Data Processing Addendum

1. Parties and roles

This Data Processing Addendum (“DPA”) forms part of the Website & Trial Terms and any later written customer agreement between VelocityHero AB (“Processor”) and the organisation using VelocityHero (“Controller”).

For account, billing contact, and marketing-site data where VelocityHero determines purposes and means, VelocityHero acts as an independent controller as described in the Privacy Policy. This DPA covers Personal Data processed on behalf of the Controller in the Service (“Controller Personal Data”).

2. Controller obligations

Controller is responsible for ensuring that its instructions and use of the Service comply with applicable Data Protection Law, including having an appropriate legal basis for the Personal Data made available to Processor. Controller determines the purposes and essential means of the processing and is responsible for providing required notices to Data Subjects.

3. Subject matter and duration

Processor processes Controller Personal Data as needed to provide the Service during trial and, if applicable, under a paid agreement. The subject matter, nature, purpose, categories of data and data subjects are set out in Annex 1. Duration is the term of the relevant processing services, subject to the deletion and return obligations in Section 13.

4. Nature and purpose

Processing includes collection, storage, retrieval, analysis, structuring, display and deletion of structured delivery signals to provide project insights, coaching and related Service functionality, as further described in Annex 1.

Processor will not use Controller Personal Data to train artificial intelligence models except on Controller’s documented instructions.

5. Types of data and data subjects

Categories of Personal Data may include names, business email addresses, user identifiers, project membership, Jira issue metadata and status events, Slack check-in responses, and other structured project context configured or connected by Controller. Data subjects are typically Controller users, project participants and authorised collaborators. Further detail is set out in Annex 1. Implementation detail is described in the Trust Center.

6. Controller instructions

Processor will process Controller Personal Data only on documented instructions from Controller, including configuration of projects and integrations in the Service and instructions regarding transfers of Personal Data to a third country or international organisation, unless required to do otherwise by EU or Member State law (in which case Processor will inform Controller unless legally prohibited).

Processor will immediately inform Controller if, in Processor’s opinion, an instruction infringes applicable Data Protection Law.

7. Confidentiality

Processor ensures that persons authorised to process Controller Personal Data are bound by appropriate confidentiality obligations.

8. Security

Processor will implement and maintain appropriate technical and organisational measures designed to protect Personal Data in accordance with Article 32 GDPR, taking into account the state of the art, costs of implementation, and the nature, scope, context and purposes of processing and associated risks.

Current measures are described in the Trust Center. Those descriptions are informational and may evolve; they do not themselves expand the contractual warranties in this DPA beyond the Article 32 standard above.

9. Subprocessors

Controller provides general written authorisation for Processor to engage the subprocessors listed in the product section of our Subprocessor Register to process Controller Personal Data as necessary to operate the Service. Website analytics providers used where VelocityHero acts as controller are outside the scope of this DPA.

Processor will notify Controller at least 30 days before adding or replacing a subprocessor that processes Controller Personal Data, thereby giving Controller a reasonable opportunity to object on legitimate data-protection grounds. Notice may be given by email to Controller’s account or designated privacy contact and by updating the Subprocessor Register.

If Controller objects on legitimate data-protection grounds within the notice period, the parties will discuss the objection in good faith. If no mutually acceptable resolution is reached before the change takes effect, Controller may terminate the affected Service (or, if the change is material to the Service as a whole, the applicable agreement) as its sole remedy for that objection, without prejudice to fees already incurred.

Processor will impose data-protection obligations on subprocessors no less protective than those in this DPA. Processor remains responsible for subprocessors’ performance of those obligations.

10. International transfers

Processor will not transfer Controller Personal Data outside the EEA (or, where applicable, the UK) except on Controller’s documented instructions (including those embodied in use of the Service and engagement of authorised subprocessors) and in accordance with Chapter V GDPR (and UK GDPR where applicable).

Where a transfer requires a Chapter V transfer tool, Processor will rely on an applicable adequacy decision or, where none applies, the European Commission’s Standard Contractual Clauses adopted under Implementing Decision (EU) 2021/914 (and, for UK transfers, the UK International Data Transfer Agreement or Addendum, as applicable), together with supplementary measures where appropriate. Information about relevant subprocessors and typical processing locations is available in the Subprocessor Register. Further details of the applicable transfer mechanism are available on request.

11. Assistance

Taking into account the nature of processing and information available to Processor, Processor will provide reasonable assistance to Controller with its obligations under Articles 32–36 GDPR and, insofar as possible, assist Controller in responding to requests for exercise of Data Subject rights.

12. Breach notification

Processor will notify Controller without undue delay after becoming aware of a Personal Data breach affecting Controller Personal Data, and will provide information reasonably available to help Controller meet legal obligations.

13. Return and deletion

At Controller’s choice, Processor will delete or return Controller Personal Data following termination of the relevant processing services and delete existing copies, unless applicable law requires continued storage. After a trial ends (or after paid processing services end), Processor may retain Controller Personal Data for a short wind-down period (typically up to about thirty (30) days) to support reactivation or delayed procurement, and will then delete it unless Controller converts to a continuing agreement, requests earlier deletion, or applicable law requires continued storage. Personal Data contained in secure backups may remain until expiry of applicable backup cycles, provided it remains protected under this DPA and is not otherwise processed except as required by law.

14. Audits

Upon reasonable written request, Processor will make available information necessary to demonstrate compliance with this DPA. Processor may provide relevant third-party certifications, audit reports or other documentation in the first instance to demonstrate compliance. Where such information is insufficient to satisfy Controller’s reasonable compliance requirements, Processor will allow for and contribute to an audit in accordance with this Section.

On-site or remote audits, if required, shall be limited in scope to what is reasonably necessary, scheduled on reasonable advance notice, conducted no more than once in any twelve-month period unless triggered by a Personal Data breach or material compliance concern, and subject to confidentiality and security constraints that protect the Service and other customers.

15. Contact

Privacy / DPA enquiries: hello@velocityhero.com.

Annex 1 — Details of Processing