Legal

Data Processing Agreement (DPA)

DRAFT, NOT LEGAL ADVICE. This page is plain-language scaffolding that describes Viraldico's intended data practices. It must be reviewed and finalized by a qualified attorney before launch, and every placeholder must be filled. Do not treat it as a binding agreement yet.

1. Parties and roles.

This DPA is between [LIBRARY/ORGANIZATION] ("Controller") and [VIRALDICO LEGAL ENTITY] ("Processor"), and supplements the service or pilot agreement. For data the partner controls, Viraldico acts as a processor, processing only on documented instructions.

2. Scope and purpose.

Viraldico processes data solely to provide the book-club service described in the agreement, and for no independent purpose. Viraldico does not sell partner or patron data and does not use it to train AI.

3. Patron privacy by design.

For library-hosted clubs, Viraldico supports mediated participation in which patrons take part without accounts and no individual patron reading history is stored. Program data is processed in aggregate. This design is intended to align with state reader/library-confidentiality laws and the California Reader Privacy Act where applicable.

4. Confidentiality.

Personnel with access to partner data are bound by confidentiality obligations.

5. Security.

Viraldico maintains technical and organizational measures including encryption in transit and at rest, access controls, and [OTHER MEASURES]. See /security.

6. Subprocessors.

Viraldico uses the subprocessors listed at [SUBPROCESSOR LIST URL] (hosting, payments, email), under contracts imposing equivalent protections, and will give notice of changes per [NOTICE TERMS].

7. Data subject and patron requests.

Viraldico will assist the partner in responding to access, correction, or deletion requests as required by law.

8. Breach notification.

Viraldico will notify the partner without undue delay, and within [N HOURS], after becoming aware of a personal-data breach, with the information the partner needs to meet its own obligations.

9. Return and deletion.

On termination, Viraldico will return or delete partner data per the partner's instruction, within [N DAYS], except where retention is legally required.

10. Audit.

Viraldico will make available information reasonably necessary to demonstrate compliance, subject to [REASONABLE AUDIT TERMS].

11. Term.

This DPA lasts for the duration of the service agreement.

Contact: [PRIVACY/LEGAL EMAIL].