Data Processing Agreement

For personal data you enter into Vuneli about your employees, suppliers, or customers, you act as the controller and Verde IQ acts as the processor under GDPR Art. 28. For account data (name, email, billing), Verde IQ is an independent controller as described in the Privacy Policy.

Verde IQ processes personal data solely to (a) provide the Vuneli service, (b) prevent abuse and secure the platform, and (c) meet legal obligations. Data is not sold, rented, or used for advertising.

The current list is published on the Security page. We will notify you by email or in-app notice of any additions with a 30-day objection window.

Encryption in transit (TLS 1.2+), encryption at rest for database and backups (managed by the platform), Row-Level Security policies, role-based admin access, HMAC-verified webhooks, and least-privilege service accounts.

Where a sub-processor operates outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses (SCCs, 2021/914).

When we receive a data subject request that concerns your controller data, we forward it to you and support you in responding within GDPR timelines.

In the event of a personal data breach affecting your data, Verde IQ will notify you without undue delay and, in any case, within 72 hours of becoming aware, with the information required by GDPR Art. 33(3).

On termination, controller data is deleted from live systems within 30 days and from backups within 12 months, unless retention is required by law. A structured export can be requested before termination.

Email samuel@stauniverse.tech with your legal entity name and address. We will return a signed counterpart within 5 business days.