How Oneiros Vision processes the personal data in your books on your behalf: part of the Terms, clause 8.2.
Last Updated: October 2026 | Version: 1.0
This Data Processing Agreement (the "DPA") is part of the Agreement between Oneiros Vision and the Customer under the Terms & Conditions (version 2.0, clause 8.2). It applies where Oneiros Vision processes personal data contained in Customer Data on the Customer's behalf, and it prevails over the rest of the Agreement on the processing of personal data.
The parties. The Customer named in the Order, as controller; and Oneiros Vision Research S.R.L. (CUI 51610020, trade register number J2025025914004), trading as Oneiros Vision ("Oneiros Vision"), as processor. The change of the company's registered name to Oneiros Vision Research S.R.L. is being entered in the trade register; its registration code and trade register number stay the same.
1.1 "Data Protection Law" means Regulation (EU) 2016/679 (the GDPR); for processing subject to them, the UK GDPR and the UK Data Protection Act 2018; the Swiss Federal Act on Data Protection of 25 September 2020 (FADP); and the national laws that supplement any of them.
1.2 "Customer Personal Data" means the personal data within Customer Data that Oneiros Vision processes on the Customer's behalf, as Annex I describes.
1.3 "Controller", "processor", "personal data", "processing", "personal data breach", "data subject" and "supervisory authority" have the meanings the GDPR gives them. Under the FADP, the supervisory authority is the FDPIC.
2.1 For Customer Personal Data, the Customer is the controller and Oneiros Vision the processor. If the Customer is itself a processor for another controller, Oneiros Vision is its sub-processor, and the Customer confirms that its controller has authorised the terms of this DPA.
2.2 For the data it holds about Authorised Users' accounts, billing and security, Oneiros Vision is an independent controller; the Privacy Notice covers that data, and this DPA does not.
2.3 The Customer has a lawful basis for the processing, gives its data subjects the information the law requires, and submits only the data the Service needs. Books are named by mandate, not by client. The Customer submits no special categories of personal data and no data relating to criminal convictions.
3.1 Oneiros Vision processes Customer Personal Data only on the Customer's documented instructions: the Agreement, the Customer's configuration and use of the Service, and any further written instructions both parties agree.
3.2 Oneiros Vision tells the Customer at once if, in its opinion, an instruction infringes Data Protection Law.
3.3 Where Union or member-state law requires Oneiros Vision to process Customer Personal Data otherwise, it informs the Customer before processing, unless that law forbids it.
Everyone Oneiros Vision authorises to process Customer Personal Data is bound by confidentiality, by contract or by law, and has access only as far as their work needs it.
5.1 Oneiros Vision maintains the technical and organisational measures in Annex II, as Article 32 of the GDPR requires.
5.2 It may change those measures to keep up with risks and technology, but never so as to lower their overall level.
6.1 The Customer gives general authorisation for the sub-processors in Annex III.
6.2 Oneiros Vision gives at least 30 days' notice, by e-mail, before adding or replacing a sub-processor. Where an urgent security or continuity need forces it to act sooner, it gives notice as soon as it can, and the Customer has the same right to object.
6.3 The Customer may object on reasonable data-protection grounds within the notice period, and the parties then discuss the objection in good faith. If they cannot resolve it, the Customer may end the affected subscription under clause 11.4 of the Terms, and Oneiros Vision refunds, pro rata, the Fees paid for the period after the end.
6.4 Oneiros Vision imposes on each sub-processor, by written contract, data protection obligations giving the same protection as this DPA, and remains fully liable for each sub-processor's performance.
7.1 The Service lets the Customer view, export, correct and delete Customer Personal Data itself, and Schedule 3 of the Terms describes the exports.
7.2 If a data subject writes to Oneiros Vision about Customer Personal Data, Oneiros Vision forwards the request to the Customer within five Business Days and does not answer it unless the Customer instructs it to.
7.3 Oneiros Vision gives the Customer any further help it reasonably needs.
Oneiros Vision gives the Customer the information and help it reasonably needs to comply with Articles 32 to 36 of the GDPR: security, breach notification, data protection impact assessments and prior consultation. The Security Overview and this DPA are the first source of that information.
9.1 Oneiros Vision notifies the Customer without undue delay, and within 48 hours of becoming aware of it, of a personal data breach affecting Customer Personal Data.
9.2 The notice gives what is then known of the nature of the breach, the categories and approximate numbers of data subjects and records concerned, a contact, the likely consequences and the measures taken or proposed. Oneiros Vision supplements it as it learns more.
9.3 Oneiros Vision cooperates in the Customer's response. It does not notify the Customer's data subjects or supervisory authority on the Customer's behalf unless the Customer asks it to or the law requires it.
