Privacy Notice & Data-Processing Agreement
Applies to every VYVA solution. Your selected vertical and enabled services determine the relevant operational provisions.
1. Who is responsible and how to contact us
MOKA DIGITECK, SOCIEDAD LIMITADA, NIF B16929804, trading as VYVA, is the controller for its own website, applications, business accounts, security administration, customer relationships and legal records. Address: Urbanización Sierra Blanca, Cascada de, número 311, 29602 Marbella (Málaga), Spain. Commercial Registry of Málaga: sheet MA163207, section 8; incorporation volume 6075, book 4982, folio 162.
Privacy contact: dpo@mokadigital.net. A “dpo” mailbox does not itself represent that a statutory data-protection officer appointment or regulatory registration has been made.
For information an organisation uploads to deliver care, residential, community, safety or response services, that organisation normally determines the purposes and is the controller; VYVA is its processor. If the organisation is a processor, VYVA acts as its authorised subprocessor. Contact the relevant organisation about its service-user records. We will help route requests where appropriate.
2. Information, sources, purposes and legal bases
We receive information from applicants and users, their organisations and authorised representatives, people they lawfully involve, enabled connected services, and technical service operation. We may check public professional or business registers when reviewing applications. Patient and service-user records are not required for organisation registration.
| Information | Purpose and legal basis for VYVA’s controller activities |
|---|---|
| Names, business email, role, telephone, organisation identity, location and registration details | Applications, authority/qualification checks, enquiries and customer administration. Contract or pre-contract steps where the individual is a party; otherwise legitimate interests in dealing with organisational representatives and providing a secure business service. |
| Account identifiers, verification, invitations, permissions and legal acceptance records | Authentication, access allocation and evidence of agreement. Contract where applicable and legitimate interests in security, access governance and legal accountability. |
| IP, browser/device information, timestamps, request/security events and essential session identifiers | Delivery, security, fraud prevention and fault investigation. Legitimate interests in a secure and reliable service, and a legal obligation where a specific duty applies. |
| Support, billing and statutory records | Requests, agreed services, accounting/tax obligations and legal claims. Contract where applicable, relevant legal obligations and legitimate interests in resolving disputes. |
| Optional marketing choices and permissions | Only the separately explained purpose and lawful basis. Where consent is required, it is separate and withdrawable without affecting earlier lawful processing. |
Required fields are needed to assess applications or provide secure access; without them we may be unable to proceed. Optional fields may be blank. You may object to legitimate-interest processing and request our assessment. We do not sell personal information or use Customer operational content for targeted advertising or general-purpose AI training.
3. Operational and sensitive information
Depending on the enabled solution, the Customer may instruct processing of identity and contacts, staff assignments, appointments and visits, support/care plans, clinical handovers, wellbeing and safeguarding observations, cases, tasks, incidents, lawful locations, response status and communications. Health, disability, children’s and other sensitive information require additional safeguards and the Customer’s valid legal bases. Acknowledging this notice does not supply those bases.
The DPA and processing schedule below govern that information. Do not enter real sensitive data into demos or unapproved setup workspaces. Recording, transcription, AI tools, precise location, surveillance and external communications require separately configured lawful purposes, notices, approved providers and applicable permissions before use.
4. Recipients, providers and locations
Access is limited to authorised organisational users, VYVA personnel and providers who need it. We may disclose information to professional advisers, regulators and courts where necessary and lawful, and to an authorised business successor subject to appropriate protection and notice.
| Provider / service | Purpose and data | Location and status |
|---|---|---|
| Supabase and its infrastructure subprocessors | Database, authentication and related infrastructure; account and authorised workspace records. | Current primary project region: EU West (Ireland), eu-west-1. Management, support and disclosed subprocessors can involve Singapore, the United States and other listed locations. The database region does not mean all processing remains in the EEA. |
| OpenAI Sites hosting and Cloudflare | Application execution, hosting, delivery and security; requests, response content and necessary technical metadata. | International infrastructure and global edge processing. Public VYVA email registration does not require a personal ChatGPT account. Hosting is distinct from an AI-model conversation. |
| Resend (Plus Five Five, Inc.) and delivery providers | Account/invitation email; recipient, necessary content and delivery events. Clinical records must not be included in account emails. | United States and provider delivery infrastructure. Transactional invitation delivery is enabled. |
| Optional voice, telephony, AI and customer-selected integrations, including ElevenLabs or Twilio where separately approved | Only data needed for the enabled function, potentially contacts, audio, transcripts or incidents. | Not automatically authorised by registration. Live voice calls are disabled in the current shared onboarding configuration. Provider, region, retention and safeguards require disclosure and approval in the Customer’s processing schedule before activation. |
The links explain providers’ own downstream providers. Customer-connected services may be independent controllers under their terms. An integration is not approved for sensitive data merely because credentials exist or a provider offers a compliance feature.
