Data Processing Agreement

1.1 Definitions. In this DPA:

(a) “Customer Personal Data” means the personal data within Customer Data that Veliu processes on Customer’s behalf in providing the Services.

(b) “Data Protection Law” means Regulation (EU) 2016/679 (the “GDPR”), the Irish Data Protection Act 2018 and the other EU and Member State laws on personal data that apply to the processing, and, where they apply, the UK GDPR and the Swiss Federal Act on Data Protection.

(c) “Personal Data Breach” means a personal data breach, as defined in Article 4(12) GDPR, affecting Customer Personal Data.

(d) “Standard Contractual Clauses” means the clauses annexed to Commission Implementing Decision (EU) 2021/914.

(e) “Subprocessor” means a processor that Veliu engages to process Customer Personal Data.

1.2 Roles. Customer is the controller of Customer Personal Data and Veliu is its processor.

1.3 Veliu as controller. Veliu is the controller of (a) the anonymised Telemetry it derives under Section 11 and (b) the personal data of Users it processes to administer their accounts, invoice Customer, communicate with Users and understand how the Services are used, as Veliu’s Privacy Policy describes.

1.4 Customer’s responsibilities. Customer ensures that its instructions comply with Data Protection Law, that it has a lawful basis for the processing, and that it gives its visitors and customers the information, and obtains the consents, that the law requires, including for the Veliu code on its website.

2.1 Subject matter and purpose. Veliu processes Customer Personal Data to provide the Services under the Agreement and each Order: to run the Brand Agent on Customer’s website and the other channels stated in the Order, to prepare and write into Customer’s systems the changes Customer approves, to read the software Customer connects, and to provide analytics, recommendations, support and security.

2.2 Nature. Collection, recording, organisation, storage, retrieval, consultation, analysis, use in conversations and model inference, disclosure to Subprocessors, and erasure.

2.3 Duration. The term of the Agreement and, after it, the periods in Section 10.

2.4 Categories of personal data.

(a) Catalog and product data. Any personal data in Customer’s catalog and product data.

(b) Visitor and customer data. The content of conversations between the Brand Agent and Customer’s website visitors and customers, online identifiers, device, browser and usage data, IP address and approximate location, and order data such as order references, products and amounts.

(c) Data from connected software. Analytics and search console data, to the extent it contains personal data, and the email address of each connected account.

(d) Staff account data. Names, business email addresses and roles of Customer’s Users, as used within the Services on Customer’s behalf.

2.5 Categories of data subjects. Visitors to Customer’s website and other channels, including people on whose behalf an AI agent talks with the Brand Agent; Customer’s customers; Customer’s staff and Users; and any other individual whose personal data Customer includes in Customer Data.

3.1 Documented instructions. Veliu processes Customer Personal Data only on Customer’s documented instructions, including as to transfers to a third country, unless Union or Member State law requires otherwise; Veliu then informs Customer of that requirement before processing, unless that law prohibits it on important grounds of public interest.

3.2 Content. Customer’s documented instructions are this DPA, the Agreement and each Order, the settings Customer chooses in the Services, the approvals it gives in the back office, and any further written instruction consistent with them. Customer instructs Veliu to derive Telemetry under Section 11.

3.3 Unlawful instructions. Veliu informs Customer immediately if, in its opinion, an instruction infringes Data Protection Law, and may suspend that instruction until the Parties agree how to proceed.

4.1 Authorised persons. Every employee and contractor Veliu authorises to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and accesses that data only as needed to provide the Services or to comply with the law.

5.1 Measures. Veliu implements and maintains the technical and organisational measures in Annex 2, which ensure a level of security appropriate to the risk under Article 32 GDPR.

5.2 Updates. Veliu may update those measures, provided the overall level of protection is maintained or improved.

6.1 Authorisation. Customer gives Veliu a general written authorisation to engage the Subprocessors in Annex 3 and further Subprocessors under this Section 6.

6.2 Terms and liability. Veliu engages each Subprocessor under a written contract whose data protection obligations protect Customer Personal Data at least as well as this DPA, and remains liable to Customer for each Subprocessor’s performance.

6.3 Notice. Veliu gives Customer at least thirty (30) days’ notice of any added or replaced Subprocessor, by email or in Customer’s account, naming the Subprocessor, its purpose and its location.

6.4 Objection and termination. Within the notice period, Customer may object on reasonable data protection grounds by email to admin@veliu.com, and the Parties discuss the objection in good faith. If Veliu cannot resolve it before the change takes effect, Customer may terminate the affected Order from the date of the change by notice to admin@veliu.com, paying the fees up to that date only; under annual billing, Veliu refunds the fees prepaid for the period after it on Customer’s request under Section 8.9 of the Agreement. Without an objection within the notice period, the change is authorised.

7.1 EU hosting. Veliu stores Customer Personal Data in the European Union and processes it there, as Section 4.7 of the Agreement states. Model inference runs in EU regions where the provider offers them, and otherwise under Section 7.2.

7.2 Safeguards. Veliu transfers Customer Personal Data outside the European Economic Area, or allows a Subprocessor to do so, only where (a) an adequacy decision of the European Commission covers the destination, including the EU-US Data Privacy Framework for a certified recipient, or (b) the Standard Contractual Clauses (Module 3, processor to processor) bind Veliu and the recipient, with the supplementary measures the transfer requires. Where UK or Swiss law applies, the Standard Contractual Clauses apply with the UK Addendum or the Swiss adjustments. Annex 3 states the safeguards.

8.1 Data subject requests. Taking into account the nature of the processing, Veliu assists Customer by appropriate technical and organisational measures in answering requests from data subjects to exercise their rights. Veliu forwards to Customer without undue delay any such request it receives, and answers the data subject only on Customer’s instructions or as the law requires.

