Data Processing Addendum
Scope and roles
This Data Processing Addendum ("DPA") supplements the Terms of Service and describes how Velira, LLC processes personal data in connection with the Service. For personal data of its own account holders, Velira acts as a controller and the Privacy Policy governs; where it processes personal data on behalf of a business customer, it acts as a processor and this DPA applies to that processing.
Processing details
Subject matter and duration of processing, the nature and purpose of processing, the types of personal data, and the categories of data subjects are described in the Privacy Policy and in Annex A to this DPA. Velira, LLC processes personal data only to provide and support the Service and as otherwise instructed or permitted by applicable law.
Security
Velira, LLC maintains appropriate technical and organizational measures designed to protect personal data, including those described in the Security document — such as encryption in transit and at rest, access controls, least-privilege internal access, and logging. Measures may be updated provided protection is not materially reduced.
Subprocessors
Velira, LLC engages the subprocessors listed in the Subprocessors document to support the Service. Subprocessors are bound by data-protection obligations no less protective than those in this DPA. Velira, LLC remains responsible for its subprocessors' processing and will provide a mechanism for notice of changes where required.
International transfers
Where personal data is transferred across borders in a manner requiring a transfer mechanism, Velira, LLC relies on an appropriate mechanism such as the Standard Contractual Clauses, the UK Addendum, or another lawful basis, to be completed with counsel.
Assistance, breach, deletion, and audits
Velira, LLC will provide reasonable assistance with data-subject requests and with breach notification consistent with the Breach Notification document and applicable law, and will delete or return personal data at the end of the engagement except where retention is legally required. The parties' audit rights and obligations will be set out in the final DPA.
Questions about this document? Contact us at hello@velirafinance.com.