This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between VeriStay Ltd ("Processor", "we", "us") and the Customer ("Controller", "you") and governs the processing of personal data in connection with the Services.
Note: This DPA is incorporated by reference into the Terms and Conditions. By using the Services, you agree to this DPA. For executed copies or custom enterprise terms, contact info@veristay.app.
In this DPA:
You are the Controller of Personal Data uploaded to or processed through the Services. VeriStay acts as your Processor when processing Personal Data on your behalf.
The categories of Personal Data processed may include:
Data subjects may include:
VeriStay will process Personal Data only:
Your use of the Services constitutes your instructions for processing. Additional instructions must be provided in writing and may be subject to additional fees if they require changes to the Services.
VeriStay implements appropriate technical and organisational measures to protect Personal Data, including:
You provide general authorisation for VeriStay to engage Sub-processors to assist in providing the Services. VeriStay will:
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Cloud hosting, storage, compute | UK / EU |
| Stripe | Payment processing | UK / EU / US |
| SendGrid (Twilio) | Email delivery | US (with SCCs) |
VeriStay will notify you at least 30 days before engaging a new Sub-processor. If you have a reasonable objection, you may notify us within 14 days. If we cannot resolve the objection, you may terminate the affected Services.
VeriStay will assist you in responding to requests from data subjects exercising their rights under Data Protection Laws, including:
Where possible, you can fulfil requests using self-service features in the Services. For requests requiring our assistance, contact info@veristay.app.
VeriStay will notify you without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data breach affecting your data.
Notification will include (to the extent known):
VeriStay will cooperate with you and provide reasonable assistance to fulfil your breach notification obligations to supervisory authorities and data subjects.
Personal Data is primarily stored and processed in the United Kingdom and European Economic Area.
Where transfers occur outside the UK/EEA, VeriStay ensures appropriate safeguards through:
VeriStay will retain Personal Data for the duration of the agreement and in accordance with your retention settings in the Services.
Upon termination of the agreement:
VeriStay will make available information necessary to demonstrate compliance with this DPA and allow for audits.
VeriStay maintains SOC 2 Type II certification (in progress) and will provide audit reports on request under NDA.
For Enterprise customers, on-site audits may be conducted with at least 30 days' notice, during business hours, no more than once per year, and subject to confidentiality requirements. Audit costs are borne by the Customer.
VeriStay will provide reasonable assistance if you are required to conduct a Data Protection Impact Assessment (DPIA) in relation to your use of the Services.
VeriStay ensures that persons authorised to process Personal Data:
This DPA remains in effect for as long as VeriStay processes Personal Data on your behalf. Termination of the main agreement automatically terminates this DPA.
Each party's liability under this DPA is subject to the limitations set out in the Terms and Conditions.
For questions about this DPA or to request an executed copy:
VeriStay LtdVeriStay is built with privacy and security at its core. Need an executed DPA or have questions?
Get in Touch