Veripass Data Processing Agreement
Forms part of the Terms of Service.
1. Parties and roles. The Customer is the controller. Cuandeoro Limited t/a Veripass is the processor of personal data contained in Customer documents and account content ("Customer Personal Data").
2. Subject matter, nature and purpose. Storage, extraction, analysis and publication of product and battery passport data, solely to provide the Service.
3. Duration. The term of the subscription plus the deletion period in clause 11.
4. Categories of data subjects. Customer staff and users; contacts of the Customer's suppliers, customers and laboratories named in uploaded documents.
5. Categories of data. Names, business contact details, job titles, signatures and identifiers appearing in documents; user account data. No special categories of data are expected. The Customer will not upload them.
5A. Customer obligations. The Customer ensures it has a lawful basis for the processing and gives lawful instructions, informs data subjects as required, and does not upload special categories of data.
6. Processor obligations. Veripass will:
- (a) process only on the Customer's documented instructions, including with regard to transfers to a third country, unless required to do so by EU or Member State law, in which case Veripass informs the Customer of that legal requirement before processing unless that law prohibits it on important grounds of public interest;
- (b) ensure persons authorised to process are bound by confidentiality;
- (c) implement the technical and organisational measures in Annex 2;
- (d) assist the Customer with data-subject requests and with Arts. 32-36 GDPR, taking into account the nature of the processing;
- (e) make available information necessary to demonstrate compliance;
- (f) inform the Customer immediately if an instruction infringes data protection law.
7. Subprocessors.
- The Customer gives general authorisation for the subprocessors in Annex 3.
- Veripass notifies new subprocessors by email 30 days in advance. The Customer may object on reasonable grounds and, if no solution is agreed, terminate without penalty.
- Veripass imposes equivalent data-protection obligations on each subprocessor and remains liable for them.
8. International transfers. Customer Personal Data may be processed in the United States by Veripass's hosting provider (Cloud Clusters, Inc.) and Google (Gemini API, paid tier), under the Standard Contractual Clauses (Commission Decision (EU) 2021/914) and, where applicable, the EU-US Data Privacy Framework, with supplementary measures (encryption in transit and at rest). Demo files are deleted after 24 hours.
9. AI processing. Documents are processed by the AI providers in Annex 3 under terms that do not permit them to use Customer data to train their models. We do not use your documents or data to train any AI model.
10. Personal data breaches. Veripass notifies the Customer without undue delay and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data, with the information required by Art. 33(3) GDPR as it becomes available.
11. Return and deletion. At the Customer's choice, Veripass returns or deletes Customer Personal Data. Within 60 days of termination the Customer may export its data. Afterwards Veripass deletes Customer Personal Data within 30 days, including backups within their rotation cycle (maximum 35 days), unless EU or Member State law requires storage.
12. Audits. Veripass allows for and contributes to audits, including inspections, by the Customer or an independent auditor mandated by it and bound by confidentiality. Audits take place once per 12 months on 30 days' notice (more often after a breach or where a supervisory authority requires), during business hours and at the Customer's cost. A written questionnaire comes first where it is enough.
13. Liability. Subject to the limitations in the Terms of Service, except where GDPR does not allow limitation.
14. Precedence. In case of conflict, this DPA prevails over the Terms on data protection matters.
Annex 1 · Processing details
As in clauses 2 to 5.
Annex 2 · Technical and organisational measures
- TLS 1.2 or higher in transit; AES-256 encryption at rest.
- Role-based access, MFA for staff, least privilege.
- Customer data logically separated per account.
- Audit log of validations and publications.
- Daily encrypted backups, 35-day rotation.
- Demo files deleted after 24 h.
- Patching of critical vulnerabilities within 7 days.
- Annual review of these measures.
Annex 3 · Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloud Clusters, Inc. | Hosting of app and passport pages | United States |
| Google (Gemini API, paid tier) | Document extraction | United States |
| Cloud Clusters, Inc. (own mail server, mailcow) | United States |
Stripe processes Veripass's own billing data; it does not process Customer Personal Data from documents.