DRAFT FOR SOLICITOR REVIEW. Not final, not in force, and not to be shown to a customer as agreed terms (VEY-58).
Veydr data processing agreement
Version: draft 1 (18 Oct 2026). Values in square brackets are for Amadis to fill in.
This agreement is between the customer (the controller) and Amadis Consultancy Ltd (the processor), and forms part of the Veydr terms of service. It sets out the terms Article 28 of the UK GDPR requires, and the EU GDPR's equivalent where it applies.
1. The processing
| Item | Detail |
|---|---|
| Subject matter | A Veydr security readiness assessment of the systems listed in the signed scope and authorisation form |
| Duration | From the signed scope form until deletion at the end of the engagement (clause 9) |
| Nature and purpose | Receiving and decrypting scan results produced in the controller's CI; reviewing code, configuration and results; manual tests with test accounts; writing the readiness report; retests |
| Types of personal data | Whatever personal data is in the controller's code, configuration, commit history and scan results, which may include names, email addresses, identifiers and credentials; contact details of the controller's staff |
| Special category data | Possible: the controller's code or data may hold health or other special category data. The processor never asks for it, and any it meets is treated under clause 4 |
| Data subjects | The controller's staff and contractors; the controller's users, where their data appears in the systems in scope |
2. Instructions
2.1 The processor processes personal data only on the controller's documented instructions: these terms, the signed scope and authorisation form, and written instructions given later. It tells the controller at once if it believes an instruction breaks data protection law.
3. Confidentiality
3.1 Everyone at the processor who handles the controller's personal data is bound by confidentiality.
3.2 No AI system or AI model provider is given the controller's code, results, evidence or forms. AI model providers are therefore not subprocessors under this agreement.
4. Security
4.1 The processor takes the measures Article 32 requires, including:
- results leave the controller's CI only as one file encrypted to the processor's key, whose private half is held
offline (kit/amadis-recipients.txt);
- decrypted data is kept only in one access-restricted folder on the processor's machine, which AI tools are
technically blocked from;
- secrets found are recorded as a fingerprint and location only, never the value;
- manual tests use test accounts and synthetic data on a beta or QA environment only, never production or real users;
- any special category data met is not copied, recorded or quoted, and the report describes a finding without it.
5. Subprocessors
5.1 The controller gives general authorisation for the subprocessors below. The processor gives at least [30] days' written notice of any change, during which the controller may object; if the objection can't be resolved, the controller may end the engagement with a refund for work not yet done.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| [Scan host provider] | Hosting the machine that runs outside-in checks | Domain names and responses from the controller's public hosts | [UK / EU] |
| [Mail provider] | Carrying the encrypted results file and correspondence | Encrypted result files only (it can't read them); contact details | [UK / EU] |
| [Backup store] | Encrypted backups of the engagement folder | Encrypted engagement data | [UK / EU] |
| Stripe Payments Europe, Ltd. | Taking payment at sign-up | Payer's name, email, billing address and payment details | [EU, with transfers under Stripe's terms] |
5.2 The processor puts the same data protection obligations on each subprocessor by contract, and remains liable to the controller for them.
6. Location and transfers
6.1 Personal data is processed in the UK or the EU only. Any transfer outside them needs the controller's prior written agreement and an appropriate safeguard under Chapter V of the UK GDPR.
7. Helping the controller
7.1 The processor helps the controller, as far as it reasonably can, to answer data subject requests and to meet its obligations under Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation).
8. Personal data breaches
8.1 The processor notifies the controller without undue delay and in any case within 24 hours of becoming aware of a personal data breach affecting the controller's data, with what it knows then, and updates it as it learns more.
9. Deletion at the end of the engagement
9.1 At the end of the engagement, the controller chooses in writing whether the processor deletes or returns the controller's personal data. Without a choice within [14] days, the processor deletes it. Either way, the processor then deletes every copy it holds, unless law requires it to keep some, and confirms the deletion in writing. That covers decrypted results, evidence, forms, any temporary source copy, the encrypted results files in the processor's mailbox (the mail provider holds them only as encrypted files), and the engagement's encrypted backups, which are deleted or expire within [30] days of the end of the engagement.
9.2 The processor keeps the readiness report and the signed scope form for [6] years as a record of what was authorised and delivered, unless the controller asks otherwise in writing. Neither holds secret values or special category data.
10. Audit
10.1 The processor makes available all information needed to show it meets this agreement and allows for audits, including inspections, by the controller or an auditor it appoints, on reasonable notice and at the controller's cost.
11. Processor details
Amadis Consultancy Ltd, [registered office]. ICO registration C2050030. Data protection contact: [role mailbox].
Questions for the solicitor
- Is the general authorisation with [30] days' notice in 5.1 acceptable, or should each subprocessor be approved specifically?
- Is Stripe a subprocessor of Amadis for the customer, or a separate controller for payment data? This draft lists it in 5.1 to be safe.
- Is the 6-year retention of the report and scope form in 9.2 justified, and on what lawful basis?
- Does the treatment of possible special category data in 1 and 4 need an Article 9 condition recorded by the controller, and should the scope form ask the customer to confirm one?
- Is the 24-hour breach notice in 8.1 workable alongside the controller's own 72-hour duty to the ICO?
- Should this be a separate signed document or accepted with the terms at checkout?