Data Processing Agreement (DPA)
Contractual commitments regarding GDPR Article 28, Standard Contractual Clauses (SCCs), and data safeguards for merchant transactions orchestrated through Veyro.
1. Introduction
This Data Processing Agreement (“DPA”) forms part of the master agreement between:
Veyro (Processor): Veyro Labs Private Limited, a company incorporated under the laws of India, having its registered office in Bangalore, Karnataka, India (“Veyro”, “Processor”, “we”, “us”, or “our”); and
Customer (Controller): The business entity or individual that has entered into an agreement with Veyro to access or use the Veyro Services (“Customer”, “Controller”, “you”, or “your”).
This DPA applies where Veyro processes Personal Data on behalf of the Customer in connection with the Services and where applicable data protection laws require a written data processing agreement.
This DPA supplements the Veyro Terms of Service and Privacy Policy. If there is a conflict between this DPA and another agreement between the parties concerning the processing of Personal Data, this DPA will prevail to the extent of that conflict.
2. Definitions
3. Roles of the Parties
Where Veyro routes customer payment instructions, handles webhook dispatches, and persists operational transaction logs, Veyro acts as a Processor. Veyro processes data solely on documented instructions from Customer, enforces least privilege, and deletes data post-termination.
Customer establishes the lawful basis for collecting customer data, provides requisite consumer disclosures, and handles consumer privacy rights. Customer warrants that its instructions to Veyro comply with data protection laws.
Veyro acts as an independent Controller for its own direct portal user accounts, billing administration, customer relationship records, platform security audit telemetry, and legal compliance.
4. Scope and Details of Processing
Processing in connection with payment orchestration, multi-gateway API connectivity, webhook processing, reconciliation, and reporting. Processing endures for the active term of the Customer agreement plus required statutory retention windows.
Customer's end-purchasers, transaction participants, Customer employees, and workspace administrators.
Names, billing addresses, email addresses, order IDs, currency and integer amounts, payment method descriptors, gateway transaction references, IP addresses, and webhook payloads.
The Services are not designed for routine processing of special categories of data (health, biometric, political beliefs). Customer warrants it will not submit special category data through Veyro.
5–6. Customer Instructions & Confidentiality
Veyro processes Personal Data strictly on documented instructions from Customer. If Veyro reasonably believes an instruction infringes governing data protection statutes, Veyro will inform Customer promptly. All personnel authorized to process Customer Personal Data are bound by enforceable confidentiality obligations.
7. Technical and Organizational Security Measures (TOMs)
Veyro implements state-of-the-art security safeguards designed to protect Personal Data against unlawful disclosure, modification, or destruction:
8. Personal Data Breaches
Veyro will notify Customer without undue delay (and within 48 hours where practicable) after confirming a Personal Data Breach affecting Customer Personal Data. The notice will describe the nature of the breach, affected records, likely impact, and mitigation measures taken.
9. Subprocessors
Customer grants general authorization for Veyro to engage subprocessors for cloud compute, database infrastructure, and telemetry. Veyro imposes equivalent data protection duties on all subprocessors.
Review current approved subprocessors, service functions, and hosting jurisdictions.
10–12. Data Subject Rights & DPIA Assistance
Taking into account the nature of processing, Veyro provides reasonable assistance to help Customer fulfill Data Subject requests (access, rectification, erasure, portability). Veyro also provides reasonable technical documentation to assist Customer in conducting Data Protection Impact Assessments (DPIAs).
13. International Data Transfers
Where cross-border transfers occur from the EEA or UK to jurisdictions without an adequacy decision, the parties agree to incorporate the European Commission's Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum.
14. Retention and Deletion of Personal Data
Upon termination of the Services, Customer may request the return or deletion of Customer Personal Data. Veyro will delete or anonymize all production copies within thirty (30) days, except where continued storage is required by statutory financial, anti-fraud, or tax retention mandates.
15. Audits and Compliance Verification
Veyro makes available reasonable compliance documentation, third-party security certifications, and audit summaries. Where mandated by applicable law, Customer may request an audit during normal business hours with reasonable advance written notice.
16–19. Legal Safeguards & Authority Requests
Customer is responsible for securing client-side API keys and webhook listeners. Veyro is not liable for compromise originating on Customer infrastructure.
If served with binding authority demands for Customer Personal Data, Veyro will challenge overbroad requests and notify Customer where legally permitted.
20. Data Protection Contact
Contractual Annexes
Annex 1: Details of Processing Activities
Annex 2: Technical and Organizational Security Measures (TOMs)
Annex 3 & 4: Subprocessors and Cross-Border Transfers
Approved infrastructure vendors are catalogued in our public Subprocessors Register. Where data is transferred out of the EEA, UK, or Switzerland, the European Commission Standard Contractual Clauses (Module 2: Controller to Processor) and the UK International Data Transfer Addendum apply in full.