Customer Personal Data itself in the System. Overvis forwards to Customer any request from a data subject it receives about Customer Personal Data and does not answer it itself unless Customer instructs it to.
8.2. Taking into account the nature of the processing and the information available to Overvis, Overvis assists Customer in meeting its obligations under Articles 32 to 36 GDPR on security, notification of personal data breaches, data protection impact assessments and prior consultation.
8.3. Overvis may charge for assistance beyond the functions available in the System.
9. PERSONAL DATA BREACHES
9.1. Overvis notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, by email to the address of Customer’s account. The notice describes, as far as it is known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. The information may be provided in phases.
9.2. A notification of a personal data breach is not an acknowledgement of fault or liability by Overvis.
10. DELETION
10.1. When the provision of the System ends, Overvis deletes Customer Personal Data as described in section 11.4 of the Terms of Service, unless European Union or Member State law requires its storage. During the period given there, Customer can download its data with the tools available in the System.
10.2. Copies of Customer Personal Data in backups, if any, are deleted when those backups are replaced in the ordinary course.
11. AUDITS
11.1. On written request to support@overvis.com, Overvis makes available to Customer the information necessary to demonstrate compliance with Article 28 GDPR.
11.2. Where that information is not sufficient, Overvis allows audits, including inspections, by Customer or by an auditor mandated by Customer and bound by confidentiality. An audit may take place at most once a year, with at least 30 days’ notice, during business hours, without disrupting the System and without access to the data of other customers. Customer bears the cost of the audit, including Overvis’s reasonable time.
12. FINAL PROVISIONS
12.1. Each Party’s liability under this DPA is subject to the limitations of liability in the Terms of Service, to the extent permitted by the GDPR.
12.2. This DPA is governed by the same law, and disputes under it are resolved by the same court, as the Terms of Service.
12.3. Overvis may change this DPA in the same way as the Terms of Service, provided that the changes do not reduce the protection required by the GDPR.
ANNEX 1. SUB-PROCESSORS
| Sub-processor | Location | Purpose |
|---|---|---|
| Hetzner | Germany | Hosting of the System and storage of its data |
| United States | Maps, address lookups and email correspondence | |
| Mailgun | United States | Notification emails |
| seven | Germany | SMS notifications |
| Sentry | United States | Error and crash reports, and session recordings with text and inputs masked |
| OpenRouter | United States | Passing requests to the AI assistant to the providers of AI models |
| Providers of AI models | Mostly United States | Answering requests to the AI assistant |
Notifications that Customer chooses to receive through Telegram are delivered by Telegram, which Customer’s users use under its own terms.
ANNEX 2. TECHNICAL AND ORGANISATIONAL MEASURES
- Encryption in transit. Browsers connect to the System over HTTPS. Each device connects through its own encrypted VPN tunnel, and the VPN carries no traffic between devices.
- Sign-in without passwords. Users sign in with a passkey, a one-time code by email or from an authenticator app, or single sign-on with the customer’s identity provider.
- Access control. Every workspace has its own members, roles and equipment. Roles range from View only to Owner, every API call runs with the rights of the user or key that makes it, and a workspace API key works only in its own workspace.
- Safe writes. Values can have limits, and writes outside them are refused. The AI assistant changes nothing on a device until a person approves the change.
- Activity history. Changes in a workspace are recorded in its activity history, which Customer can view and export.
- Retention. Customer can set how long readings are kept; older readings are then deleted automatically.
- Hosting. The System’s data storage is hosted by Hetzner in Germany.
- Staff access. Access by Overvis staff to Customer Personal Data is limited to what is needed to operate, support and secure the System, and staff are bound by confidentiality.