Personal Data Management

What personal data does Vaam save?

• Name
• Country
• Email
• Phone number
• LinkedIn profile URLs
• Job information (e.g., title, company, industry)
• Other professional information available on LinkedIn profiles
• IP address
  • Vaam saves your IP address to keep your account safe and monitor unusual activity.

How does Vaam process personal data?

Vaam acts as a data processor for personal data that customers upload to the platform or that Vaam collects through LinkedIn automation. Vaam processes this data in a professional capacity and does not collect or store personal, non-professional contact information.

Vaam processes this data for specific service functions, including:

• Recording and editing videos
• Facilitating communication about video content
• Managing teams and sub-users
• LinkedIn automation and prospect management
• Handling data subject requests
• Maintaining audit trails and activity logs

Vaam processes only the personal data needed to provide the services that customers instruct Vaam to provide in the Data Processing Agreement (DPA).

Where does Vaam process data?

Vaam is a Swedish company. Like many other SaaS solutions, Vaam uses subcontractors that process personal data as Vaam’s data processors and your subprocessors to deliver the service. Vaam treats GDPR compliance as a top priority and chooses subcontractors carefully. See the document about GDPR or contact Vaam for more information.

What is the data retention policy?

The data retention policy is:

1. Active Customer Data: Vaam retains personal data and other information related to customer accounts and activities, including video content, LinkedIn automation data, and communication data, for as long as the accounts remain active.

2. After Account Termination: After a customer’s account ends, the customer has the following options under the Data Processing Agreement (DPA). Within 30 days of account termination, the customer can elect to have Vaam either:

   • Return all personal data to the customer in a commonly used, machine-readable format.
   • Delete all personal data in Vaam’s possession or control.

3. Retention for Legal Compliance: Vaam may retain specific personal data when applicable laws or regulations require it, even after account termination. The terms of the DPA still apply to retained data, which Vaam keeps securely.

4. Backup and Archived Data: Vaam securely destroys or overwrites backups or archived copies that are not readily accessible in the ordinary course of business under normal backup and archival processes.

5. Anonymized or Aggregated Data: Vaam may retain anonymized or aggregated data derived from personal data indefinitely when it cannot be used to identify any individual.

Customers can request deletion of their data at any time. Vaam complies with those requests under the DPA and applicable data protection laws.

Vaam regularly reviews and updates its data retention policies to align them with legal requirements, business needs, and data minimization.

What routines does Vaam use to delete data?

Vaam’s data cleansing routines are designed to ensure data accuracy, relevance, and compliance with data protection regulations.

Proactive routines

1. Automated Data Validation: Vaam’s systems use automated checks to validate data integrity and format, especially for structured data such as email addresses, phone numbers, and LinkedIn URLs.
2. Handling of Outdated LinkedIn Data: Vaam’s LinkedIn automation service has processes to flag and update information that may have changed on LinkedIn profiles.
3. Data Minimization: Vaam regularly assesses the data it collects and stores and keeps only information needed for its services. Vaam removes unnecessary data fields from its systems.
4. Secure Data Disposal: When Vaam deletes data because of a customer request, account termination, or regular cleansing, it securely and permanently removes the data from active systems.
5. Backup Data Management: Vaam deletes data from active systems immediately and has processes to remove deleted data from backups through normal backup rotation and overwriting procedures.

Reactive routines

1. Customer-Initiated Updates: Vaam provides tools for customers to review and update the data they upload or collect through the platform, ensuring the most up-to-date information.
2. Data Subject Requests: Vaam has procedures to handle data subject requests for correction, deletion, or restriction of personal data promptly, as described in the Data Processing Agreement.

How does Vaam work with third-country transfers?

In 2020, the European Court of Justice (ECJ) published its judgment in case C311-18, commonly called “Schrems II”. Vaam continuously manages the ruling’s legal consequences, including the invalidation of the Privacy Shield framework for transfers of personal data between the EU and the US.

Vaam has entered into standard contractual clauses (SCC) with all sub-processors where a transfer can occur, or the companies are either American or owned by an American company.

For sub-processors covered by 50 USC § 1881a (“FISA section 702”) and the legal issues that the ECJ raised in the ruling, Vaam has taken these actions to implement supplementary safety measures:

1. Vaam investigated the processing of personal data by necessary sub-processors to ensure that personal data is processed and isolated within the EU. Among other things, Vaam received assurances from IT security personnel at Google in Sweden that, because Vaam has an agreement with the European subsidiary of Google, Google Cloud EMEA Limited, and a server location within the EU, Vaam’s data is processed in isolation within the EU.
2. Through their agreements, Google undertakes to legally challenge, for example, orders for information disclosure. Google also releases information about orders and injunctions it receives about data disclosure. For more information, see Google’s Transparency Help Center.
3. About Google Cloud Platform and encryption:
   1. Encryption of data “in transit”. The only communication allowed to be sent to the server is transferred via HTTPS protocols. All incoming traffic on HTTP is redirected to HTTPS. When data reaches the server through an HTTPS-encrypted transfer, it is processed within a virtual private network. Within this network, Vaam has security policies to ensure that only necessary communication is allowed between resources. Information transferred between users’ browsers and the server is therefore encrypted and unreadable.
   2. Encryption of data “at rest”. The database is encrypted with the encryption standard AES-256.
4. Vaam continuously monitors the evolving legal situation and assesses its safety measures against the guidelines and criteria set by, among others, the European Court of Justice, the European Data Protection Board, and the Swedish supervisory authority IMY.
5. Vaam can assist with any transfer impact or other risk assessments regarding its sub-processors.

What security measures protect data from service administrators and unauthorized users?

Administrators can list or access data only through Vaam’s servers. Multiple authentication factors protect that access, and Vaam grants access only to internal users who need it to run and maintain the service.

What can an AI assistant connected to Vaam see?

Vaam lets a user connect an AI assistant, such as Claude or ChatGPT, to the user’s own account. The assistant signs in as that user and can do what that user can do, no more. By default, it reads only that user’s data. It includes team data only when the request is explicitly about the team, and it loses all access when the user disconnects it.

Permissions and trust sets out the full boundary: what a connected assistant can read, what it can change, what it can never reach, and how to end its access.