Data Processing Addendum
Last updated 1 March 2026
Parties and roles
This Data Processing Addendum (the DPA) forms part of the agreement between the customer (you) and Veydria. It applies when we process personal data on your behalf. For that data you are the controller and we are the processor. You decide what data to send and why. We process it only to provide the service and on your documented instructions, which include the agreement and your use of the product.
Scope and purpose
We process the account data and agent event data you send so we can run discovery, classification, evaluation, monitoring, documentation, and support. The categories of data and data subjects depend on what you choose to send. You confirm you have a lawful basis to send that data and to have us process it.
Our obligations as processor
We will process personal data only on your instructions, keep it confidential, and limit access to staff who need it. We will help you respond to data subject requests and meet your security, breach notification, and impact assessment duties, taking into account the nature of the processing. We will tell you if we believe an instruction breaks data protection law.
Sub processors
You authorize us to use the sub processors listed on our sub processors page to help run the service. Each is bound by data protection terms at least as protective as this DPA. We will give notice before we add or replace a sub processor so you can object on reasonable grounds.
Security measures
We keep appropriate technical and organizational measures, including encryption in transit, access controls, tenant isolation, and the append only audit log described on our security page. We review these measures and improve them over time.
International transfers
Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on the Standard Contractual Clauses and any required addenda, along with extra safeguards where they are needed.
Data subject requests
If a data subject contacts us about data we process for you, we will refer them to you unless the law requires otherwise, and we will give you reasonable help to respond.
Breach notification
If we become aware of a personal data breach affecting your data, we will notify you without undue delay and share the information you need to meet your own notification duties.
Return and deletion
On termination, or at your request, we will delete or return the personal data we process for you within a reasonable period, unless the law requires us to keep it. Backups are deleted on our normal cycle.
Audits
You may audit our compliance with this DPA once a year, or after a breach, on reasonable notice and in a way that does not disrupt the service. We may satisfy an audit by providing our documentation and answering your questions. You bear your own audit costs.
Order of precedence
If this DPA conflicts with the rest of the agreement on the processing of personal data, this DPA controls for that subject.
Contact
To ask about this DPA or request a signed copy, email legal@veydria.com.