Data processing agreement

Auftragsverarbeitungsvertrag

Data Processing Agreement Last updated: 16 July 2026 This Data Processing Agreement, including its Annexes ("DPA"), forms part of, and is incorporated into, the Terms of Service between you ("Merchant," "Controller," or "you") and Blue Squirrel Pte Ltd (UEN 202306690Z), registered address Blk 328 Tampines St 32, #08-362, 520328, Singapore, trading as Vedron ("Vedron," "we," "us," "our," or "Processor"). Capitalised terms not defined here have the meaning given in the Terms of Service (the "Terms") or in the GDPR. This DPA applies where we process Personal Data on your behalf as a processor in connection with the Service, and reflects the parties' agreement as required by Article 28(3) of the EU General Data Protection Regulation ("GDPR"). In case of conflict between this DPA and the Terms, this DPA prevails on the subject of Personal Data processing. 1. Roles and scope 1.1 Roles. You are the controller of the Personal Data you submit to, connect to, or that is processed through the Service. We act as your processor, processing that Personal Data only on your documented instructions. 1.2 Where you are yourself a processor. If you are a processor acting on behalf of a third-party controller (for example, providing managed services to your own client), you confirm that you are authorised to give us instructions on that controller's behalf and that you remain responsible to that controller for compliance with your own processor obligations. We will treat you as the controller for the purposes of this DPA, and you will flow down equivalent terms to the underlying controller. 2. Processing on documented instructions 2.1 Instructions. We will process Personal Data only on your documented instructions, which include: (a) the configuration of the Service and its integrations through the Service's administrative interface; (b) your instructions in Annex 1; and (c) such further instructions as you give through the Service or otherwise in writing. 2.2 Scope of instructions. Your instructions must comply with applicable data-protection law. We will not be required to follow any instruction that, in our reasonable opinion, infringes applicable law, and we will notify you promptly if we become aware of such a conflict. 2.3 Merchant-directed transfers. When you configure the Service to transmit data to a connected sales channel, marketplace, payment provider, carrier, tax/accounting system, or other third-party system (for example Amazon, Shopify, KSeF, DATEV, easybill, eRechnung/ZUGFeRD, e-Sprawozdania), you instruct us to send the data you have selected to that third party on your behalf. Those third parties are independent controllers or processors acting on your instructions and under your authority, not our sub-processors; you are responsible for your use of those systems, for the lawfulness of transmitting data to them, and for maintaining any necessary agreements with them. Annex 4 lists the current Merchant-directed destinations. 2.4 No monitoring. We do not monitor, review, or audit the Personal Data for legality, quality, or completeness. Automated outputs depend on the data and configuration you provide. 3. Confidentiality 3.1 Personnel. We ensure that our personnel authorised to process Personal Data are subject to binding confidentiality obligations that survive termination of their engagement, and grant access only on a need-to-know basis. 3.2 No publication. We will not publish, share, or otherwise make Personal Data available to any third party except as instructed by you, as required to provide the Service, or as required by law. 4. Security measures 4.1 Measures. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to data subjects, we implement and maintain the technical and organisational measures ("TOMs") described in Annex 2. 4.2 Review. We regularly review and update the TOMs and will notify you of any material change that reduces the level of protection (without limiting our ability to implement improvements). 4.3 No absolute security. No method of transmission or storage is completely secure. The TOMs are designed to provide a level of security appropriate to the processing, not to guarantee absolute security. 5. Sub-processors 5.1 General authorisation. You provide general written authorisation for us to engage other processors ("Sub-processors") to process Personal Data, subject to this §5. 5.2 Sub-processor contracts. We enter into a written agreement with each Sub-processor imposing data-protection obligations substantially equivalent to those in this DPA. Where a Sub-processor fails to meet its obligations, we remain fully liable to you for the performance of that Sub-processor's obligations. 5.3 Current Sub-processors. Annex 3 lists our current Sub-processors. We maintain an up-to-date list and make it available at [INSERT URL — the Privacy Policy currently says "(link to be added)"] . 5.4 Changes and objection. We will give you reasonable advance notice (at least 30 days) of any intended addition or replacement of a Sub-processor, so that you have the opportunity to object. If you object on reasonable data-protection grounds, we will use reasonable efforts to make available a change in the Service or recommend a commercially reasonable alternative. If we are unable to do so within a reasonable period, you may, as your sole and exclusive remedy, terminate the affected portion of the Service and receive a pro-rata refund for the unused portion of the affected Service, without penalty. 