Data Processing Addendum

This Data Processing Addendum (“DPA”) is between the business customer (“Customer”) and [VERITY LEGAL ENTITY] (“Provider”) and forms part of the Terms of Service when Customer uses Verity as an organization.

Role allocation is flexible: where applicable, Customer may be a controller (or “business”) and Provider a processor (or “service provider”) for personal data in Customer Content. For account data about individual users that Provider collects to operate Verity as a SaaS product, Provider may be an independent controller (or equivalent). This DPA does not force the same controller/processor classification onto every dataset or jurisdiction.

If Israeli law, other national privacy law, or a follow-on agreement assigns different labels, those labels apply to the relevant processing.

Provider will process Customer Content only:

• to provide, secure, and support the Service
• according to Customer’s documented instructions in the product (upload, analyze, share with workspace members, delete/retain settings)
• as required by law (in which case Provider will notify Customer unless legally prohibited)

Customer is responsible for the lawfulness of Customer Content and for any notices or permissions needed from data subjects.

Provider will ensure that persons authorized to process Customer Content are bound by confidentiality obligations.

Provider will maintain reasonable technical and organizational measures appropriate to the Service, including access control, hashing of passwords, session controls, encryption in transit, and private storage of uploads when object storage is configured. Customer is responsible for member access inside the workspace.

Customer authorizes Provider to use subprocessors necessary to host, store, send email, process payments, run model inference, and measure reliability. The Privacy Policy lists providers actually used.

Provider remains responsible for subprocessors’ performance of the obligations Provider outsources to them, to the extent required by applicable law.

Provider will impose data-protection terms on subprocessors no less protective of Customer Content than this DPA in material respects, where the subprocessor processes that content.

Taking into account the nature of processing, Provider will assist Customer with requests from individuals that Customer cannot reasonably fulfill alone from the product (access, correction, deletion), by providing workspace tools where they exist and reasonable cooperation via [PRIVACY CONTACT EMAIL].

Provider will notify Customer without undue delay after becoming aware of a security incident affecting Customer Content, and will provide information reasonably available to help Customer meet its own notification duties. Notification is not an admission of fault.

On termination of the Service, Provider will delete or return Customer Content from live systems within a reasonable period, except copies retained as required by law, for security, billing, or dispute resolution, or remaining in backups until recycled.

Return means making available the data as it exists in the product at that time (for example remaining files and analysis records). Provider does not guarantee a specialized migration format unless separately agreed.

Upon reasonable written request, no more than once per year unless a confirmed incident requires more, Provider will make available information reasonably necessary to demonstrate compliance with this DPA (for example a summary of security measures). On-site audits, if required by mandatory law and not reasonably satisfied by documentation, will be scheduled to minimize disruption and may be subject to confidentiality and cost allocation.

Customer acknowledges that subprocessors may process data outside Customer’s country, including outside Israel. Provider will use available contractual and technical measures offered by those subprocessors where a restricted transfer requires them. This DPA does not invent a specific standard-contractual-clause package; the operator should attach the mechanism counsel selects.

Retention of Customer Content follows the Privacy Policy and workspace settings. Acceptance records, invoices, and security logs may be kept for longer than live Customer Content.

If this DPA conflicts with the Terms for data-protection obligations concerning Customer Content, this DPA controls. Liability remains subject to the Terms except where data-protection law requires otherwise.

Governing law: [GOVERNING LAW], subject to mandatory privacy statutes. Contact: [PRIVACY CONTACT EMAIL].