Data Processing Addendum

Effective: September 13, 2026 · Version 1.0 · Request a signed copy: legal@voltifyagency.com

How to use this DPA: it supplements the Terms and your SOW/MSA where Voltify processes personal data as a processor on your behalf (e.g., hosted VANTA analysis, managed deployments). Email legal@voltifyagency.com with your entity name and SOW reference to countersign. On-prem / local-first processing where data never leaves your environment is outside processor scope — noted per service.

1. Roles & subject matter

Customer = controller; Voltify = processor (sub-processors below). UK/EU/Swiss GDPR, UK GDPR, and applicable US/Mexico data laws apply.
Categories: business contact data, account data, customer-provided analysis inputs/uploads, usage/security logs. No sensitive data should be submitted unless the SOW expressly covers it.
Processing only on documented instructions (SOW + this DPA + your configured use of the service).

2. Processor duties

Process only as instructed; alert you if an instruction appears unlawful.
Confidentiality: personnel under written confidentiality; least-privilege access.
Assist with data-subject requests (access/export/delete) via available tooling within 15 days.
Assist with DPIAs and prior consultation on request with reasonable information.
Delete or return personal data at SOW end (your choice within 30 days), then delete residual copies except where law requires retention (then isolated and protected).

3. Security measures

TLS 1.2+ in transit; AES-256 at rest where we control storage; hashed API keys; tenant isolation (RLS); logging/monitoring; backups; access reviews; PCI-scoped payments via Stripe (no card storage).
Report personal-data breaches without undue delay and within 72 hours of confirmation, with nature, categories, approximate subjects, consequences, and mitigations.

4. Sub-processors

Sub-processor	Purpose	Location
Stripe, Inc.	Payments, invoicing, fraud screening	US/EU
Vercel, Inc.	Hosting, CDN, logs	US/EU
Supabase, Inc.	Auth, database (VANTA)	US/EU (per project)
AI model providers (per VANTA Privacy §5)	Generate requested analysis	US/APAC (per routing)
Upstash / caching	Rate limiting, sessions	US/EU
Email/calendar providers	Transactional email, bookings	US/EU

We give ≥14 days notice of new sub-processors (email + posting here); object on reasonable data-protection grounds within 14 days and we will work in good faith (alternative, configuration change, or termination right for the affected service).

5. International transfers

Non-adequate-country transfers use EU SCCs (Module 2, controller→processor) and the UK IDTA/Addendum as applicable, with transfer impact assessment on request. Contact us for the executed transfer schedule.

6. Audits

Once per 12 months (or on demonstrated breach cause), on 30 days notice and under NDA, you or a qualified auditor may review relevant SOC 2 reports, pen-test summaries, and configuration evidence. On-site audits only where reports are insufficient and scoped to processor systems.

7. Liability & term

Liability under this DPA follows the SOW/MSA (or Terms §12 if none), subject to mandatory data-protection liability. This DPA lasts while we process data for you and for deletion/retention wind-down. Conflicts: SOW > DPA > Terms for processing matters.

8. Signatures

Countersign by email: send entity name, signatory, and SOW reference to legal@voltifyagency.com. Related: Privacy · VANTA Privacy · Bedrock Privacy · Legal Hub.