Data processing agreement

This data processing agreement follows the structure of the Danish Data Protection Agency’s standard contract for data processing agreements. It is entered into between the customer and Veyro when the customer accepts it in the customer portal at kunde.veyro.dk or via a quote link. Acceptance is recorded with the time and version and replaces a signature. If you would like a signed copy, please write to kontakt@veyro.dk.

The parties

The controller: the business that has accepted the agreement ("the customer").

The processor: Veyro, CVR 46857569, Albert Ibsensvej 28, 2. tv, 4200 Slagelse ("Veyro").

1. Purpose and background

Veyro provides websites, online stores, ordering, order management, inventory and job systems, as well as hosting, operations, support and development to the customer (the main agreement; see our terms of service and subscription). When the customer enters personal data about their own customers, employees or partners into the solution, Veyro processes it on the customer’s behalf. This agreement sets out the parties’ rights and obligations under Article 28(3) of the General Data Protection Regulation (GDPR).

The agreement applies for as long as Veyro processes personal data on the customer’s behalf. Appendices A–D form part of the agreement. If the main agreement and the data processing agreement conflict, the data processing agreement takes precedence regarding the protection of personal data.

2. The customer’s rights and obligations

The customer is the controller and warrants that the processing has a lawful basis, that data subjects have been informed about the processing and that the instructions in this agreement are lawful. The customer must not enter sensitive data (GDPR Article 9), data about criminal offences (Article 10) or Danish civil registration (CPR) numbers into the solution unless agreed in writing with Veyro in advance.

3. Veyro acts on instructions

Veyro processes personal data only on documented instructions from the customer, as set out in Appendices A and C or subsequently given by the customer in writing, unless EU or Danish law requires otherwise. In that case, Veyro informs the customer before processing unless the law prohibits this. If Veyro considers an instruction to breach data protection rules, we inform the customer immediately.

4. Confidentiality

Only persons authorised by Veyro who need access to provide the service have access to personal data. They are bound by confidentiality by agreement or law. Access is removed when no longer necessary.

5. Security of processing

Veyro implements the technical and organisational measures required under GDPR Article 32, taking account of the risk to data subjects. The agreed minimum measures are set out in Appendix C.

6. Use of subprocessors

• The customer gives Veyro general authorisation to use subprocessors. The subprocessors approved when the agreement is entered into are listed in Appendix B.
• Veyro gives at least 30 days’ written notice of planned additions or replacements of subprocessors. The customer may object before then. If the parties cannot find a solution, the customer may terminate the affected services effective on the date the change takes effect.
• Veyro imposes the same data protection obligations on subprocessors as in this agreement and is responsible to the customer for their compliance.

7. Transfers to third countries

Personal data is transferred to countries outside the EU/EEA only on the customer’s instructions. Through this agreement, the customer instructs the transfers listed in Appendix B. These are based on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses.

8. Assistance to the customer

To the extent possible, and taking account of the nature of the processing, Veyro helps the customer to

• respond to requests from data subjects for access, rectification, erasure, restriction, data portability and objection,
• comply with the customer’s obligations concerning security, breach notification, informing data subjects, impact assessments and consultation with the Danish Data Protection Agency.

If Veyro receives a request directly from a data subject, we forward it to the customer without undue delay. Assistance beyond the usual scope is charged for the time spent at Veyro’s current hourly rate.

9. Notification of personal data breaches

Veyro notifies the customer without undue delay and no later than 48 hours after becoming aware of a personal data breach. As far as possible, the notification includes the information the customer needs to notify the Danish Data Protection Agency under GDPR Article 33: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken to limit them.

10. Deletion and return

When the processing agreement ends, Veyro deletes all personal data processed on the customer’s behalf and confirms this to the customer, unless retention is required by law. Within 30 days of termination, the customer may request the data in a standard format (such as CSV) before it is deleted. Backups are deleted as they expire at the hosting provider.

