Data Processing Agreement

This Data Processing Agreement ("Agreement" or "DPA") governs, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), the processing of personal data that VERYPYME SERVICIOS DIGITALES, S.L. ("VeryPyme" or the "Processor") carries out on behalf of the customer organisation (the "Controller") in providing the services of the VeryPyme platform. It forms part of the contractual relationship together with the Terms and Conditions of Service and prevails over them with respect to the processing of personal data on behalf of the Controller.

1. Parties and scope

The parties to this Agreement are VERYPYME SERVICIOS DIGITALES, S.L., with tax ID B25998022 and registered address at Av. Talgo, 83 – 28023 Madrid (Madrid), Spain, as Processor, and the customer organisation identified in the platform account on whose behalf this Agreement is accepted, as Controller.

The Agreement is accepted on behalf of the Controller, through the platform, by a person with the owner or administrator role in the organisation, who expressly declares to be authorised to accept it on behalf of the organisation. VeryPyme records as evidence the identification of the accepted document (identifier, version, language and digital fingerprint of the text), the identity of the accepting person, their authority declaration and the server-recorded date.

The Agreement applies to all processing of personal data that VeryPyme carries out on behalf of the Controller in the context of the purchased services, as described in Annex I. It does not apply to the processing for which VeryPyme is the controller (user accounts, authentication, billing, contractual records, security, communications, support and analytics), which is governed by the Privacy Policy.

2. Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach", "supervisory authority" and "international transfer" have the meaning given to them by the GDPR.

"Services" means the features of the VeryPyme platform purchased or used by the Controller in accordance with the Terms and Conditions. "Controller Data" means the personal data that the Controller, or the persons acting on its behalf, upload to the platform or that VeryPyme generates from them when providing the Services. "Sub-processor" means any third party engaged by VeryPyme that processes Controller Data. "Authorised representative" means the person with the owner or administrator role in the organisation on the platform.

3. Roles

With respect to Controller Data, the Controller determines the purposes and means of the processing and VeryPyme acts as Processor, processing them solely on behalf of the Controller and in accordance with its documented instructions.

The status of controller or processor is determined for each specific processing activity and not globally. The same data item may be processed by VeryPyme as a processor in the context of the Services and as a controller for its own purposes where the Privacy Policy so provides (for example, a user's email address in order to manage their account).

When the Controller decides to share information with another company through the platform, the receiving company acts as an independent controller of the information received.

4. Subject matter

The subject matter of this Agreement is to govern the conditions under which VeryPyme processes Controller Data to provide the Services: hosting, storage, organisation, processing, information extraction, analysis, assessment, calculation, generation of reports and certificates, automated analysis by means of artificial intelligence, sharing with third parties on the Controller's instruction, creation of technical copies, support and ensuring the security of the service, as described in Annex I.

5. Duration

This Agreement enters into force upon its acceptance by the Authorised representative and remains in force for as long as VeryPyme processes Controller Data in the context of the Services.

The obligations of confidentiality, return and deletion and the other obligations that by their nature must survive will remain in force after termination of the Services until the return or deletion of Controller Data is completed in accordance with clause 18.

6. Nature and purpose

The nature of the processing comprises the operations necessary to provide the Services described in clause 4 and Annex I, carried out by automated means through the platform.

The purpose of the processing is exclusively the provision of the Services to the Controller, including ESG sustainability and compliance assessment, carbon footprint calculation, risk analysis, preparation of plans, reports and certificates, value chain management and the sharing of information instructed by the Controller. VeryPyme will not process Controller Data for its own purposes other than the above, nor train artificial intelligence models with them.

7. Controller's instructions

VeryPyme will process Controller Data only on the documented instructions of the Controller. The following constitute documented instructions: the Terms and Conditions, this Agreement, the configuration and the actions that the Controller or the persons acting on its behalf perform on the platform (uploading, editing, analysing, sharing, exporting or deleting information) and the additional instructions that the Controller communicates in writing to soporte@verypyme.com.

If a provision of Union or Member State law applicable to VeryPyme requires it to process Controller Data otherwise, VeryPyme will inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

VeryPyme will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions, and may suspend the execution of that instruction until the Controller confirms or amends it.

8. Categories of data subjects

Controller Data may relate to the following categories of data subjects, depending on the information the Controller uploads to the platform: employees and workers of the Controller; representatives, directors and contact persons of the Controller; self-employed professionals; suppliers, subcontractors and their contact persons; customers of the Controller and their contact persons; and other persons whose data legitimately appear in the documentation and evidence provided.

