Data Processing Agreement

Last updated 10 October 2026

Roles and scope

This Data Processing Agreement (“DPA”) applies where an organisation (the “Customer”, controller) uses Vigil and Rora Labs Ltd (“RoraLabs”, processor) processes personal data on its behalf under Article 28 UK GDPR. A countersigned copy is available on request from [email protected].

Processing details

• Subject matter and duration: provision of Vigil for the term of the Customer's subscription.
• Nature and purpose: collection and analysis of endpoint information to diagnose and remediate IT issues, and to keep an audit trail.
• Data subjects: the Customer's staff and device users.
• Personal data: hostname, serial number, machine ID, username, Windows event logs and process lists, issue descriptions, action history.

Processor obligations

• Process only on the Customer's documented instructions (this DPA and use of the service).
• Confidentiality of all personnel with access.
• Security measures proportionate to risk, including tenant isolation, encryption in transit, access controls and logging.
• Engage only the sub-processors on the sub-processor list; notify the Customer at least 30 days before adding or replacing one, giving the Customer the right to object.
• Assist with data subject requests, security, DPIAs and consultations.
• Notify the Customer without undue delay and within 48 hours of becoming aware of a personal data breach.
• Delete or return Customer data within 30 days of the end of the service, and make available information needed to show compliance, allowing reasonable audits.

Retention

Operational data is retained for 90 days, then cleared or pseudonymised using a keyed hash, as described in the Privacy Policy.

Cloud AI fallback

The Customer instructs RoraLabs to use the cloud AI fallback described in the Privacy Policy unless the Customer disables it. A per-tenant switch to disable it is being introduced; until then the Customer may request disablement by email.

International transfers

Transfers to sub-processors outside the UK are made under the UK International Data Transfer Addendum, the UK Extension to the EU-US Data Privacy Framework, or another lawful mechanism listed on the sub-processor page.

Erasure procedure

To erase a device, user or tenant data, the Customer's administrator emails [email protected]. We delete it and confirm within 30 days.