Data Processing Agreement (DPA)

[PLACEHOLDER: draft skeleton, to be replaced by the text validated by the owner's lawyer]

1. Scope

This agreement is concluded between the Customer (controller) and VELLOX SRL (processor) in accordance with Article 28 GDPR and covers the personal data of the Customer's subscribers processed through the Service.

2. Instructions

The processor processes the data only on the documented instructions of the controller, i.e. to deliver and track the e-mail campaigns configured by the Customer.

3. Confidentiality and security

Access is limited to authorised staff bound by confidentiality; technical and organisational measures include encryption in transit, access control, logging and backups.

4. Sub-processors

Hosting and e-mail delivery providers located in the EU/EEA; the current list is available on request. The controller is informed of changes.

5. Assistance and deletion

The processor assists with data subject requests and breach notifications, and deletes or returns the data at the end of the contract.

6. Audit

The controller may request the information necessary to demonstrate compliance. Contact: contact@vellox.ro.