9. Types of data

Controller Data may include: identification and contact data (name, surname, position, email, telephone, address); professional and employment data (job, category, type of contract, working hours, training, aggregated or individual workforce and accident data); economic and billing data of third parties contained in documents; business documentation (certificates, policies, invoices, contracts, reports, records); free text, comments and action plans; and any other incidental information contained in the documents provided.

The platform is not designed to process special categories of data (Article 9 GDPR), data relating to criminal convictions and offences or data of minors. The Controller will refrain from uploading them unless strictly necessary for the purpose of the Service and it has a valid legal basis, in which case it must inform VeryPyme in advance in order to agree, where appropriate, additional measures.

10. Confidentiality

VeryPyme will process Controller Data with due confidentiality and will ensure that the persons authorised to process them have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Access by VeryPyme's authorised staff to Controller Data will be limited to what is necessary to operate the platform, provide support, resolve incidents and ensure the security of the Services.

This obligation survives termination of the Agreement.

11. Security

VeryPyme will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of natural persons. The measures implemented as at the date of this version are described in Annex II.

VeryPyme may update the measures in Annex II provided that they do not reduce the overall level of security. The security measures provided by the infrastructure providers, including their certifications, belong to those providers and not to VeryPyme.

The Controller is responsible for the security of its own credentials, for managing the roles and permissions of the persons in its organisation and for configuring the sharing options it decides to enable.

12. Sub-processors

The Controller grants VeryPyme a general authorisation to engage Sub-processors in the provision of the Services. The Sub-processors authorised as at the date of this version are those listed in Annex III, which refers to the public, versioned list of sub-processors.

VeryPyme will impose on each Sub-processor, by way of a contract or other legal act, data protection obligations substantially equivalent to those of this Agreement, in particular as regards sufficient guarantees to implement appropriate technical and organisational measures. Where a Sub-processor fails to fulfil its obligations, VeryPyme will remain fully liable to the Controller for the performance of the Sub-processor's obligations.

VeryPyme will inform the Controller of any addition or replacement of Sub-processors by publishing a new version of the list of sub-processors, indicating its effective date, and by means of a notice addressed to the Authorised representatives in the notices inbox of the client area, at least thirty (30) calendar days before the effective date. Exceptionally, where the addition or replacement is urgently required for security reasons, due to unavailability of the provider, due to a legal requirement or due to a cause beyond VeryPyme's reasonable control, the change may be applied without observing that notice period and VeryPyme will inform the Controller as soon as reasonably possible, stating the reason.

The Controller may object to the new Sub-processor, on reasonable and documented grounds relating to data protection, by written notice to soporte@verypyme.com before the effective date. In that case, VeryPyme will endeavour to offer a reasonable alternative. If this is not possible, the Controller may terminate the Service affected by the new Sub-processor under the terms set out in the Terms and Conditions for cancellation of the service, without the exercise of this right being considered a breach by the Controller.

13. International transfers

VeryPyme will process Controller Data in the European Economic Area. The database, file storage and artificial intelligence services are configured in European Union regions, as indicated in the list of sub-processors.

Certain Sub-processors are established outside the European Economic Area or may access data from outside it (in particular, hosting and execution of the application, sending of transactional emails, the global authentication service and support access by infrastructure providers). VeryPyme will only carry out or allow such transfers where a valid mechanism under Chapter V of the GDPR exists: a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework with respect to certified entities), standard contractual clauses approved by the European Commission or another appropriate safeguard, as indicated for each Sub-processor in the public list.

The Controller authorises such transfers under the conditions indicated. Upon the Controller's request, VeryPyme will provide the available information on the transfer mechanism applicable to each Sub-processor.

14. Rights of data subjects

Taking into account the nature of the processing, VeryPyme will assist the Controller, through the platform's features and, where necessary, through support, so that it can fulfil its obligation to respond to requests for the exercise of data subjects' rights (access, rectification, erasure, restriction, portability, objection and rights relating to automated decisions).

If VeryPyme directly receives a request from a data subject relating to Controller Data, it will communicate it to the Controller without undue delay and will not resolve it itself, unless the Controller so instructs or a law obliges it to do so. VeryPyme will inform the data subject that their request has been forwarded to the Controller.

The platform allows the Controller to consult, rectify, export by means of reports and delete the information it has uploaded, subject to the limitations described in clause 18 regarding closed reporting years, confirmed assessments and data subject to mandatory retention.

15. Personal data breaches

VeryPyme will notify the Controller, without undue delay after becoming aware of it, of any personal data breach affecting Controller Data, through the organisation's contact email or the Authorised representatives.

The notification will include, to the extent the information is available: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach or mitigate its effects, and a contact point. Where it is not possible to provide all the information at the same time, it will be provided in phases without undue delay.

