Data Processing Addendum

1. Roles

For customer workspace data, the customer is typically the controller or business, and Velnezo acts as processor or service provider.

For account, billing, security, and product operations data, Velnezo may act as an independent controller where permitted by law.

2. Processing instructions

Velnezo processes personal data only to provide and secure the service, comply with documented customer instructions, and meet legal obligations.

Processing may include storage, retrieval, generation, transformation, enrichment, transmission to configured processors, and deletion.

3. Subprocessors

Velnezo may use subprocessors for hosting, databases, email, payments, analytics, monitoring, AI processing, and support workflows.

We require subprocessors to protect personal data using appropriate contractual and technical safeguards.

4. International transfers

Where personal data is transferred internationally, Velnezo relies on appropriate safeguards such as contractual commitments, transfer mechanisms, and risk-based technical measures.

5. Assistance and deletion

We assist customers with data subject requests, security reviews, incident investigation, and deletion or return of personal data where required and technically feasible.