Data processing agreement.

Where an engagement involves personal data from your customers, employees or users, Veltacta acts as a processor on your instructions. A full data processing agreement under GDPR Art. 28 is available on request and is signed before any such data is shared. This page summarises its main terms.

The main terms

• EU hosting. Systems we run for you are hosted in an EU region. Where you host in your own cloud account, the region is yours to choose.
• Sub-processors listed on request. The hosting, monitoring and model providers used on your engagement are named in the agreement, and you are told before one is added or replaced.
• No training on client data. Your data is never used to train or fine-tune models for anyone else, and model providers are configured so they do not retain it for training.
• Deletion at the end of the contract. At handover or termination, data we hold on your behalf is returned or deleted, with written confirmation, except where law requires us to keep it.
• Security. Access on a need-to-know basis, encryption in transit and at rest, audit logging, and incident notification without undue delay.
• Your rights as controller. Audit and inspection rights, assistance with data subject requests, and support for your own impact assessments.

How to request it

Write to hello@veltacta.com with the name of your organisation and the engagement. We send the agreement as a signable document, and we accept your standard DPA where it covers the same ground.