Data Processing Agreement
For business and reseller customers. This DPA forms part of the Terms and Conditions where Verachek processes personal data on your behalf.
1. Parties and roles
You (the customer) are the controller of personal data contained in the content you submit; Substantia Regulatory (Verachek) is the processor. Where Verachek determines the purposes and means, for example account administration and billing, it acts as an independent controller under the Privacy Policy.
2. Subject matter, duration, nature and purpose
Processing of personal data incidental to Safety Data Sheets, substance declarations and product records (typically supplier or contact details) for the purpose of regulatory screening, report generation, human review and workspace storage, for the duration of the service agreement.
3. Processor obligations
- Process personal data only on your documented instructions, which include the Terms and your use of the service.
- Ensure persons authorised to process the data are bound by confidentiality.
- Implement appropriate technical and organisational measures (encryption in transit, per-account isolation, access control, secure secret storage, logging).
- Engage sub-processors only under written terms that impose equivalent obligations, maintain a sub-processor list, and give you 30 days' notice of changes with a right to object.
- Assist you with data-subject requests, security, breach notification and, where relevant, impact assessments.
- Notify you of a personal-data breach without undue delay after becoming aware of it.
- Delete or return personal data at the end of the service, subject to legal retention duties.
- Make available the information necessary to demonstrate compliance and allow audits, on reasonable notice and no more than once a year unless required by a supervisory authority.
4. International transfers
Processing takes place in the EU/EEA where our stack allows. Transfers to sub-processors outside the EU/EEA rely on an adequacy decision or the EU Standard Contractual Clauses, with supplementary measures where needed.
5. Sub-processors at the date of this DPA
document-processing provider; automation platform; database and file storage; application/portal provider; payment processor; transactional email provider. The named list with locations is provided on request and on signature.
6. Liability
Liability under this DPA is subject to the limitation in the Terms and Conditions, except where the GDPR provides otherwise.
To execute this DPA for your organisation, or to receive the named sub-processor list, contact privacy@verachek.com.