Updated 21 October 2026
Data processing addendum
Terms for any agreed processing of customer personal data by SIA Vietne on behalf of a Licitu business customer.
When this addendum applies
This addendum applies only where a written service agreement identifies SIA Vietne as processor of personal data on behalf of a business customer and incorporates this addendum. It does not turn ordinary public profiles, member accounts or Licitu’s independent publication activities into processor services. SIA Vietne’s controller activities are described in the Privacy Policy. No private customer-processing workspace is included merely by opening a standard Licitu account.
Parties and processing instructions
SIA Vietne, registration 40103048838, Ozolciema iela 46 k-5 – 35, Rīga, LV-1058, Latvia, is the processor for the processing expressly agreed with the customer as controller. The processor will act only on documented lawful instructions, including instructions concerning international transfers, except where applicable law requires otherwise. The processor will inform the customer if an instruction appears to infringe applicable data protection law.
Processing schedule
Before customer-directed processing begins, the written service agreement must specify its subject matter and duration, purpose, operations, categories of data subjects and types of personal data. It must also identify the authorised users, applicable retention or return arrangements and any additional safeguards. Special-category or criminal-conviction data is outside the default scope and requires separate written agreement.
Customer responsibilities
The customer determines the lawful purposes and legal basis, supplies required notices and instructions, and remains responsible for the personal data it asks SIA Vietne to process. The customer must not instruct unlawful processing or provide data outside the agreed scope.
Confidentiality and security
Persons authorised to process customer data must be subject to confidentiality obligations. SIA Vietne will maintain measures appropriate to the agreed processing and its risks, including access restrictions, authenticated server access and encrypted network connections. The specific security schedule must reflect the deployed service; this addendum does not assert certifications, backup schedules or security controls that have not been agreed or implemented.
Subprocessors
The customer authorises the providers specifically listed in the agreed processing schedule. Supabase provides Licitu’s hosted authentication and database services, with the project configured in Frankfurt. Additional hosting or delivery providers must be identified before use for customer data. SIA Vietne will impose appropriate contractual data-protection duties on subprocessors, remain responsible for its obligations, and give advance notice of proposed additions or replacements with a reasonable opportunity to object.
Assistance and incidents
Taking account of the nature of processing and information available, SIA Vietne will assist with data-subject requests, security obligations, impact assessments and consultations. It will notify the customer without undue delay after becoming aware of a personal data breach affecting the agreed customer data, provide available relevant information and updates, and cooperate with investigation and remediation.
Transfers
Transfers outside the EEA must comply with applicable GDPR requirements and the agreed instructions. Where needed, the parties will put in place an appropriate transfer mechanism and supplementary safeguards before the transfer. The customer may request information about the applicable arrangements.
Return, deletion and audits
At the end of the agreed processing, SIA Vietne will, at the customer’s choice, return or delete customer personal data and delete existing copies unless law requires retention. Timing and treatment of any backup copies must be specified in the processing schedule. SIA Vietne will provide information necessary to demonstrate compliance and allow and contribute to proportionate audits and inspections, subject to confidentiality and reasonable security arrangements.
Precedence and contact
For processing within its scope, this addendum takes precedence over conflicting general service terms. Mandatory data protection law remains applicable. To arrange a processing schedule or raise a data-protection question, contact privacy@otnox.com and identify Licitu and your organisation.
Ozolciema iela 46 k-5 – 35, Rīga, LV-1058, Latvia
privacy@otnox.com