5. International transfers
Providers, support and enabled integrations may process or access data outside the EEA. Restricted transfers must have a lawful GDPR Chapter V mechanism: applicable adequacy (including an eligible, currently certified recipient where relevant) or applicable European Commission Standard Contractual Clauses, with a transfer assessment and supplementary safeguards where needed. A privacy acknowledgement is not consent to unrestricted overseas transfers.
Ask our privacy contact for information about applicable safeguards and an accessible copy or description, subject to lawful redactions. If safeguards or a required schedule cannot be established, the affected processing must not be enabled. An EU-only commitment requires an expressly agreed, technically supported service schedule.
6. Retention and deletion
This is VYVA’s operating policy. Deletion and restriction requests are handled through our privacy contact; this notice does not imply every category has an automated deletion job. We review retention needs and keep only necessary information.
| Category | Default rule |
|---|---|
| Abandoned application drafts | Delete or anonymise within 90 days of last meaningful activity, unless the applicant asks to continue or another documented lawful purpose applies. |
| Rejected or withdrawn applications | Up to 12 months after the final decision or withdrawal for enquiries, review and proportionate misuse prevention. Keep only limited evidence longer where legally necessary. |
| Active business accounts and contacts | The relationship and necessary closure work. Remove unused access promptly when notified. Limited contract, acceptance and dispute evidence may be restricted for up to six years after closure, or a different applicable legal limitation period. |
| Billing and statutory records | The applicable statutory period; Spanish commercial-accounting records generally require six years. A longer legal hold applies only to relevant records and purpose. |
| Routine security and support records | Normally no longer than 12 months after the event or request closure. Relevant evidence may be isolated for a documented incident, investigation or legal claim. |
| Operational records, recordings and transcripts | The Customer’s documented category-specific schedule during service. Onboarding imposes no generic clinical-record period. At termination: 30 days for return/export and active-system deletion within 90 days of closure or agreed return, unless lawful instructions or mandatory restricted preservation require otherwise. |
| Residual provider backups | Protected and unavailable for routine use until overwritten under the provider’s documented lifecycle. The applicable maximum expiry must be recorded in the processing schedule before sensitive live use. Reapply deletions after any restoration. |
Legal holds do not permit ordinary continued use. Relevant data is segregated or access-restricted and deleted when preservation is no longer necessary. Customers remain responsible for clinical, care, employment and incident records they must lawfully retain independently.
7. Your rights and complaints
Subject to applicable conditions, you may request access, correction, erasure, restriction or portability; object to legitimate-interest processing; and withdraw optional consent. Contact dpo@mokadigital.net or our registered address. Identity and authority checks must be proportionate and avoid unnecessary identity documents. We respond within one month; a legally permitted extension for complexity is up to two additional months, explained within the first month.
Where the Customer is controller, we refer the request to it and assist under the DPA rather than independently alter its records. You may complain to the Spanish Data Protection Agency (AEPD) or another competent authority. Contractual dispute provisions do not restrict that right.
8. Security, essential storage and automation
Safeguards include encrypted transport, provider-managed storage protections, tenant and role-based access checks, authenticated privileged changes and relevant access/audit records. Organisational measures include confidentiality, controlled support access, incident handling and review before enabling sensitive integrations. No system is risk-free; report suspected exposure through our privacy contact. Specific availability, recovery, backup or certification commitments require an agreed service schedule.
Essential cookies and browser storage support authentication, session protection and form continuity. Synthetic demo progress uses browser session storage. Optional analytics or advertising requiring consent must stay off until a separate choice is offered. This notice does not authorise installing them.
Onboarding does not make solely automated decisions with legal or similarly significant effects about people. Application and live-service approvals require authorised review. Optional AI and automation require an assessment of intended use, appropriate human oversight and any legally required safeguards.
9. Data-Processing Agreement
This DPA forms part of the Customer Terms when the Customer instructs MOKA DIGITECK SL to process personal data on its behalf. The Customer is controller, or a duly authorised processor; VYVA is processor or subprocessor. GDPR definitions apply. The DPA does not change independent-controller activities above.
9.1 Instructions and description
VYVA processes Customer data only on documented instructions, including selected configuration, enabled services, this agreement and the accepted processing schedule, unless binding law requires otherwise. We will disclose such a legal requirement unless prohibited and notify the Customer if an instruction appears to infringe data-protection law. The Customer establishes legal bases, special-category conditions, notices and authority; a processor Customer must have authority from its controller to appoint VYVA.
