Data processing agreement.

1. Purpose

ViuTour processes personal data on the company’s behalf only to provide the contracted service: live audio and simultaneous translation of its guided tours, visitors’ questions, management of its guides and admins and, when it is on, the vocabulary analysis of its tours.

2. Which data and whose

• The company’s guides and admins: name, email, phone if given, language and service usage (tours and hours).
• What the guide says during the tour: the voice is turned into text and translated in real time. The audio is neither recorded nor stored. The text may incidentally contain data about the guide, the visitors or third parties.
• Visitors: they take part with no account or name. A random connection identifier, the chosen language and the text of the questions they send are processed.

3. Vocabulary analysis

• Purpose: improving how the proper names and terms of the company’s own tours are recognised and translated, by proposing terms for its vocabulary.
• It is on by default for contracted plans and packs. The company can turn it off at any time from its panel: no more text is stored from the next tour, and the text already stored is deleted.
• What is stored: only the phrases translated for the group, with the company, city, tour, day and language, with no time of day and no link to the specific tour or to the guide. Before storing them, phone numbers, emails, ID and account numbers and the names of the company’s guides are removed.
• Period: 30 days at most, deleted automatically every day.
• Access: ViuTour only. The company never sees the text of its tours: it receives proposed terms with a short, already cleaned example, which is deleted when it accepts or rejects them.
• The analysis is done by an Anthropic AI model (annex), on the already cleaned data and without it being used to train models.

4. Prohibitions

• ViuTour will not use the data for its own purposes, for other companies or to train AI models.
• Neither ViuTour nor the analysis will produce ratings, metrics, reports or proposals per guide. Service data will not be used to monitor or evaluate the performance or behaviour of guides, and the company undertakes not to ask for it.

5. ViuTour’s obligations

• Process the data only on the company’s instructions, which are those in this agreement and any it gives in writing, and tell it if an instruction seems unlawful.
• Ensure the confidentiality of the people authorised to process the data.
• Apply the security measures in section 7.
• Help the company respond to people’s rights (access, rectification, erasure, objection, restriction and portability) and with any impact assessments and prior consultations it has to carry out.
• Notify the company of any personal data breach without undue delay and within 48 hours of becoming aware of it, with the information available.
• Make available the information needed to demonstrate compliance and allow reasonable audits, with prior notice.

6. The company’s obligations

• Have a legal basis for the processing. For the vocabulary analysis, the company’s legitimate interest in translation quality (GDPR Article 6(1)(f)); in an employment relationship, the guide’s consent is not a suitable basis.
• Inform its guides before they use the service (GDPR Article 13 and LOPDGDD Article 87) and, if there is one, their legal representatives. The app shows the guide a notice when preparing each tour.
• Remind its guides to mute the microphone during private conversations.
• Never ask ViuTour to use the data to evaluate guides.

7. Security measures

• Encryption in transit (HTTPS and secure WebSocket) on every connection.
• Sign-in with username and password and per-company permissions in the database: each company only sees its own data.
• The analysis text can only be reached with ViuTour’s service key, never from the company’s app or the visitors’ app.
• Minimisation: no audio recording, technical logs without the text of the phrases, personal data removed before any text is stored, and automatic deletion after 30 days.

8. Sub-processors

• The company authorises ViuTour to use the sub-processors in the annex. ViuTour will give 15 days’ notice by email of any change; the company may object and, if no agreement is reached, cancel its plan.
• ViuTour binds each sub-processor to obligations equivalent to those in this agreement through their data processing agreements.
• Where a sub-processor processes data outside the European Economic Area, it does so with the safeguards of GDPR Chapter V, such as the European Commission’s standard contractual clauses.

9. Term and end

It lasts while the company has a contracted plan or pack. When it ends, ViuTour deletes the company’s data within 30 days, except data it must keep by law (such as invoicing) and data the company asks to have returned first. The analysis text is deleted 30 days after it was stored in any case.

10. Changes

If this agreement changes, ViuTour will publish a new version and the company will have to accept it from its panel. Until it does, the vocabulary analysis is paused.

ViuTour's signature

When a company pays, it receives this agreement as a PDF electronically signed by ViuTour with its own certificate. A declaration signed with Sergi Bel Salvadó's qualified FNMT certificate ties that certificate to him.

Certificate SHA-256 fingerprint: F6:4A:68:36:C2:8C:B5:35:60:7A:8B:E8:90:B2:F6:76:24:19:F2:36:D0:A1:B4:48:59:DD:C0:F6:25:E2:C4:8E

Signed declaration (PDF)