Data Processing Agreement

This Data Processing Agreement (DPA) forms an integral part of the agreement between Abels Enterprise B.V. (processor) and the customer (controller). It enters into force automatically upon conclusion of a paid VEO by VERA subscription.

1. Parties

Processor:Abels Enterprise B.V., Mariastraat 52, 1531 JB WORMER, Netherlands, CoC 77754247 (“VEO by VERA”).

Controller:the organisation or person that subscribes to a paid VEO by VERA plan and introduces personal data of its own customers or employees into the platform (“Customer”).

2. Subject matter and purposes

VEO by VERA processes personal data solely for the purpose of providing the agreed service: analysing website visibility (SEO/GEO/AEO). Processing takes place only on the basis of documented instructions from the Customer, unless otherwise required by law.

Categories of personal data processed may include: end-user email addresses, website data (URLs, metadata) and usage logs.

3. Instructions

VEO by VERA processes personal data only in accordance with the written instructions of the Customer, including the instructions arising from the agreement and this DPA. If VEO by VERA is required to process personal data under Union or Member State law, it will inform the Customer in advance, unless prohibited by law.

4. Security measures

VEO by VERA implements appropriate technical and organisational security measures as referred to in Article 32 GDPR, including:

• Encryption of personal data at rest (AES-256) and in transit (TLS 1.2+).
• Access restriction based on the need-to-know principle and role-based access control.
• Regular backups and disaster recovery procedures.
• Logging and monitoring of access to production systems.
• Annual internal security review.

5. Sub-processors

VEO by VERA uses the following sub-processors:

• Supabase Inc. (US) — database hosting; adequacy decision / SCCs applicable.
• Stripe Inc. (US) — payment processing; adequacy decision / SCCs applicable.
• Vercel Inc. (US) — hosting platform; adequacy decision / SCCs applicable.

VEO by VERA will notify the Customer at least 14 days in advance of changes to the engagement of sub-processors. The Customer has the right to object. If the parties cannot reach agreement, the Customer has the right to terminate the agreement.

6. Data subject rights

VEO by VERA will assist the Customer — to the extent technically and organisationally possible — in fulfilling its obligations to respond to requests from data subjects exercising their rights (access, rectification, erasure, objection, data portability). Requests will be forwarded to the Customer within 5 business days of receipt.

7. Duration and termination

This DPA is in force for as long as VEO by VERA processes personal data on behalf of the Customer. Upon termination of the agreement, VEO by VERA will delete all Customer personal data within 30 days, unless the Customer requests data transfer in writing. Deletion will be confirmed in writing.

Questions about this DPA? Contact us at info@veobyvera.com.