Last updated: 28 October 2026 Version: 1.0
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer ("Customer", controller) and Delusion Group ("Delusion", processor), for Dwork and DeluHub. A signed copy is available on request at support@delusiongroup.com.
1. Scope and roles
Customer is the controller of personal data in Customer Content (emails, meeting media, recordings, workspace data). Delusion processes it as processor only to provide, secure and support the Services. This DPA follows Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP and, where applicable, Article 28 of the EU/UK GDPR.
2. Details of processing
- Subject matter and duration: provision of the Services for the subscription term plus the export and deletion period.
- Nature and purpose: hosting, storage, transmission, filtering of email, relaying live meetings, storing recordings, backups, support.
- Data subjects: Customer's users, their correspondents, and meeting participants.
- Data types: contact details, email content and metadata, audio, video and screen content, recordings, workspace content, technical logs.
- Sensitive data: not intended; Customer controls what is stored.
3. Delusion's obligations
Delusion will:
- process personal data only on Customer's documented instructions (these Terms, the product settings, and written requests), and tell Customer if an instruction appears unlawful;
- ensure staff with access are bound by confidentiality;
- apply the security measures described in the Privacy Policy, section 6;
- use subprocessors only under written terms with equivalent protection, keep the list in the Privacy Policy up to date, and give at least 30 days' notice of new subprocessors so Customer can object;
- help Customer respond to data subject requests and carry out impact assessments, including cross-border transfer assessments;
- notify Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Content, with the information Customer needs to meet its own notification duties;
- at the end of the Services, delete or return Customer Content as described in the Terms (section 8.3), unless the law requires retention;
- make available information needed to demonstrate compliance and allow reasonable audits, normally through written questionnaires and documentation, at most once per year unless after a breach.
4. Customer's obligations
Customer will ensure it has a lawful basis and any required consents for the personal data it puts into the Services, including consent from meeting participants for recordings, and will give data subjects the information required by law.
5. International transfers
Customer Content is hosted outside Vietnam (see the subprocessor list). Delusion maintains the cross-border transfer documentation required by Vietnamese law and, for EU/UK data, relies on Standard Contractual Clauses or equivalent safeguards.
6. Liability and precedence
Liability under this DPA is subject to the limits in the Terms, except where the law does not allow it. If this DPA conflicts with the Terms on data protection, this DPA prevails.