Last updated 2026-11-01 (version 2)
Data Processing Agreement
The DPA between you and HAVA Export B.V., trading as Vibel, registered in the Netherlands at Meester Achtenstraat 21, 5963 HM Hegelsom, KvK 90977203.
This is a working draft prepared for customer and internal review. It has not yet been reviewed by qualified legal counsel. If you need a signed copy for procurement, contact us at the address below.
1. Parties and roles
For the comment and DM data your own followers generate, you are the data controller and Vibel Reply is the data processor, processing that data only to provide the service and only on your instructions. For your own account and billing data, Vibel Reply is an independent controller.
2. Subject matter and duration
Vibel Reply matches keyword comments on your own Instagram posts and sends a private reply, optionally with a public reply under the comment. Processing lasts for the term of your subscription; on termination, Vibel Reply deletes your data on the schedule in the Data Deletion page.
3. Types of personal data
Comment author identifiers and comment text, Instagram account identifiers and encrypted access tokens, DM conversation content, and webhook delivery logs.
4. Security measures
Described in full on the Security page: encryption in transit and at rest, encrypted Instagram token storage, webhook signature verification, and access restricted to signed-in workspace members.
5. Sub-processors
You give Vibel Reply general authorization to engage sub-processors to provide the service. The current list is published on the Sub-processors page, which includes Meta (Instagram, Facebook Messenger and WhatsApp), Stripe, Anthropic and TikTok alongside the hosting, database and email vendors. Vibel Reply will give notice before adding a new one.
6. International transfers
Some sub-processors process data in the United States. Where Vibel Reply transfers personal data originating in the EEA or UK to a country without an adequacy decision, it relies on the EU Standard Contractual Clauses or another valid transfer mechanism under GDPR Chapter V.
7. Breach notification
If Vibel Reply becomes aware of a personal data breach affecting your data, we will notify you without undue delay, and within 72 hours where GDPR requires it.
8. Assignment
We may assign or transfer this agreement, in whole or in part, to an affiliate or group company (including a successor entity operating Vibel) by giving you written notice; your rights under this agreement are not reduced by such a transfer.
9. Governing law
This DPA is governed by the laws of the Netherlands. Any dispute not resolved informally is submitted to the competent court in Amsterdam.
Contact
Questions about this DPA, or to request a signed copy: legal@getvibel.com.