6. Data-subject rights and assistance 6.1 Forwarding requests. If we receive a request from a data subject (or a supervisory authority) concerning Personal Data processed under this DPA, we will promptly forward it to you and will not respond to the request ourselves unless required by law. 6.2 Assistance. Taking into account the nature of the processing, we will assist you, by appropriate technical and organisational measures, insofar as this is possible, with your obligations to respond to data-subject requests and with your obligations regarding data-protection impact assessments and prior consultation with supervisory authorities. You are responsible, at your cost, for responding to data subjects. 6.3 Information for the controller. We will make available to you the information necessary to demonstrate our compliance with Article 28 GDPR (which this DPA itself provides), and we will support reasonable audits as set out in §9. 7. Personal data breach 7.1 Notification. We will notify you without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data breach affecting Personal Data processed under this DPA. 7.2 Information and assistance. Our notification will describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will take reasonable steps to identify the cause and mitigate the effects, and will assist you in meeting your own breach-notification obligations where applicable. 7.3 Controller responsibility. You are solely responsible for determining whether to notify data subjects or supervisory authorities, and for the content of any such notification. 8. Data protection by design and by default The Service applies per-tenant data separation (each customer's data is separated at the database level) and role- and module-based access controls, so that Personal Data is, by default, accessible only to authorised users within your account and to our personnel on a need-to-know basis. You configure the granularity of access within your own account. 9. Audits and certifications 9.1 Information rights. To the extent this DPA, the information we make available, and any independent third-party reports or certifications we hold do not demonstrate our compliance, we will, upon reasonable written request and no more than once per calendar year, make available to you information necessary to demonstrate compliance. 9.2 Audits. Subject to confidentiality and to the reasonable protection of other customers' data, we will contribute to your audits (or those of a third-party auditor you mandate, who is not a competitor and who is bound by confidentiality) at your cost, with reasonable advance notice during business hours. Before any on-site audit, you will use reasonable efforts to use a recent independent third-party audit report, certification, or summary, and we will reasonably cooperate so that any audit does not require access to other customers' data. 9.3 Remediation. Where an audit identifies a material non-compliance by us, we will remediate it at our cost within a reasonable period. 10. International data transfers 10.1 In-scope transfers. Personal Data is hosted within the European Union (application and database hosting with Hetzner in Nuremberg, Germany; file and media storage in Cloudflare R2 in the European Union). However, two categories of transfer may occur to a country outside the EEA that is not the subject of an adequacy decision: (a) Cloudflare edge processing. Cloudflare operates a global network and is headquartered in the United States; some edge processing of Personal Data may occur outside the EEA. (b) Access from Singapore. Vedron (Blue Squirrel Pte Ltd) is based in Singapore, and our support and engineering staff may access Personal Data from Singapore for administration and troubleshooting. Singapore is not the subject of a European Commission adequacy decision. 10.2 Safeguard — Standard Contractual Clauses. For each such transfer, the parties agree that the Standard Contractual Clauses set out in Annex 5 apply, incorporated into this DPA by reference and duly completed as follows: Module 2 (controller-to-processor); Clause 7 (docking clause) applies; Clause 9 (use of sub-processors) Option 2 (general written authorisation) applies with the time period in Clause 9(a) set at 30 days; Clause 11 (redress) Option 1 — the data subject may lodge a complaint with the supervisory authority of Ireland or of their habitual residence; Clause 17 (governing law) — the laws of Ireland; Clause 18 (choice of forum and jurisdiction) — the courts of Ireland; the optional language of Clause 9 does not apply. 10.3 Cloudflare DPA. For transfers to Cloudflare, the parties additionally rely on Cloudflare's Data Processing Addendum, which incorporates the Standard Contractual Clauses. To the extent of any conflict between Cloudflare's DPA and this DPA on the subject of Cloudflare's processing, Cloudflare's DPA governs as between Cloudflare and its customer. 10.4 Sub-processor transfers. We flow down equivalent transfer safeguards to each Sub-processor that transfers Personal Data outside the EEA. 10.5 Transfer-assistance. We will provide reasonable assistance to you, at your request and cost, with any transfer impact assessment, and will notify you if we become aware of a legal requirement or change in law that materially affects the safeguards in this §10. 10.6 Government access. If we receive a request from a public authority (including a law-enforcement or national-security request) for Personal Data processed under this DPA, we will, to the extent legally permitted, notify you promptly, document the request, and challenge it if we reasonably conclude that it is unlawful. 