Data Processing Agreement

This DPA forms part of the agreement between Veridue AI, Inc. and the Customer and applies where Veridue processes personal data on the Customer’s behalf.

1  Subject matter and scope. Veridue processes personal data contained in documents and inputs the Customer submits to the platform, for the purpose of providing the Services, for the duration of the subscription. Categories of data subject and personal data are those the Customer chooses to upload, typically project counterparties, signatories and contacts.

‍2  Instructions. Veridue will process personal data only on the Customer’s documented instructions, including as to international transfers, unless required otherwise by law, in which case it will inform the Customer unless prohibited. The Agreement, including the Platform Terms of Use and this Data Processing Agreement, constitutes the Customer’s documented instructions.

‍3  Confidentiality. Veridue ensures that personnel authorised to process personal data are bound by confidentiality obligations.

‍4  Security. Veridue implements the technical and organisational measures set out in Annex II (Security Measures), which meet Article 32.

‍5  Sub-processors. The Customer gives general authorisation for the sub-processors listed in Annex III (Sub-processor List), published at veridue.ai/legal/sub-processors. Veridue will give 30 days’ notice of any addition or replacement, and the Customer may object on reasonable data protection grounds. Veridue imposes equivalent obligations on each sub-processor and remains fully liable for their performance.

‍6  Data subject rights. Veridue will assist the Customer, by appropriate technical and organisational measures and insofar as possible, in responding to data subject requests, and will forward any request it receives directly.

‍7  Assistance. Veridue will assist the Customer with security, breach notification, data protection impact assessments and prior consultation, and will notify the Customer without undue delay and in any event within 72 hours of becoming aware of a personal data breach. Assistance under this clause and clause 6 is provided at the Customer’s reasonable expense, unless the need for it arises from an act or omission of Veridue.

‍8  Deletion or return. On termination Veridue will, at the Customer’s election, return personal data by making it available for download for 30 days, and will delete it at the end of that period, save where retention is required by law. Anonymised Data is unaffected.

‍9  Audit. Veridue will make available the information necessary to demonstrate compliance and will allow and contribute to audits, satisfied in the first instance by a completed security questionnaire and any current certification or penetration test summary, and otherwise by audit on reasonable notice, no more than once a year unless required by a regulator. Audits will not extend to information relating to any other customer of Veridue. The Customer bears its own audit costs, unless an audit establishes a material breach by Veridue.

‍10  Transfers. Where personal data is transferred outside the UK or EEA, the EU Standard Contractual Clauses and the UK International Data Transfer Addendum apply and are incorporated, with Veridue as data importer. Module Two applies where the Customer is a controller, and Module Three where the Customer acts as a processor on behalf of another controller. The clauses are deemed completed as follows: the Customer is data exporter and Veridue is data importer; the parties’ details are those in the Order Form or the Customer’s account; Annexes I, II and III to this Agreement serve as Annexes I, II and III to the clauses; option 2 of clause 9 applies, with the notice period in clause 5 of this Agreement; and clauses 17 and 18 are governed by the law of, and subject to the courts of, Ireland. Either party may request that the clauses be executed as a separate document.

‍11  Model providers. Veridue will require any AI model provider processing personal data on its behalf not to use it to train any model.

‍12  Customer obligations. The Customer warrants that it has a valid legal basis and all necessary rights and consents to provide personal data to Veridue and to authorise the processing described in this Agreement. The Customer will comply with Applicable Data Protection Laws in whichever capacity it acts, and will limit the personal data it provides to what is necessary for the Services. Where the Customer provides special category personal data or criminal offence data, the Customer confirms that the processing is necessary for an authorised purpose and that it has identified an applicable lawful basis, any additional condition and any safeguards required by Applicable Data Protection Laws.

‍13  Definitions. "Applicable Data Protection Laws" means the UK GDPR, the EU General Data Protection Regulation, and any other data protection or privacy law applicable to a party, as amended from time to time. "Personal Data" means any Customer Content that relates to an identified or identifiable natural person, or that constitutes personal data or personal information under Applicable Data Protection Laws. "Restricted Transfer" means a transfer of Personal Data requiring a transfer mechanism under Applicable Data Protection Laws. "Standard Contractual Clauses" means the European Commission’s standard contractual clauses adopted on 4 June 2021, and any clauses replacing them. "Anonymised Data" has the meaning given in the Platform Terms of Use.