Subject and purpose: provision, security, support and agreed operation of the selected VYVA services. Nature: collection, recording, organisation, hosting, retrieval, display, authorised sharing/transmission, correction, restriction, return and deletion. Duration: service plus necessary return/deletion, with restricted preservation only where legally required.
9.2 People and records by solution
| Solution | Potential people and data, limited to enabled services |
|---|---|
| Home Care | Clients, carers, representatives and staff; contacts, visits, support/care needs, tasks and escalation records. |
| Hospital Discharge | Patients, representatives, clinicians and care teams; discharge/handover, contacts, follow-up and recovery records. |
| Senior Living / Senior Communities | Residents, authorised family/representatives, staff and providers; contacts, service requests, activities, wellbeing and safeguarding records. |
| Nursing Homes | Residents, representatives, nursing and other staff; contacts, care needs, clinical/nursing observations and governed care tasks. |
| Community Support | Participants, representatives, volunteers and coordinators; eligibility, referrals, contacts, support and safeguarding records. |
| Safety & Security / Safety Support | Protected people, authorised contacts, operators and responders; alerts, incidents, lawful locations and response records. |
| Emergency Response | People receiving assistance, callers, dispatchers and responders; incidents, triage, lawful locations, dispatch and response status. |
All solutions may include authorised-user identity, roles, timestamps and relevant audit events. Health and safeguarding information require enhanced protection. Criminal-offence information, biometrics, continuous location tracking, covert monitoring and unrelated special-category data are excluded unless specifically lawful, necessary and covered by an expressly accepted schedule. Apply safeguards appropriate to children and vulnerable people where involved.
9.3 Confidentiality and security
VYVA will bind authorised personnel to confidentiality, restrict access to need, and apply appropriate Article 32 measures according to risk, including tenant separation, authentication, least-privilege administration, secure transmission, supported infrastructure and incident response. Measures must be reviewed as risks change and agreed protection must not be materially reduced. Before sensitive live use, the schedule must confirm access roles, locations, retention, communications, integrations and required backup/recovery arrangements.
9.4 Subprocessors and transfers
The Customer gives general authorisation for core providers in section 4 as necessary for the agreed service and covered by appropriate processing contracts. Optional providers require approval in the processing schedule before receiving data. VYVA will contractually impose substantially equivalent data-protection obligations and remains responsible for subprocessors’ performance of those obligations.
Affected Customers will receive at least 30 days’ advance notice of planned material additions or replacements and may raise a reasoned data-protection objection. Urgent continuity or security replacements require notice as soon as practicable and equivalent safeguards. The parties will seek an alternative; if none is available, the Customer may terminate the affected service before the disputed provider is used, with refund of unused prepaid fees for that service. Transfers must satisfy section 5; region labels and provider marketing do not replace the required contracts and assessment.
9.5 Assistance and personal-data breaches
Taking account of processing and available information, VYVA will assist with rights requests, security, breach notifications, impact assessments and prior consultation. We notify the Customer without undue delay after becoming aware of a breach affecting its data, providing available facts, likely consequences and mitigation, followed by updates. Initial notice will not await a complete investigation. The Customer remains responsible for its legally required authority and individual notifications unless law provides otherwise.
9.6 Return, deletion and audits
At the Customer’s choice, VYVA returns or deletes personal data after service and deletes copies, subject to mandatory preservation and the restricted backup lifecycle in section 6. Confirmation is available on request. VYVA will provide reasonably necessary compliance information and allow proportionate audits or inspections by the Customer or an independent confidential auditor. Arrangements must protect other customers and security without preventing a justified audit or supervisory access. Exceptional assistance fees require advance agreement and must not obstruct statutory rights.
9.7 Customer processing schedule
The recorded organisation, selected solutions, roles and enabled configuration define initial scope. Before real sensitive or regulated data is introduced, the Customer and VYVA must record particular purposes and categories, controller contact and lawful instructions, retention/deletion periods, approved providers and locations, transfer safeguards, required security and backup/recovery measures, and recording/communication permissions. This is an activation condition, not permission for unrestricted processing. Until approved, use organisation setup information and synthetic data only.
10. Editions and information
Effective 18 October 2026. Material changes follow the Customer Terms. Records identify the shown edition and authenticated accepting person. New editions do not rewrite old acceptance. Acknowledgement does not waive rights or create optional consent.
Legal information: GDPR, Spain’s Organic Law 3/2018 and AEPD guidance and complaints.