11. Return and deletion 11.1 On termination. On termination or expiry of the Terms, and at your choice, we will return your Personal Data to you in a commonly used, machine-readable format and delete all remaining copies, unless applicable law requires storage. 11.2 Retention period. Retention is governed by our retention schedule and applicable statutory retention periods. As set out in our Privacy Policy: account and contract data is kept for the duration of the account and for six years after account closure; transaction, accounting, and tax data is retained for the longest statutory period applicable in the relevant market (generally up to ten years); and data may not be recoverable after deletion. 11.3 Post-termination access. During the post-termination data-export window provided in the Terms (currently 30 days), you may export your Customer Data, after which we may delete it in accordance with this §11. 11.4 Certificates of deletion. We will, on request, confirm deletion in writing. 12. Records and compliance We maintain records of our processing activities and Personal Data categories as required by Article 30(2) GDPR, to the extent applicable, and make summary information available to you under §9. 13. Liability and indemnity 13.1 Cap. Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms. Nothing in the Terms limits either party's liability in a manner that would breach Article 82 GDPR or other mandatory law. 13.2 Indemnity (controller). You indemnify and hold us harmless from any claim, loss, fine, or cost (including reasonable legal fees) arising from your instructions being unlawful, from the Personal Data you submit being unlawful, or from your breach of this DPA or of your controller obligations — except to the extent the matter is attributable to our fault. 13.3 Sole remedy. Subject to §13.1 and to mandatory law, the remedies in this DPA (including the audit right and the termination-for-sub-processor-objection right in §5.4) constitute the sole and exclusive remedies for breach of this DPA. 14. Term and termination 14.1 Duration. This DPA takes effect when the Terms take effect and remains in effect for so long as we process Personal Data on your behalf, including any post-termination period during which we retain Personal Data as permitted by §11. 14.2 Survival. §§ 3, 4, 7, 10, 11, and 13 survive termination or expiry of this DPA. 15. General 15.1 Order of precedence. In case of conflict between the documents governing the processing of Personal Data, the order of precedence is: (a) the Standard Contractual Clauses (Annex 5); (b) this DPA; (c) the Terms. 15.2 Governing law and jurisdiction. This DPA is governed by the laws of the Republic of Singapore, and the courts of Singapore have jurisdiction — except in relation to the Standard Contractual Clauses, which are governed by the laws and subject to the jurisdiction specified in Clause 17 and Clause 18 of the SCCs (Ireland). 15.3 Variation. We may update this DPA where required to remain compliant with applicable law or with a binding decision of a supervisory authority or court, giving you reasonable notice. 15.4 Notices. Notices under this DPA should be sent to info@vedron.io. Our EU representative under Article 27 GDPR is Weiyang Zhang, Goethestraße 11E, 15234 Frankfurt (Oder), Germany. 15.5 Contact. Our Data Protection Contact can be reached at info@vedron.io. Annex 1 — Subject matter, duration, nature and purpose of processing; data categories; data subjects Subject matter. Vedron's provision of the Service (VedronCMS and VedronERP) to the Merchant. Duration. For the term of the Terms of Service, plus any post-termination retention period described in §11 of the DPA. Nature and purpose. Hosting, storing, processing, securing, and transmitting the Merchant's business data as configured by the Merchant, including storefront/content management, order and inventory management, purchasing, shipping, accounting, reporting, reconciliation, and integration with sales channels, payment providers, carriers, and tax/accounting systems selected by the Merchant. Categories of Personal Data. As determined by the Merchant's configuration and the data the Merchant submits or connects. Typically: Customer and order data (e.g., shopper name, contact details, shipping address, order history) synced from connected sales channels. Supplier and contact data (e.g., supplier name, contact person, address). User data the Merchant creates within its account (e.g., names, email addresses, roles of the Merchant's invited users). Accounting and financial data the Merchant enters, imports, or transmits (which may include personal data, e.g., of employees, contractors, or sole traders). Files and documents (e.g., invoice PDFs, media) stored or processed in the Service. Special categories (Art. 9). The Service is not designed to process special categories of Personal Data. If the Merchant requires processing of such data, the Merchant must obtain our prior written agreement and must provide a legal basis and appropriate safeguards. Categories of data subjects. As determined by the Merchant's data: the Merchant's customers/shoppers; the Merchant's suppliers and contacts; the Merchant's own personnel and invited users; and, where present in accounting or contact data, sole traders, employees, contractors, or other identifiable individuals. Annex 2 — Technical and organisational measures (TOMs) Measures drawn from the Security section of our Privacy Policy: Encryption in