11. Audit and inspection

Veyro makes available all information necessary to demonstrate compliance with this agreement and GDPR Article 28. Once a year, the customer may obtain a written account of Veyro’s security measures. If the customer wants an on-site inspection or an audit by an independent third party, the timing and scope are agreed in advance and the customer pays the costs. The Danish Data Protection Agency always has access as provided by law.

12. Other matters

The parties’ liability under this agreement follows the main agreement’s rules on liability and limitation of liability to the extent compatible with GDPR Article 82. Veyro may amend this agreement under the same rules as the terms of service, but never in a way that reduces the protection of personal data.

13. Entry into force and termination

The agreement takes effect when the customer accepts it and applies for as long as Veyro processes personal data on the customer’s behalf. It cannot be terminated separately while the main agreement remains in force. The parties may renegotiate the agreement at any time if the law or processing changes.

14. Contact persons

Veyro: kontakt@veyro.dk, telephone +45 61 66 39 31. The customer: the email address registered in the customer portal. The parties inform each other if the contact person changes.

Appendix A: Information about the processing

Purpose: to provide the services under the main agreement to the customer, namely hosting, operations, maintenance, support, troubleshooting and further development of the customer’s website, online store and ordering, order management, inventory and job systems, including sending emails from the solution.

Nature of the processing: storing, organising, retrieving, displaying, modifying, sending and deleting information in the solution. Veyro only views the information when necessary to provide the service, such as during support and troubleshooting.

Categories of data subjects:

• the customer’s own customers and their contact persons (such as people placing and receiving orders)
• the customer’s employees and users of the solution
• contact persons at the customer’s suppliers and partners
• visitors to the customer’s website and people who complete forms there

Types of personal data (ordinary data, GDPR Article 6):

• name, company name, CVR number, address, delivery address, email and telephone number
• orders, bookings, receipts, jobs, work addresses, notes and messages
• user accounts, roles and logged actions (who did what and when)
• employees’ recorded hours and the hourly rates entered by the customer
• technical information such as IP addresses for security and abuse prevention

Duration: while the main agreement is in force, and thereafter until deletion under section 10.

Appendix B: Subprocessors

The following subprocessors are approved when the agreement is entered into:

• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Hosting websites and systems, database, files and protection against attacks. Data may be processed in Cloudflare’s data centres inside and outside the EU/EEA.
• Resend (Plus Five Five, Inc.), USA. Sending emails from the solution, such as order confirmations, login links and alerts.
• Google Cloud EMEA Limited, Ireland (Google Workspace). Veyro’s email, if the customer sends personal data to us, for example in connection with support.

The current list is always available on this page.

Appendix C: Instructions and security

C.1 Subject matter and instructions: Veyro processes personal data to provide the services in Appendix A and only on the customer’s instructions. The customer’s use and configuration of the solution form part of those instructions.

C.2 Security: Veyro has at least the following measures:

• all traffic is encrypted using HTTPS (TLS)
• each customer has their own database so that customers’ data is kept separate
• login uses personal accounts; login links, one-time codes and sessions are stored only as hash values
• roles restrict what each user can see and change
• protection against forged forms, abuse and excessive attempts (rate limiting)
• access to hosting, the database and code is restricted to persons authorised by Veyro
• the database can be restored to an earlier point in time through the hosting provider’s recovery function
• secret keys are stored encrypted with the hosting provider and never in the code
• security updates are installed regularly

C.3 Assistance: Veyro assists under sections 8 and 9 using the measures in C.2. The customer can correct and delete most information in the solution themselves.

C.4 Storage and deletion: Information is retained while the main agreement is in force or until the customer deletes it. Section 10 applies on termination.

C.5 Location: Processing takes place at Veyro in Denmark and at the subprocessors in Appendix B.

C.6 Transfers to third countries: see section 7 and Appendix B. Other transfers require the customer’s written instructions.

C.7 Supervision of subprocessors: Veyro supervises subprocessors by reviewing their data processing agreements, security documentation and audit reports (such as SOC 2 or ISO 27001) when updated.

Appendix D: The parties’ arrangements on other matters

Assistance under section 8 and inspections under section 11 that go beyond the usual scope are charged for the time spent. Other matters are governed by the main agreement.