Data Processing Agreement

The Customer is the Controller and Veris Privacy is the Processor for Personal Data in Customer Data. The details of processing are set out in Annex 1.

This DPA does not cover data Veris Privacy handles as a controller, such as account, billing and log data. Our Privacy Policy covers that data.

If the Customer is a consultancy using PrivacyTenet for its own clients, the Customer is responsible for having the right agreements in place with those clients. Veris Privacy acts as the Customer's subprocessor for that data and takes instructions only from the Customer.

The Customer's instructions to Veris Privacy must comply with Data Protection Laws. The Customer is responsible for having a lawful basis, or valid consent, for the Personal Data it puts into the Service and for giving any notices individuals require.

The Terms, this DPA, and the Customer's use and configuration of the Service are the Customer's complete instructions. Additional instructions must be agreed in writing.

Instructions. Veris Privacy will process Personal Data only on the Customer's documented instructions, unless the law requires otherwise. If so, Veris Privacy will tell the Customer before processing, unless the law forbids it. Veris Privacy will tell the Customer if it believes an instruction breaches Data Protection Laws.

No other use. Veris Privacy will not sell or share Personal Data, or use, keep or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service. Veris Privacy will not combine it with personal data from other sources, except as Data Protection Laws allow. Veris Privacy certifies that it understands these restrictions.

Confidentiality. Veris Privacy will ensure that everyone authorised to process Personal Data is bound by a duty of confidentiality and accesses it only as needed to provide the Service.

Security. Veris Privacy will put in place and maintain the technical and organisational measures in Annex 2. Veris Privacy may update these measures as long as overall protection is not reduced.

Individual requests. If Veris Privacy receives a request from an individual about Personal Data in Customer Data, it will pass it to the Customer without undue delay and will not respond directly, except to redirect the individual. Taking into account the nature of the processing, Veris Privacy will help the Customer respond, mainly through the Service's own features for finding, correcting, exporting and deleting data.

Other assistance. Veris Privacy will give reasonable help with the Customer's privacy impact assessments, data protection impact assessments and consultations with regulators, to the extent they relate to the Service and the information is not otherwise available to the Customer. Veris Privacy may charge reasonable fees for help beyond what the Service provides as standard.

Privacy officer. Veris Privacy has appointed a person responsible for protecting personal information, whose contact details are in our Privacy Policy.

Authorisation. The Customer gives general authorisation for Veris Privacy to use the Subprocessors listed in Annex 3 and on our subprocessor page at privacytenet.com/subprocessors.

Obligations. Veris Privacy will have a written contract with each Subprocessor that protects Personal Data at least as well as this DPA. Veris Privacy remains responsible for each Subprocessor's performance.

Changes. Veris Privacy will give at least 30 days' notice before adding or replacing a Subprocessor, by updating the subprocessor page and notifying Customers who have subscribed to the service. In an emergency, such as replacing a provider to keep the Service secure or running, notice may be shorter.

Objection. The Customer may object to a new Subprocessor on reasonable data protection grounds within the notice period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may end the affected Subscription and receive a refund of prepaid Fees for the unused period.

Veris Privacy will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Security Incident affecting Customer Data.

The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, and the steps taken or proposed. Veris Privacy will send further information as it becomes available.

Veris Privacy will take reasonable steps to contain and investigate the incident and reduce its effects. Veris Privacy will help the Customer meet its own duties to notify regulators and individuals, and to keep records of breaches.

Notice of a Security Incident is not an admission of fault or liability.

On request, Veris Privacy will provide information reasonably needed to show compliance with this DPA. This may include completed security questionnaires, summaries of our security policies, and any independent audit reports or certifications we hold.

If that information is not enough to meet a requirement of Data Protection Laws, or a regulator requires it, the Customer may conduct an audit, no more than once a year. The Customer must give at least 30 days' notice, agree the scope with Veris Privacy in advance, use an independent auditor bound by confidentiality, and avoid disrupting Veris Privacy’s business. The Customer bears its own audit costs.

Veris Privacy hosts Customer Data in Canada. Some Subprocessors process limited Personal Data, such as User email addresses, in the United States, as listed in Annex 3.

EU and UK data. Canada has an adequacy decision from the European Commission and is recognised as adequate by the UK, so transfers of Personal Data from the EEA or UK to Veris Privacy in Canada need no further safeguards. For onward transfers to countries without adequacy, Veris Privacy will rely on the EU-US Data Privacy Framework and its UK Extension where the Subprocessor is certified, or on the SCCs and the UK Addendum.

Quebec data. Before communicating Personal Data outside Quebec, Veris Privacy assesses whether it will receive adequate protection, as Quebec law requires, and will share a summary of that assessment with the Customer on request.

Other jurisdictions. If Data Protection Laws require another transfer mechanism, the parties will cooperate in good faith to put it in place.

During the Subscription Term, the Customer can export and delete Customer Data using the Service.

After the Terms end, the Customer may export Customer Data for 30 days. After that, Veris Privacy will delete Customer Data from active systems within 30 days. Backups containing it are overwritten on their normal cycle of up to 30 days. Until then, they stay protected under this DPA and are not actively processed.

Veris Privacy may keep Personal Data where the law requires it, and will protect it under this DPA for as long as it is kept.

On request, Veris Privacy will confirm deletion in writing.

If this DPA conflicts with the Terms, this DPA prevails as to the processing of Personal Data. If the SCCs or UK Addendum apply and conflict with this DPA, they prevail.

This DPA lasts for as long as Veris Privacy processes Personal Data on the Customer's behalf.

Veris Privacy may update this DPA to reflect changes in Data Protection Laws or the Service. Updates will not reduce the overall protection of Personal Data, and Veris Privacy will give notice as set out in the Terms.