Data Processing Agreement (DPA)

For customer content, the customer is the controller and Velqory is the processor under Article 28 of the GDPR. This Data Processing Agreement applies where Velqory processes personal data on the customer's behalf and forms part of the contract for that service.

Velqory processes personal data only on documented instructions from the customer and as needed to provide the contracted service. The subject-matter, duration, nature, and purpose of processing, and the categories of data and data subjects, are those described in the agreement and the Privacy Policy.

• confidentiality commitments from personnel with access to data;
• technical and organisational security measures appropriate to the risk (see Security & Trust Statement);
• assistance with data-subject requests, breach notification, and DPIAs;
• sub-processing only with authorisation and equivalent contractual terms (see Sub-Processor List).

The location of processing and the sub-processors involved are identified in the Sub-Processor List and in the proposal. Any transfer outside the EEA relies on an appropriate safeguard under Chapter V of the GDPR.

On termination, export, return and deletion of customer content follow the proposal or DPA and the Data Retention & Deletion Policy, unless storage is required by law.

A counter-signed DPA is available on request from suporte@velqory.com.