Data processing

Parties

  • Agreement under Art. 28 GDPR between the customer (controller) and Vauri (processor, see imprint). It is concluded electronically when signing up and applies as long as the account exists.

Subject, data, data subjects

  • Providing Vauri: storing and showing boards, running live sessions.
  • Data: board titles and elements, pseudonyms and anonymous IDs of guests. Data subjects are the controller's clients.
  • Identifying data (real names, dates of birth, health information, contact details) is not intended and must not be entered.

Instructions

  • We process the data only on the controller's instructions, as given by the terms of use and by using Vauri. If we consider an instruction unlawful, we say so.

Confidentiality (§ 203 German Criminal Code)

  • We bind ourselves and everyone who may have access to the data to secrecy, also after the agreement ends.
  • We are aware that, as contributing persons, we are liable to prosecution under § 203(4) StGB for unauthorised disclosure of third-party secrets. We only take note of content where strictly necessary for operation.

Technical and organisational measures

  • Encrypted transfer, storage in Frankfurt, encrypted database, access to your own data only, passwords as hash only, logs without board content, invitation codes only in the link fragment.

Sub-processors

Assistance

  • We help with data subject requests (export and deletion in the account) and report personal data breaches without undue delay, within 48 hours at the latest (Art. 33, 34 GDPR).
  • On request we provide the necessary evidence and allow audits by arrangement.

End of the agreement

  • After a trial or subscription ends, data can be exported for 90 days and is deleted afterwards; immediately when the account is deleted. Backups are overwritten within 30 days.

Version

  • October 2026 (2026-10)