Last updated: September 30, 2026
Introduction
This Data Processing Agreement forms part of the agreement between you (the Controller) and ViraKeys (the Processor) for the use of the ViraKeys service. It sets out how we process personal data on your behalf in accordance with the UK GDPR, the EU General Data Protection Regulation (2016/679), and the Data Protection Act 2018.
Definitions
Controller means you, the customer, who determines the purposes and means of processing personal data.
Processor means ViraKeys, who processes personal data on your behalf.
Personal Data means any information relating to an identified or identifiable natural person.
Processing means any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and deletion.
Sub-processor means any third party engaged by ViraKeys to process personal data in connection with the service.
Data Processing Details
We retain active account and license records while your account remains open to provide the service. Account termination and a verified deletion request are different events: termination alone does not mean that every record is permanently deleted after a fixed period. Following a verified deletion request, we delete or de-identify personal account data within a reasonable period, generally within 30 days, unless a longer period is needed for accounting, tax, payment disputes, fraud prevention, security investigations, legal obligations, or marketplace authorization and transaction history. We restrict any retained records to those purposes.
Operational recovery copies are separate from active records. Our encrypted database backups are configured to expire after 30 days and expired copies are removed when backup maintenance runs. Data removed from active records may remain in existing recovery copies until those copies rotate; hosting-provider backups may follow separate retention schedules. We do not promise immediate erasure from every recovery copy upon termination or a deletion request.
If you enable optional license exports to Google Drive or pCloud, CSV files are saved in your connected cloud account, not as persistent export copies on ViraKeys servers. These files are separate from active account records and operational backups. ViraKeys records the identifiers of exports it creates and checks for exports that have reached 30 days of age each hour. It deletes verified, tracked exports at the next successful check after that age, including when automatic exporting is disabled. When you disconnect a provider through ViraKeys, we first try to delete its tracked exports and the previously stored export reference. If deletion fails, the disconnection is not confirmed, the connection and file reference are retained for a retry, and you are shown an error. If you revoke provider access outside ViraKeys before deletion, we may be unable to remove exports; you should remove them directly in your cloud account. Older files whose identifiers were lost before export tracking began cannot safely be identified for automatic deletion and may also need to be removed by you. We do not delete unrelated files or product ZIPs.
We process data solely to provide and improve the ViraKeys service. We do not process personal data for our own commercial purposes and we never sell it to third parties.
Types of Personal Data Processed
Account data: name, email address, company name. Usage data: login timestamps, feature usage, session identifiers. Team member data: names and email addresses of invited team members. Billing data: billing name and address (full card details are processed by Stripe directly and never stored by us).
Categories of Data Subjects
Your account holders and administrators; team members you invite to your ViraKeys account; and any individuals whose personal data you upload as part of license records.
Controller Obligations
As Controller, you agree to ensure you have a lawful basis for any personal data you provide or store within ViraKeys; ensure any personal data you upload complies with applicable data protection law; provide clear privacy notices to data subjects (such as invited team members); and respond to data subject rights requests promptly.
Processor Obligations
As Processor, ViraKeys agrees to process personal data only on your documented instructions; ensure all personnel with access to personal data are bound by appropriate confidentiality obligations; implement and maintain appropriate technical and organisational security measures; notify you without undue delay (and within 72 hours where feasible) of any personal data breach affecting your data; provide reasonable assistance to help you fulfil data subject rights requests; and, upon termination of the agreement, delete or return personal data processed on your behalf, subject to applicable legal retention requirements and the recovery-copy lifecycle described above. A verified deletion request is handled as described under Data Processing Details.
Sub-Processors
We engage the following sub-processors to deliver the service. We will notify you at least 14 days before adding or replacing any sub-processor.
Hosting provider: Hostinger VPS — Infrastructure hosting — EU/UK
Payment processor: Stripe — Secure payment processing — USA (SCCs in place)
AI features (optional): OpenAI — AI-assisted draft features when enabled — USA (SCCs in place)
Data Subject Rights
We will assist you in responding to requests from data subjects exercising their rights under GDPR, including rights of access, rectification, erasure, portability, restriction, and objection. Contact us at privacy@virakeys.com.
Security Measures
We implement the following protections: encryption of data in transit using TLS 1.3; encryption of sensitive fields at rest using AES-256; access controls and least-privilege principles for staff; regular security assessments and dependency auditing; and automated backups with point-in-time recovery.
International Transfers
Where personal data is transferred outside the UK or EEA (for example to Stripe or OpenAI in the USA), such transfers are governed by Standard Contractual Clauses approved by the relevant supervisory authority.
Contact and Supervisory Authority
Data protection contact: privacy@virakeys.com
You have the right to lodge a complaint with your relevant supervisory authority. In the UK this is the Information Commissioner's Office at ico.org.uk. In the EU, contact your local Data Protection Authority.