10.1 Oneiros Vision processes Customer Personal Data in the European Economic Area. The operator's encrypted backup copy stays in the European Economic Area or in Switzerland, which the European Commission recognises as ensuring an adequate level of protection.
10.2 Oneiros Vision transfers Customer Personal Data to a sub-processor outside the European Economic Area, or allows such a transfer, only under an adequacy decision, the European Commission's standard contractual clauses (Module 3, processor to processor), or another safeguard under Chapter V of the GDPR.
10.3 If the Customer is established in a third country that has no adequacy decision, Module 4 of the standard contractual clauses (processor to controller) applies to the return of data to the Customer, incorporated by reference, without the optional Clause 7 or the optional wording in Clause 11, with the law of Romania under Clause 17 and the courts of Bucharest under Clause 18.
10.4 For a Customer in the United Kingdom or Switzerland, transfers to Oneiros Vision rely on the adequacy of the European Economic Area under UK and Swiss law, and references to the GDPR are read as references to the UK GDPR or the FADP.
11.1 While the Agreement runs, the Customer may export or delete Customer Personal Data at any time.
11.2 When the Agreement ends, Schedule 3 of the Terms governs retrieval. Books are deleted 30 days after the subscription ends, and the mandate record and other account data 365 days after it ends, unless the Customer asks for earlier deletion, which Oneiros Vision carries out within 30 days of the request.
11.3 Copies in backups expire on a fixed schedule, at the latest 13 months after they were taken. Until then they are encrypted, used only to recover the whole service after a disaster, and never used to restore or read a single customer's data. If a backup is restored, the deletions made after it was taken are applied again before the service reopens.
11.4 This clause does not apply to data that Union or member-state law requires Oneiros Vision to keep, which remains protected by this DPA for as long as it is kept.
11.5 On request, Oneiros Vision confirms the deletion in writing.
12.1 Oneiros Vision makes available the information needed to show that it complies with Article 28 of the GDPR. Each year the Customer may obtain the current Security Overview and answers to one reasonable security questionnaire.
12.2 The Customer may audit Oneiros Vision, itself or through an independent auditor bound by confidentiality, including by on-site inspection, on at least 30 days' notice, no more than once in 12 months, during Business Days, and in a way that neither disproportionately disrupts the Service nor exposes other customers' data.
12.3 These limits do not apply after a personal data breach affecting the Customer, or where a supervisory or other competent authority requires an audit.
12.4 Each party bears its own costs.
If an authority asks Oneiros Vision for Customer Personal Data, Oneiros Vision informs the Customer unless the law forbids it, challenges a request it regards as unlawful, and discloses only the minimum the law compels.
Oneiros Vision keeps the record of processing activities that Article 30(2) of the GDPR requires, and gives it to a supervisory authority on request.
15.1 Each party's liability under this DPA is subject to clause 14 of the Terms, including the higher cap of clause 14.4.
15.2 Nothing in this DPA limits either party's liability to data subjects under Article 82 of the GDPR, and each party bears any fine imposed on it.
This DPA lasts as long as Oneiros Vision processes Customer Personal Data. It is governed by the law of the Terms (clause 21), except where the standard contractual clauses require otherwise.
| Item | Description |
|---|---|
| Data subjects | The Customer's clients, natural persons whose mandates the Customer records, and only as far as it records them; the Customer's Authorised Users, as authors of the entries and notes they write in Customer Data; any other person the Customer mentions in a note |
| Personal data | For each book: holdings and identifiers, quantities, values, cash, base currency, mandate limits, stated risk tolerance, targets, the book's name and any notes. The mandate record: dated measurements, acknowledgements and their authors. Alert e-mails about a book. |
| Special categories | None; the Customer does not submit any (clause 2.3) |
| Frequency | Continuous, while the subscription runs |
| Nature of processing | Storage, valuation, computation of measurements, display, export, e-mail alerts, backup and deletion |
| Purpose | To provide the Service to the Customer under the Agreement |
| Duration | The subscription, then the periods in clause 11 |
| Sub-processor | Service | Customer Personal Data | Location | Safeguard |
|---|---|---|---|---|
| Hostinger International Ltd. | Virtual private server: the application, the API and the database | All | Germany (EU) | Hostinger's data processing terms |
| Hostinger International Ltd. | Transactional e-mail from mailboxes on Oneiros Vision's domain | The content of alert e-mails about a book | EU | Hostinger's data processing terms |
| Backblaze, Inc. | Off-site backup storage | All, as ciphertext it cannot decrypt | Netherlands (EU Central region) | Backblaze's Data Processing Addendum; a US company, so the safeguards of Chapter V of the GDPR apply to what it holds |
Stripe is not a sub-processor for Customer Personal Data: it handles billing data, which Oneiros Vision holds as controller. The market-data sources receive the identifiers of instruments, never an account or a client.