8.2 Impact assessments. Veliu gives Customer the information available to it that Customer reasonably needs for data protection impact assessments and prior consultations under Articles 35 and 36 GDPR.

8.3 Personal Data Breaches. Veliu notifies Customer of a Personal Data Breach without undue delay and no later than seventy-two (72) hours after becoming aware of it, by email to the User who administers Customer’s account. The notice describes, as far as then known, the nature of the breach, the data subjects and records concerned, its likely consequences, the measures taken or proposed and a contact point. Veliu completes the notice as facts emerge and takes reasonable steps to contain the breach and limit its effects.

9.1 Certifications and reports. On request, Veliu makes available the information necessary to demonstrate compliance with this DPA and Article 28 GDPR, including the certifications and audit reports of its Subprocessors where the providers allow their disclosure, and written answers to reasonable security questionnaires. Customer relies on this information first.

9.2 Inspections. Where that information does not demonstrate compliance, Customer may audit Veliu, itself or through an independent auditor bound by confidentiality, including on site, once in any twelve (12) months, or more often where a supervisory authority requires it, with at least thirty (30) days’ notice by email to admin@veliu.com. Audits take place during Business Hours with the least disruption to Veliu’s operations, and give no access to other customers’ data or to Subprocessors’ facilities. Veliu remedies any non-compliance the audit finds.

10.1 Return. For thirty (30) days after an Order ends, Customer may export Customer Data, including Customer Personal Data, in the formats the Services offer under Section 4.8 of the Agreement, or ask Veliu by email to return it in a commonly used, machine-readable format.

10.2 Deletion. Within sixty (60) days after the Order ends, Veliu deletes the Customer Personal Data processed under it, including where Subprocessors hold it, except what Union or Member State law requires Veliu to keep, for as long as that law requires. Customer Personal Data in backups is deleted as the backups rotate, within ninety (90) days after the Order ends. Until deletion, this DPA continues to protect it.

10.3 Earlier deletion. Customer may ask for earlier deletion by email to admin@veliu.com, and Veliu confirms deletion in writing on request.

11.1 Customer’s instructions only. Veliu uses Customer Data only to provide the Services to Customer and to derive Telemetry, on Customer’s instructions under Section 3. Veliu does not use Customer Data, including Customer Personal Data, to train, fine-tune, evaluate or otherwise improve any artificial-intelligence model, agent or system made available to, or operated for, anyone other than Customer.

11.2 What Veliu learns from Customer stays with Customer. Models, prompts, configurations, knowledge and memory that Veliu derives from Customer Data serve only Customer’s own Brand Agent and Services, and Veliu does not transfer them to, or use them for, any other customer.

11.3 Model providers. The model providers in Annex 3 process Customer Personal Data under enterprise terms that do not allow them to use it to train their models.

11.4 Telemetry. Veliu improves its models, agents and Services only with Telemetry (Section 4.4 of the Agreement). Telemetry derived from Customer Personal Data meets three conditions: (a) no one can re-identify from it a natural person, Customer or its brand by the means reasonably likely to be used, alone or combined with other data; (b) it is aggregated across brands; (c) it names no brand and no person, and discloses none of Customer’s unpublished data. Veliu does not attempt to re-identify Telemetry and does not allow anyone else to do so.

11.5 Public information. Section 4.6(e) of the Agreement governs the information Customer publishes on its own website or feeds, which Veliu’s assessment tools read from the outside, as any AI shopping agent does.

11.6 Survival. This Section 11 survives for as long as Veliu holds any Customer Data.

12.1 Limits. Each Party’s liability under this DPA is subject to Section 12 of the Agreement and counts towards the limits stated there. Nothing in this DPA limits the rights of data subjects under Data Protection Law.

13.1 Term. This DPA takes effect with Customer’s first Order and applies while Veliu processes Customer Personal Data, including during the periods in Section 10.

13.2 Precedence. Section 18.11 of the Agreement sets the order of precedence, and this DPA controls over the Agreement and any Order on matters of personal-data processing. The Standard Contractual Clauses, where they apply, prevail over every other term.

13.3 Language. Section 18.13 of the Agreement applies to this DPA.

(a) Controller. Customer, as identified in the Order.

(b) Processor. Veliu Limited, admin@veliu.com.

(c) Data subjects and personal data. Sections 2.5 and 2.4.

(d) Special categories. None required by the Services; a visitor may volunteer them in a conversation, for example a health need behind a product question.

(e) Nature, purpose, duration and retention. Sections 2.1 to 2.3 and Section 10.

(f) Frequency. Continuous, for the term of the Agreement.

(g) Subprocessors. Annex 3.

(h) Veliu’s lead supervisory authority. Data Protection Commission, Ireland.

(a) EU hosting. Customer Data is stored and processed on infrastructure in the European Union, operated by cloud providers that hold SOC 2 Type II reports, and ISO/IEC 27001 certification where the provider holds it: Amazon Web Services, Google Cloud, Vercel and Supabase, in EU regions.

(b) Encryption. In transit with TLS 1.2 or higher; at rest with AES-256.

(c) Backups and resilience. Daily backups and redundancy across availability zones; availability monitored from at least two locations in the European Union.

(d) Access control. Least-privilege access with multi-factor authentication, logged; credentials for the software Customer connects stored encrypted.

(e) Vulnerabilities and incidents. Vulnerability management, and incident response with notice to Customer under Section 8.3.

(f) Model inference. In EU regions where the provider offers them, otherwise under the Standard Contractual Clauses (Sections 7 and 11).

Subprocessors established outside the European Economic Area, or with access from outside it, rely on the Standard Contractual Clauses or on an adequacy decision, including the EU-US Data Privacy Framework where certified.