Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the Controller ("Client") and the Processor ("veritas_fox").

 

1. SUBJECT MATTER AND DURATION

​

veritas_fox will process personal data solely for the purpose of providing AI governance, compliance, and risk assessment services. Processing continues for the duration of the service engagement.

​

2. NATURE AND PURPOSE OF PROCESSING

​

Processing activities include data analysis, audits, reporting, and related consultancy services.

​

3. TYPES OF PERSONAL DATA AND DATA SUBJECTS

​

Personal data may include identifiers, business information, technical logs, and any data provided by the Client. Data subjects may include employees, customers, or other individuals relevant to the Client's operations.

​

4. OBLIGATIONS OF veritas_fox (PROCESSOR)

​

veritas_fox agrees to:

- Process data only on documented instructions from the Client.

- Ensure confidentiality of personnel handling data.

- Implement appropriate technical and organisational security measures.

- Assist the Client with data subject rights requests.

- Assist with DPIAs and consultations with regulators.

- Notify the Client of personal data breaches without undue delay.

- Maintain records of processing activities.

- Allow audits by the Client or authorised auditors.

​

5. SUB-PROCESSORS

​

veritas_fox may engage sub-processors. All sub-processors will be bound by equivalent data protection obligations. The Client will be informed of any intended changes.

 

6. INTERNATIONAL TRANSFERS

 

Where data is transferred outside the UK, veritas_fox will use appropriate safeguards, including the UK Addendum, Standard Contractual Clauses (SCCs), and Transfer Risk Assessments (TRAs).

 

7. SECURITY MEASURES

 

veritas_fox will implement measures such as encryption, access controls, secure storage, monitoring, and incident response procedures.

 

8. DATA SUBJECT RIGHTS

 

veritas_fox will assist the Client in responding to requests under UK GDPR, including access, rectification, erasure, restriction, objection, and portability.

 

9. END OF PROCESSING

 

Upon termination of services, veritas_fox will delete or return all personal data, unless retention is required by law. Backups will be securely deleted within a reasonable timeframe.

​

10. GOVERNING LAW

​

This DPA is governed by the laws of England and Wales. For questions, contact: hello@veritasfox.com