Data Processing Agreement

1. Subject matter and duration

The Processor processes personal data contained in Customer Data only to provide the Veldis service to the Controller, for the duration of the subscription and the deletion period set out in section 9.

2. Nature of the processing

• Purpose: hosting, storing, displaying and transmitting project and task information; sending notifications chosen by users; providing support.
• Data subjects: the Controller’s users, and people named in projects, tasks, comments or files.
• Categories of data: names, work email addresses, account settings, and any personal data the Controller’s users enter in tasks, comments or attached files.
• Sensitive data: the service is not designed for special categories of data, and the Controller should not upload them.

3. Instructions

The Processor acts only on the Controller’s documented instructions, which are these terms, the Controller’s use of the service’s settings, and any further written instructions agreed between the parties. The Processor will tell the Controller if it believes an instruction breaks applicable law.

4. Confidentiality

People authorized to process the data are bound by confidentiality obligations and access it only as needed to provide the service.

5. Security

The Processor maintains technical and organizational measures appropriate to the risk, including:

• encryption of connections with HTTPS;
• password-protected accounts and role-based access per project;
• limited, logged staff access to production systems;
• regular backups held by the hosting provider.

6. Sub-processors

The Controller authorizes the Processor to use sub-processors for hosting and email delivery. The Processor imposes data protection obligations on each sub-processor equivalent to those in this agreement and remains responsible for them. The current list is available on request at contact@veldis.app. The Processor will give notice before adding or replacing a sub-processor, and the Controller may object on reasonable grounds.

7. Assistance

Taking into account the nature of the processing, the Processor helps the Controller respond to requests from data subjects and meet its obligations on security, breach notification and impact assessments.

8. Personal data breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available to help the Controller meet its own obligations.

9. Return and deletion

At the end of the subscription the Controller may request an export of Customer Data for thirty days. After that period the Processor deletes Customer Data from the active service, and from backups as they expire in their normal cycle, unless the law requires it to keep some data.

10. Audits

The Processor makes available the information reasonably necessary to show compliance with this agreement. Any audit is agreed in advance, carried out with reasonable notice during business hours, and limited to what is necessary.

11. Transfers

The Processor is based in the United States. Where applicable law requires safeguards for transfers of personal data, the parties will put them in place.

12. Order of precedence

If this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails. Governing law and venue are those of the Terms of Service.