Data Processing Agreement

Effective date: June 9, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Verified Workflows Inc. ("Processor") and the customer ("Controller") and governs the processing of personal data in connection with the Service.

1. Definitions

Terms not defined herein shall have the meaning given in the GDPR. "Personal Data", "Processing", "Data Subject", "Controller", and "Processor" shall have the meanings ascribed in Regulation (EU) 2016/679 (GDPR).

2. Scope and Purpose

This DPA applies when Processor processes Personal Data on behalf of Controller in connection with the Verified Workflows review platform. The subject matter is the human-in-the-loop review of AI-generated content submitted by Controller.

3. Roles and Responsibilities

Controller determines the purposes and means of processing Personal Data submitted to the Service.
Processor processes Personal Data only on documented instructions from Controller, as embodied by Controller's use of the Service.

4. Categories of Data and Data Subjects

Category	Data Subjects	Data Types
Account data	Controller's employees and agents	Name, email, role
Task content	Individuals whose data appears in task payloads	Text, audio, structured data submitted for review
Review data	Reviewers	Reviewer decisions, corrections, certifications

5. Processor Obligations

5.1 Compliance with Instructions

Processor shall process Personal Data only on Controller's documented instructions, unless required by EU or member state law.

5.2 Confidentiality

Processor shall ensure that all persons authorized to process Personal Data are bound by confidentiality obligations.

5.3 Security Measures

Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256)
Access controls limiting data access to authorized personnel
Regular security testing and vulnerability assessments
Physical security of data centers
Pseudonymization of Personal Data where feasible
Ability to restore availability and access in a timely manner

5.4 Sub-processors

Controller grants Processor general authorization to engage the following sub-processors:

Cloud hosting providers (data storage and compute)
Stripe (payment processing)
Wise (payout processing)
Resend (email delivery)

Processor shall inform Controller of any intended changes concerning the addition or replacement of sub-processors, giving Controller the opportunity to object.

5.5 Data Subject Rights

Processor shall assist Controller by implementing appropriate measures to fulfill Controller's obligations to respond to Data Subject requests under Chapter III of the GDPR.

5.6 Data Breach Notification

Processor shall notify Controller without undue delay (and in any event within 48 hours) after becoming aware of any personal data breach.

5.7 Data Protection Impact Assessment

Processor shall assist Controller in conducting data protection impact assessments where required, providing necessary information about the processing.

6. International Transfers

Where Processor transfers Personal Data outside the EEA, it shall ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Deletion and Return of Data

Upon termination of the Service, Processor shall, at Controller's choice, delete or return all Personal Data and delete existing copies, unless EU or member state law requires storage of the Personal Data.

8. Audits and Inspections

Processor shall make available to Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by Controller or another auditor mandated by Controller.

9. Liability

Each party's liability under this DPA shall be subject to the limitation of liability provisions in the Terms of Service.

10. Governing Law

This DPA is governed by the laws of the State of California, without regard to conflict of law principles, except to the extent the GDPR applies mandatorily.