VeryPyme will cooperate with the Controller and provide reasonable assistance so that it can fulfil its obligations to notify the supervisory authority and communicate to data subjects. It is for the Controller to decide on such notifications and communications.

16. Impact assessments and consultations

Taking into account the nature of the processing and the information available to it, VeryPyme will provide the Controller with reasonable assistance in carrying out data protection impact assessments and prior consultations with the supervisory authority that may be required in relation to Controller Data.

This assistance will consist, in particular, of providing the information on the processing contained in this Agreement and its Annexes, in the Privacy Policy and in the list of Sub-processors, as well as additional information reasonably available.

17. Information and audits

VeryPyme will make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and in this Agreement. As a general rule, this obligation will be fulfilled through this Agreement and its Annexes, the list of Sub-processors, the documentation and certification reports that the infrastructure providers make available to their customers, and responses to reasonable compliance questionnaires sent by the Controller.

Where the above information is not sufficient to demonstrate compliance and there is reasonable cause (in particular, a security breach affecting the Controller, a request from a supervisory authority or well-founded indications of non-compliance), the Controller may carry out an audit, itself or through an independent auditor bound by confidentiality and who is not a competitor of VeryPyme, with reasonable notice, during business hours and with a duration and scope proportionate to its purpose. The notice period may be reduced or not required where there is a relevant security incident, a competent authority so requires, a legal obligation exists or there are reasonable grounds justifying urgent action.

The audit will be carried out respecting the confidentiality of the information accessed and avoiding unnecessary interference with the operation of the Services. It will not give access to other customers' data nor imply automatic access to the platform's source code, sensitive infrastructure or information that would compromise the security of the Services; any access of that nature will require prior written agreement. The audit will not extend to the facilities of the infrastructure providers, in respect of which the documentation they provide will apply. Each party will bear its own costs, unless the audit reveals a material breach by VeryPyme.

18. Return and deletion

During the term of the Services and upon their termination, the Controller can obtain the information it has uploaded through the consultation, reporting and export features available on the platform. Upon the Controller's reasonable request, VeryPyme will assist it in returning Controller Data in a commonly used format.

Upon termination of the Services, or earlier if the Controller so requests, VeryPyme will delete Controller Data. A request to delete an account or organisation is currently handled by a communication from an Authorised representative to soporte@verypyme.com. VeryPyme will confirm the request, delete the organisation's active data within a reasonable period and without undue delay, and inform the Controller of the completion of the process.

The following are excepted from deletion and will be kept duly blocked: data whose retention is required by a legal obligation applicable to VeryPyme (in particular, contractual, billing and acceptance records) for the corresponding period; the audit records of the deletion operations themselves, limited to the identification of what was deleted and who requested it; and the information the Controller previously shared with other companies through the platform, which is held by them as independent controllers.

Technical and backup copies that may exist in the providers' infrastructure will be deleted in accordance with those providers' own cycles, without VeryPyme guaranteeing a specific purge period for such copies, and will remain subject until then to the confidentiality and security obligations of this Agreement. No immediate deletion periods are promised.

During the term of the Services, the deletion of individual documents by the Controller through the platform has the effects described in section 8 of the Privacy Policy.

19. Controller's obligations

The Controller warrants that: it has a valid legal basis for the processing of Controller Data and for their communication to VeryPyme; it has informed data subjects in accordance with Articles 13 and 14 GDPR where applicable; the data it uploads are adequate, relevant and limited to what is necessary for the purpose of the Service; it refrains from uploading special categories of data or other high-risk data except under the terms of clause 9; and the instructions it gives to VeryPyme comply with applicable law.

The Controller is also responsible for properly managing the roles and permissions of the persons in its organisation, for the truthfulness of the authority declaration of the person accepting this Agreement, for the decisions to share information with other companies through the platform and for handling data subjects' requests as controller.

20. Liability

Each party will be liable for the damage caused by the breach of the obligations imposed on it by the GDPR and this Agreement, under the terms of Article 82 GDPR. VeryPyme will be liable only for damage caused by processing that does not comply with the obligations of the GDPR specifically directed to processors or that has acted outside or contrary to the lawful instructions of the Controller.

The limitations of liability set out in the Terms and Conditions will apply to this Agreement to the extent permitted by applicable law, without limiting liability towards data subjects or the supervisory authority.

The Controller will hold VeryPyme harmless against third-party claims arising from the Controller's breach of the obligations in clause 19.

21. Governing law and precedence

This Agreement is governed by Spanish law and the GDPR. Any dispute will be submitted to the courts provided for in the Terms and Conditions of Service.

In the event of conflict between this Agreement and the Terms and Conditions or other contractual documents, this Agreement will prevail with respect to the processing of personal data on behalf of the Controller. If any clause is declared void, the remaining clauses will remain valid and the affected clause will be replaced by the one that most closely approximates its purpose in accordance with applicable law.

