Data processing addendum

1. Purpose

This Data Processing Addendum (“DPA”) forms part of the agreement between Veloraz AI, Lda. (“Processor”) and Customer (“Controller”) and governs the processing of Personal Data in connection with the Service.

2. Scope of processing

The Processor processes Personal Data strictly to provide the Service to the Controller, in accordance with the Controller's documented instructions and applicable data protection laws including the GDPR and UK GDPR.

3. Subprocessors

The Controller authorizes the Processor to engage subprocessors to provide the Service. A current list of subprocessors is maintained and made available on request. The Processor will notify the Controller in advance of any new or replacement subprocessor.

4. Security

The Processor implements appropriate technical and organizational measures to protect Personal Data, including encryption in transit and at rest, access controls, audit logging, and annual security testing.

5. Data subject rights

The Processor will assist the Controller in responding to requests from data subjects to exercise their rights under applicable law (access, rectification, deletion, portability).

6. Breach notification

The Processor will notify the Controller without undue delay, and in any case within 72 hours, upon becoming aware of a Personal Data Breach affecting the Controller's data.

7. International transfers

Where Personal Data is transferred outside the EEA or UK, the parties rely on the applicable Standard Contractual Clauses incorporated by reference into this DPA.

8. Return and deletion

Upon termination of the agreement, the Processor will, at the Controller's choice, delete or return all Personal Data processed on behalf of the Controller, unless retention is required by law.

Request a signed copy

For a countersigned DPA, email legal@veloraz.ai.