Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Venoly Terms of Service for customers where Venoly processes personal data on the customer's behalf — typically users of our future B2B APIs, Stripe Connect platform integrations, or white-labelled tenants under Venoly for Platforms.

Where Venoly determines the means and purposes of processing — as for end-user accounts on the consumer platform — we act as controller and this DPA does not apply; the consumer Privacy Policy governs that processing.

The subject matter is the personal data processed in providing the relevant Venoly service to the customer. The duration is the term of the underlying agreement plus any period during which we retain personal data thereafter for retention or legal-hold purposes.

The nature and purpose of processing is described in the Service Description for each Venoly product covered by this DPA. The categories of data subjects are the customer's end users; the categories of personal data are listed in the Service Description and may not exceed what is necessary for the service.

Customer is the controller. Venoly is the processor. Venoly will:

• Process personal data only on the customer's documented instructions, including transfers to third countries.
• Ensure persons authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational measures (§6).
• Engage sub-processors only under the conditions in §4.
• Assist the customer in fulfilling data-subject rights (§8) and security obligations.
• Make available all information necessary to demonstrate compliance and allow audits (§9).
• Delete or return personal data at the end of provision (§10).

Customer authorizes Venoly to engage the sub-processors listed at /legal/subprocessors. Venoly will give at least 14 days' notice of any new or replacement sub-processor; customer may object for reasonable data-protection concerns and, if not resolved, terminate the affected service.

Venoly remains liable to the customer for the performance of each sub-processor's obligations.

Where personal data is transferred outside the European Economic Area, Venoly relies on the EU Standard Contractual Clauses (Commission Decision 2021/914), the UK Addendum, or any successor mechanism. Module 2 (controller-to-processor) is incorporated by reference. The customer instructs Venoly to execute the SCCs with the relevant sub-processor on the customer's behalf.

Venoly implements at minimum:

• Encryption at rest for the production database (AES-256 + Stacked Encryption for PII columns).
• TLS 1.2+ in transit for all customer-facing endpoints.
• Role-based access control with least privilege; admin actions audit-logged.
• MFA on all production administrative access.
• Quarterly review of access; immediate revocation on role change or off-boarding.
• Daily encrypted backups with bounded retention.
• Vulnerability monitoring of dependencies; security patches applied within commercially reasonable timeframes.
• Security incident-response procedure with defined escalation, roles, and post-incident review.

A current Technical and Organizational Measures (TOMs) document is available on request to privacy@venoly.nl.

Venoly will notify the customer of a personal-data breach affecting the customer's data without undue delay and in any event within 72 hours of becoming aware. The notification will include the nature of the breach, categories and approximate numbers affected, likely consequences, and the measures taken or proposed.

Where Venoly receives a data-subject request that relates to personal data processed on the customer's behalf, we will forward it to the customer without responding ourselves (except to acknowledge receipt) unless instructed otherwise. We will assist the customer to respond within legal time limits through appropriate technical and organizational measures.

Customer may, no more than once per calendar year (or where required by a supervisory authority), audit Venoly's compliance with this DPA. Audits will be conducted on at least 30 days' written notice, at the customer's expense, during business hours, and in a manner that does not materially disrupt operations. The customer may rely on independent third-party audit reports (SOC 2, ISO 27001 when available) in lieu of a direct audit.

On termination of the underlying agreement, Venoly will, at the customer's choice, return or delete all personal data processed on the customer's behalf, except where retention is required by Union or Member State law. Venoly will certify deletion in writing on request.

Liability under this DPA is subject to the limitations in the underlying agreement. Nothing in this DPA limits a party's liability that cannot be limited under applicable data-protection law.

Venoly may update this DPA to reflect legal or operational changes. Material changes will be notified at least 30 days before the effective date. If a change materially reduces protections, customer may terminate the affected service for cause.

To execute this DPA as a customer, email privacy@venoly.nl with your company name, jurisdiction, and a description of the processing. We will return a counter-signed PDF along with the relevant Service Description and a copy of the current sub-processor list.