transit. Traffic to and from the Service is protected using HTTPS/TLS. Encryption of sensitive credentials at rest. Connected-service credentials (such as marketplace API keys) are encrypted at rest. Authenticated access. Access to the Service is controlled using short-lived access tokens with separate refresh tokens. Role- and module-based access controls. Users can access only the functions and data assigned to their role; access is configurable by the Merchant within its account. Per-tenant data separation. Each customer's data is separated at the database level. Rate limiting. Applied to help protect the Service against abuse. Regular backups. A daily backup regime (2-2-7 system) is maintained. Confidentiality-bound personnel. Personnel authorised to access Personal Data are subject to binding confidentiality obligations and granted access on a need-to-know basis (see §3). Sub-processor governance. Sub-processors engaged under written terms with equivalent data-protection obligations (see §5). Incident management. Breach detection and notification as described in §7. These measures are kept under review and updated as needed. No method of transmission or storage is completely secure. Annex 3 — Sub-processors The following Sub-processors process Personal Data in the provision of the Service. An up-to-date list is maintained at [INSERT URL — the Privacy Policy currently says "(link to be added)"] . Sub-processor Purpose Transfer safeguard Cloudflare, Inc. (US) Content delivery, edge compute (Workers), object storage (R2) for media and invoice PDFs Cloudflare DPA incl. 2021 SCCs (see §10.3) Hetzner Online GmbH (DE, Nuremberg) Application and database hosting EU-located; no third-country transfer for storage Stripe, Inc. (US) Payment processing Stripe DPA incl. SCCs; Vedron does not store raw card details PayPal, Inc. (US) Payment processing PayPal DPA incl. SCCs Merchant-directed destinations are NOT Sub-processors and are listed in Annex 4. Annex 4 — Merchant-directed transfers (on the Merchant's instructions) The following are third-party systems that the Merchant may instruct Vedron to transmit data to via the Service's integrations. These systems are independent controllers or the Merchant's own processors; they are not Vedron Sub-processors. The Merchant is responsible for the lawfulness of transmitting data to them, for maintaining its own agreements with them, and for their processing of the data once received. Availability and behaviour of these systems are outside our control (see Terms §§ 10, 12, 13). Connected sales channels / marketplaces. Allegro, Amazon, Bol, CDON, eBay, eMAG, Kaufland, mimovrste, PHH, Shopify, TikTok Shop, and others as enabled by the Merchant. Tax and accounting systems (transmitting invoices, filings, and related data). Poland: KSeF, e-Sprawozdania. Germany: DATEV, easybill, eRechnung/ZUGFeRD. Payment providers. Stripe, PayPal (in their capacity as the Merchant's independent payment processors; see Annex 3 for their role as Vedron's Sub-processor for payment processing on the Service). Carriers (for shipping labels and tracking). DHL, DPD, InPost, FedEx, and others as enabled by the Merchant. This list is illustrative and may change as integrations are added or discontinued. Configuration of an integration in the Service constitutes your documented instruction to transmit the relevant data to that third party. Annex 5 — Standard Contractual Clauses The Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("2021 SCCs"), Module 2 (transfer controller to processor), are hereby incorporated into this DPA by reference and apply to the transfers described in §10, completed as follows. Clauses and selected options: Clause 7 (docking clause): applies. Clause 9 (use of sub-processors): Option 2 — general written authorisation; the time period for objection in Clause 9(a) is 30 days . Clause 11 (redress): Option 1 — a data subject may lodge a complaint with an independent public authority in the Member State of his or her habitual residence, place of alleged infringement, or with the competent supervisory authority identified below. Clause 13 (supervision): the supervisory authority of Ireland . Clause 15 (complaints): a data subject may lodge a complaint with the supervisory authority identified in Clause 13. Clause 17 (governing law): the laws of Ireland . Clause 18 (choice of forum and jurisdiction): the courts of Ireland . Clause 9 optional language on independent dispute resolution: does not apply. Description of the transfer (Clause 1 / Annex I.A & B): Data exporter: the Merchant (controller), as party to the Terms. Data importer: Blue Squirrel Pte Ltd (UEN 202306690Z), Blk 328 Tampines St 32, #08-362, 520328, Singapore, trading as Vedron; contact: info@vedron.io; EU representative (Art. 27): Weiyang Zhang, Goethestraße 11E, 15234 Frankfurt (Oder), Germany. Sub-processors (Annex I.C): as listed in Annex 3 to this DPA. Categories of data subjects: as listed in Annex 1. Categories of Personal Data: as listed in Annex 1. Sensitive data: the Service is not designed to process special categories of data (see Annex 1). Frequency and nature of the transfer: continuous, on a remote-access basis, for the duration of the Terms. Purpose of the transfer: provision of the Service as described in Annex 1. Period for which Personal Data will be retained / deletion: as described in §11 of the DPA. Annex II — Technical and organisational measures: as set out in Annex 2 to this DPA. Annex III — Sub-processors (where Clause 9 Option 1 applies): as listed in Annex 3 to this DPA.