The Spanish version of this Agreement is the contractual reference version; the English version is provided for information purposes.

22. Term and amendments

This Agreement is versioned: each version is identified by its date, kept immutably and linked to the recorded acceptance by its identifier, version, language and digital fingerprint. The Controller is bound by the version in force at the time of its acceptance.

VeryPyme may publish new versions to adapt the Agreement to regulatory changes, decisions of supervisory authorities, changes in Sub-processors or the evolution of the Services. New versions will be published at /en/dpa and communicated to the Authorised representatives through the platform. Where a new version contains material amendments to the parties' obligations, its acceptance will be requested from the Authorised representative; in the meantime the accepted version will continue to apply, unless a mandatory rule requires otherwise.

Annex I — Description of the processing

Subject matter of the processing: hosting, storing, organising, processing, extracting, analysing, assessing and calculating the information uploaded by the Controller; generating reports, certificates, plans and results; analysing documents by means of automated systems and artificial intelligence; sharing information with third parties on the Controller's instruction; making technical copies; providing support and ensuring the security of the Services.

Duration: for as long as the Controller uses the Services and until the return or deletion of Controller Data in accordance with clause 18.

Nature: automated processing through the platform, with intervention by VeryPyme's authorised staff limited to operation, support and security.

Purpose: provision of the Services of ESG sustainability and compliance assessment, carbon footprint, climate risks, action plans, reports, certificates, value chain and sharing of information instructed by the Controller.

Categories of data subjects: employees and workers of the Controller; representatives, directors and contact persons; self-employed professionals; suppliers, subcontractors and their contact persons; customers of the Controller and their contact persons; other persons whose data legitimately appear in the documentation provided.

Categories of data: identification and contact data; professional and employment data; economic and billing data of third parties contained in documents; business documentation (certificates, policies, invoices, contracts, reports, records); free text, comments and action plans; incidental information contained in the documents provided. No special categories of data are envisaged.

Location of processing: European Economic Area, with the exceptions indicated in clause 13 and in the list of Sub-processors.

Annex II — Technical and organisational measures

As at the date of this version, VeryPyme implements the following measures appropriate to the risk of the processing:

• Authentication: access to the platform through Google's identity service (password, email sign-in link or Google account), with protection against account enumeration and lockout after failed attempts provided by that service; server sessions of limited duration by means of a server-only cookie.
• Role-based access control: owner, administrator, member and viewer roles with a differentiated permission matrix, enforced on the server; assignment to the least-privileged role in case of doubt.
• Logical separation per organisation: each organisation's data are stored and queried separately; the active organisation is resolved on the server and all API operations are validated against the user's membership and role in that organisation.
• Database and storage access rules: deny-by-default security rules; critical collections (billing, contractual records, purchased access, closed reporting years) accessible only from the server; type and size limits on uploaded files.
• Encryption in transit: all communications with the platform and with providers take place over HTTPS/TLS.
• Encryption at rest: provided by the infrastructure of the database and storage providers (Google Cloud), with no additional encryption of VeryPyme's own.
• Temporary signed links: file downloads take place through signed URLs of limited validity; invitation links are single-use, with expiry, and are stored irreversibly (hashed).
• Webhook verification and payment idempotency: notifications from the payment provider are verified by signature and processed with idempotency controls and re-verification of amounts on the server.
• Immutable contractual records: contractual acceptances, confirmed orders and billing records are stored immutably with a server date.
• Third-party API keys: API access keys are stored irreversibly (hashed), with limited scopes and the possibility of revocation.
• Environments: development routes and tools are not available in the production environment; changes are validated by automated check batteries before publication.
• Data location: database, storage and artificial intelligence configured in European Union regions.
• Staff confidentiality: VeryPyme's authorised staff are bound by confidentiality obligations and access data only for operation, support and security.

The infrastructure providers (Google Cloud, Vercel, Stripe) maintain their own security programmes and certifications, which belong to those providers and not to VeryPyme. VeryPyme does not hold information security certifications of its own (ISO 27001, ENS or SOC 2) and does not offer backup or point-in-time recovery guarantees other than those inherent to its providers' infrastructure.

Annex III — Authorised sub-processors

The Sub-processors authorised as at the date of this version are those listed in the public list of sub-processors in its version 2026-09-24, which is incorporated into this Agreement by reference. The list identifies for each Sub-processor the entity, the service and purpose, the general categories of data, the relevant country or region and the international transfer mechanism where applicable.

Subsequent versions of the list, published in accordance with clause 12, will replace the previous one from their effective date, without the need to publish a new version of this Agreement.