Data processing agreement (DPA) template

1. Parties

• Controller ("Customer"): Company name, Address, Contact person and email
• Processor ("Veltessa"): Veltessa, info@veltessa.com

2. Subject matter and duration

Veltessa processes personal data on the Customer's behalf while providing the dynamic QR code management service (terms of use). This agreement applies for as long as the Service is provided and until the data has been deleted afterwards.

3. Nature of the processing

• Purpose: creating and storing QR codes, redirecting to their destination or showing their content when scanned, scan statistics, user and permission management.
• Data subjects: the Customer's panel users; people whose details the Customer puts into QR content (e.g. business card holders); people who scan the Customer's codes or answer its feedback forms.
• Types of data: username and display name; optional notification email address; QR content (e.g. name, phone number, email, address, links, Wi-Fi passwords); scan records (time, country, device type, operating system; no IP address); feedback answers (rating, chosen answers, an optional comment by the visitor, time, country, device type; no IP address); activity log (including the shortened IP address and country of sign-in events).
• Special categories of data: not intended to be processed; the Customer does not enter such data in QR content.
• Retention: the periods in the privacy policy.

4. Instructions and confidentiality

Veltessa processes personal data only on the Customer's documented instructions (this agreement, the terms of use and the Customer's actions in the panel). The operator exports a workspace's data only at the Customer's request or when the Service ends. It informs the Customer if it considers an instruction unlawful. Persons with access to the data are bound by confidentiality.

5. Security measures

Veltessa applies at least the following technical and organisational measures:

• HTTPS only; passwords stored as salted PBKDF2 hashes; limits on password guessing;
• session cookies that scripts cannot read and that are not sent cross-site; session time-outs;
• role- and project-based access control; an activity log of important actions;
• a strict content security policy; no scripts loaded from elsewhere;
• no IP addresses in scan records and shortened IP addresses in the activity log (data minimisation); Wi-Fi passwords shown only to roles that may edit codes; bot protection on the panel sign-in;
• daily automatic deletion of data whose period has expired; nightly backups encrypted with AES-256 under a key only the operator holds, only the newest 14 kept, and weekly copies of uploaded files encrypted the same way, only the newest 4 kept, in Cloudflare R2 (EU jurisdiction); production access limited to the operator.

6. Sub-processors

The Customer gives general authorisation for the providers listed on the sub-processors page. Veltessa announces a new sub-processor at least 30 days in advance, to the email address the Customer gives in this agreement; the Customer may object on reasonable grounds and, if the objection cannot be resolved, terminate the Service. Veltessa imposes obligations on its sub-processors equivalent to those in this agreement.

7. International transfers

Data is held on Cloudflare's infrastructure, the database with a Western Europe location hint, and may be processed outside the EEA and Turkey. Transfers rely on the safeguards of Chapter V GDPR and Art. 9 KVKK (standard contractual clauses).

8. Assistance and breach notification

Veltessa reasonably assists with answering data subject requests, impact assessments and correspondence with supervisory authorities, and forwards requests it receives to the Customer. It informs the Customer, at the email address given in this agreement, without undue delay after becoming aware of a personal data breach, describing its nature, the data affected and the measures taken.

9. Information and audits

Veltessa provides the information needed to demonstrate compliance with this agreement. The Customer may carry out or commission an audit with reasonable prior notice, at its own cost and at most once a year (additionally after a breach).

10. End of the agreement

When the Service ends, Veltessa returns the data by exporting it, at the Customer's choice, and deletes it within 30 days, except where the law requires it to be kept. Copies in the encrypted nightly backups are deleted as the newest 14 backups are replaced, within 14 days, and uploaded files in the weekly encrypted copies within 35 days; Cloudflare D1 point-in-time recovery copies expire on their own within 7 days at most.

11. Signatures