Data Processing Agreement

Last updated: 15 October 2026

1. About this agreement

This Data Processing Agreement (DPA) applies to customers of the Team, Business and Enterprise plans ("the Customer") who use valtrinity.com to process personal information on behalf of their business. It is between the Customer and Granwel Technologies LTD, company number 17419846, Suite Ra01, 195-197 Wood Street, London, England, E17 3NU ("we", "the Processor"). It forms part of the agreement under our Terms of Service and your order or invoice. If the two conflict on the processing of personal information, this DPA applies.

It is written to meet Article 28 of the UK GDPR and, where it applies, Article 28 of the EU GDPR. "Controller", "processor", "personal data", "data subject", "personal data breach" and "processing" have the meanings given in those laws.

2. Roles

For the content the Customer and its users put through the service, the Customer is the controller and we are the processor. For the account data of the Customer's users (such as email addresses, sign in details and plan state) and for our own security, fraud prevention, billing and legal duties, we are an independent controller, as described in our Privacy policy. This DPA covers only the processing for which we are the Customer's processor.

3. Subject matter, duration, nature and purpose

4. What we do as processor

We will:

• process personal data only on the Customer's documented instructions, which are this DPA and the Customer's use of the features of the service. We will tell the Customer if we think an instruction breaks data protection law, unless the law forbids us from telling;
• make sure people allowed to process the data are bound by confidentiality;
• apply the security measures in Section 6;
• respect the conditions on subprocessors in Section 5;
• help the Customer, taking account of the nature of the processing, to answer requests from data subjects. If a data subject contacts us about the Customer's data, we will pass the request on to the Customer without undue delay and not reply except to say that we have done so;
• help the Customer meet its duties on security, breach notification, data protection impact assessments and prior consultation, taking account of the information available to us;
• delete or return personal data as set out in Section 11;
• give the Customer the information needed to show we comply with Article 28, and allow audits as set out in Section 9.

The Customer will give instructions lawfully, will make sure it has the right to submit the data, and will tell us promptly if an instruction needs to change.

5. Subprocessors

The Customer gives general authorisation for the subprocessors on our subprocessors page. Before we add or replace a subprocessor that processes the Customer's personal data, we will give the Customer at least 30 days' notice by email to the address on the account, or by updating the subprocessors page and emailing those who asked to be told. The Customer may object on reasonable data protection grounds within that time. If we cannot resolve the objection, the Customer may end the affected plan and we will refund the unused part of the current period. We will place data protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible for their performance.

6. Security measures

We apply technical and organisational measures suited to the risk. They are described on our Security page and include TLS for data in transit; encryption at rest by Microsoft Azure; scrypt password hashing; signed session cookies; server side enforcement of limits and ownership; short lived, scoped upload and read links; outbound request guards; Stripe webhook signature checks; secrets held in platform settings; access to stored data limited to the API and the company through the Azure portal; and server logs kept for 90 days. We may improve these measures but will not reduce overall security during the term.

7. Personal data breaches

We will tell the Customer without undue delay and in any event within 48 hours after becoming aware of a personal data breach affecting the Customer's personal data. The notice will say, as far as we then know, what happened, the categories and approximate numbers of people and records affected, the likely consequences and what we have done or propose to do. We will give further information as it becomes available and help the Customer with its own notifications.

8. International transfers

Customer personal data is stored and processed in the UK (Microsoft Azure, UK South). A transfer outside the UK can happen through subprocessors, for example support access from other regions, or the US-based recipients on the subprocessors page. We will make such a transfer only where a lawful safeguard is in place, which can be the UK Addendum to the EU Standard Contractual Clauses, the International Data Transfer Agreement, or certification under the UK Extension to the EU US Data Privacy Framework. Where the Customer is in the EEA, the parties agree that the EU Standard Contractual Clauses (Module Two, controller to processor) apply to any restricted transfer, with the details in this DPA completing the annexes, and the UK Addendum applies to restricted transfers from the UK.

9. Audits

On reasonable written request we will give the Customer the information needed to show we comply with this DPA. If that is not enough, we will allow an audit, by the Customer or an auditor it appoints who is bound by confidentiality, no more than once in any 12 months (or after a personal data breach), on at least 30 days' notice, during working hours, in a way that does not disrupt the service or reveal other customers' data. The Customer bears the cost of the audit. Where the audit is of a subprocessor, it is limited to what the subprocessor's agreement allows, and we will give the Customer the subprocessor's available audit reports.

10. Retention while the plan is active

We keep the Customer's content only for the periods described in the Privacy policy: uploaded media is deleted as soon as transcription finishes or fails and always within 24 hours, transcripts after 30 days or on deletion by the user, and saved domains or sites until they are removed. The Customer can delete transcripts at any time.

11. Deletion at the end

When the plan ends, we will delete the Customer's personal data we hold as processor, including saved domains and sites, within one month of a written request, or in any event under the periods above and our inactive account rule (24 months, with a warning email), unless the law requires us to keep a copy. At the Customer's request before deletion we will return transcripts that are still held. We will confirm deletion in writing on request.

12. Liability

Liability under this DPA is subject to the limits and exclusions in the Limitation of liability section of our Terms of Service. Nothing in this DPA limits liability that cannot be limited by law, and nothing limits a data subject's rights.

13. General

This DPA is governed by the law of England and Wales and the courts of England and Wales have jurisdiction, as set out in the Terms. We may update it to reflect changes in the law or the service, with at least 30 days' notice to the Customer. To ask us to sign a copy of this DPA, or for the details in the annexes for a transfer clause, email [email protected] or [email protected].

14. Contact

Data protection questions: [email protected]. Granwel Technologies LTD, company number 17419846, Suite Ra01, 195-197 Wood Street, London, England, E17 3NU.