This Data Processing Addendum (the "DPA") forms part of the agreement between the customer ("Controller") and VALO TECH PTE. LTD. ("Processor", "VALO") for the Verdiq platform (the "Service"). It governs VALO's processing of personal data on the Controller's behalf and is designed to meet Article 28 of the GDPR and the processor obligations of Singapore's PDPA. A countersigned copy is available on request at legal@valotech.org.
1. Roles and scope
The Controller determines the purposes and means of processing the personal data it submits to the Service ("Customer Personal Data"); VALO processes that data only as a processor. The subject matter is the provision of the Service; the duration is the term of the agreement; the nature and purpose are hosting, securing, and operating the Service; the data subjects and categories are those the Controller chooses to upload.
2. Processing on instructions
VALO processes Customer Personal Data only on the Controller's documented instructions, including the agreement and the configured use of the Service, unless required otherwise by law (in which case VALO will inform the Controller unless legally prohibited).
3. Confidentiality
VALO ensures that personnel authorized to process Customer Personal Data are bound by confidentiality and are trained on their obligations, and limits access to those who need it to provide the Service.
4. Security
VALO implements appropriate technical and organizational measures under Article 32 GDPR, including encryption in transit and at rest, strict per-tenant isolation, access controls and least privilege, append-only audit logging, secure development practices, and regular testing of those measures.
5. Subprocessors
The Controller authorizes VALO to engage the subprocessors listed on the Subprocessorspage, each bound by data-protection terms no less protective than this DPA. VALO will give at least thirty days' notice before adding or replacing a subprocessor, and the Controller may object on reasonable data-protection grounds.
6. Data-subject requests
Taking into account the nature of the processing, VALO will assist the Controller with appropriate technical and organizational measures to respond to data-subject requests (access, correction, deletion, portability, objection), including self-service export where the Service provides it.
7. Personal-data breaches
VALO will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, with the information the Controller reasonably needs to meet its own notification duties, and will assist with the Controller's breach obligations.
8. Assistance with DPIAs
VALO will provide reasonable assistance with data-protection impact assessments and prior consultations with a supervisory authority, where required, given the information available to VALO as processor.
9. International transfers
Where VALO transfers Customer Personal Data across borders, it relies on appropriate safeguards such as the EU standard contractual clauses and equivalent mechanisms, and applies supplementary measures where needed.
10. Audit
VALO will make available the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including through third-party reports and certifications, and, where reasonably required, audits by the Controller on reasonable notice and subject to confidentiality.
11. Return and deletion
On expiry or termination, VALO will, at the Controller's choice, return or delete Customer Personal Data within a defined period and delete existing copies, except where retention is required by law.
12. Precedence and contact
In case of conflict on data protection, this DPA prevails over the rest of the agreement. Questions: dpo@valotech.org.