1. Definitions
- "Controller" means you, the customer, who determines the purposes and means of processing personal data.
- "Processor" means Relay Labs Ltd, trading as Veritome, who processes personal data on behalf of the Controller.
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "Processing" means any operation performed on personal data, whether automated or not.
- "GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation).
2. Subject Matter and Duration
This DPA governs the processing of personal data by Veritome on behalf of the Controller in connection with the provision of the Veritome compliance management platform (the "Services").
The duration of processing shall be for the term of the Services agreement plus any legally required retention period.
3. Nature and Purpose of Processing
Veritome processes personal data for the following purposes:
- Providing and maintaining the EU AI Act compliance management platform
- Processing user account information and authentication
- Storing and managing AI system documentation submitted by the Controller
- Generating compliance reports and assessments using AI assistance
- Providing customer support and communication
- Processing billing and payment information
4. Types of Personal Data and Data Subjects
4.1 Categories of Personal Data
- Contact information (name, email, phone)
- Account credentials (encrypted)
- Organisation details (company name, role, country)
- Billing information (processed via Stripe)
- AI system documentation and compliance data
- Usage logs and analytics data
4.2 Categories of Data Subjects
- Controller's employees and contractors
- Controller's authorised users
- Individuals referenced in AI system documentation (as uploaded by Controller)
5. Obligations of the Processor
Veritome shall:
- Process personal data only on documented instructions from the Controller
- Ensure that persons authorised to process data are subject to confidentiality obligations
- Implement appropriate technical and organisational security measures
- Engage sub-processors only with Controller's authorisation and under written contract
- Assist the Controller in responding to data subject requests
- Assist with data protection impact assessments and consultations with supervisory authorities
- Delete or return all personal data upon termination, as instructed
- Make available all information necessary to demonstrate compliance
6. Sub-Processors
The Controller authorises Veritome to engage the following sub-processors:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure, PostgreSQL database and object storage | Nuremberg & Falkenstein, Germany (EU) |
| Mistral AI | Aria — in-product AI assistance: classification, evidence matching, risk drafting | Paris, France (EU) |
| Upstash | Rate limiting and short-lived cache | AWS eu-central-1 — Frankfurt, Germany (EU) |
| Sentry (Functional Software, Inc.) | Application error and performance monitoring | Sentry EU region — Germany (EU) |
| PostHog, Inc. | Product analytics — only with your analytics-cookie consent | PostHog EU Cloud — Frankfurt, Germany (EU) |
| Plunk | Transactional email delivery | Hetzner, Germany (EU) · delivery via AWS SES (region unstated) |
| Stripe Payments Europe, Ltd. | Payment processing and subscription billing | Dublin, Ireland (EU) · USA (SCCs) |
| Google Ireland Ltd. | Google sign-in, Google Analytics (consent-gated) and the Google Drive evidence connector (only if an admin connects it) | Dublin, Ireland (EU) · USA (SCCs) |
| Microsoft | Microsoft Entra ID sign-in and the SharePoint / OneDrive evidence connector (only if an admin connects it) | Dublin, Ireland (EU) · USA (SCCs) |
| GitHub | Evidence connector — read-only, only if an admin connects it | USA (SCCs) |
| Atlassian (Jira) | Evidence connector — read-only, only if an admin connects it | USA (SCCs) |
7. Data Transfer Safeguards
Personal data is hosted in the European Union. The application, database, backups and object storage run on Hetzner infrastructure in Nuremberg and Falkenstein, Germany; Aria's AI processing runs on Mistral AI in Paris, France; the rate-limit store is Upstash Redis in AWS eu-central-1 (Frankfurt); error monitoring and product analytics run in the EU regions of Sentry and PostHog. Certain sub-processors listed in section 6 are established outside the EEA or replicate data to the United States — Resend, Stripe, Google, Microsoft, GitHub and Atlassian. For those transfers, appropriate safeguards are in place including:
- EU Standard Contractual Clauses (SCCs)
- Adequacy decisions where applicable
- Supplementary measures including encryption and access controls
8. Data Breach Notification
Veritome shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach. The notification shall include, where possible, the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.
9. Data Deletion and Return
Upon termination of the Services, Veritome shall, at the Controller's choice, delete or return all personal data within 30 days, unless EU or Member State law requires retention. A certificate of destruction may be provided upon request.
10. Governing Law and Supervision
This DPA is governed by the laws of Ireland. The lead supervisory authority is the Irish Data Protection Commission (DPC).
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Website: www.dataprotection.ie
11. Contact
For questions about this DPA or to exercise your rights: