Data Processing Addendum
Conditional contractual framework for business-customer data processing if hosted Valmera services are introduced.
Last updated: 08.31.2026 | Louisville, Kentucky
Back to home1. Status of this document
This Data Processing Addendum (DPA) is a public informational draft for future business customers. It is not an executed contract, does not itself authorize processing, and does not assert that Valmera currently hosts customer workspaces. If Valmera Labs later processes personal data on behalf of an organizational customer, the parties should execute a DPA identifying the contracted services, instructions, roles, duration, and relevant security arrangements before processing begins.
2. Roles and defined terms
In an applicable service arrangement, the customer would ordinarily act as controller or business, and Valmera Labs would act as processor or service provider when processing personal data strictly on the customer’s documented instructions. Those roles are not universal and must reflect the actual arrangement. Applicable data protection laws may include GDPR, UK GDPR, or U.S. privacy rules, depending on the customer and data.
3. Purpose, duration and categories
An executed DPA should specify the nature and purposes of processing, types of personal data, categories of data subjects, contract duration, and authorized operations. In a task-management service, possible categories could include authorized user profiles, task descriptions, comments, and uploaded files; the actual scope must be confirmed and any prohibited sensitive data categories identified.
4. Instructions and confidentiality
Where Valmera Labs acts as processor, it should process relevant customer data only on documented instructions except where applicable law requires otherwise. Authorized personnel with access to the data should be bound by appropriate confidentiality commitments. Instructions contrary to applicable law should be addressed through a defined escalation process.
5. Security, incidents, and assistance
The final DPA should include a verified description of technical and organizational security measures, access controls, logging, backup practices, incident notification responsibilities, and assistance with data subject rights and regulator inquiries as required by law. No particular certification, encryption specification, uptime level, or notification deadline is promised by this draft.
6. Subprocessors and international transfers
Before a processor relationship is activated, the parties should confirm the actual subprocessors, scope of delegated services, authorization mechanism, notice of changes, and required flow-down obligations. International transfers should be governed by the safeguards required for the relevant countries, which may include standard contractual clauses where appropriate.
7. Return, deletion, audit, and liability
The executed document should address export and deletion on contract termination, retention obligations imposed by law, requests for audit information, reasonable audit procedures, allocation of expenses, and applicable liability provisions. Those rights and duties must be agreed together with a separate master service agreement rather than inferred from this public informational text.
8. Next steps
Prospective business customers may request a proposed DPA as part of a technical and privacy review. Valmera Labs should not treat this informational document as complete until the relevant legal terms, processing inventory, security controls, subprocessor register, and customer contract have been verified and approved.
9. Applicability and execution
This document is provided as a proposed framework only and is not automatically accepted or incorporated into a contract because a visitor reads it. Where Valmera Labs processes personal information on behalf of a business customer as a processor or service provider, the parties must expressly agree on the applicable data-processing terms and relevant service description. If the client acts as a controller, it remains responsible for its lawful instructions, notices, retention criteria, and requests by affected individuals.
10. Description of processing
An executed addendum should specify the services involved, duration of the engagement, the permitted purposes, processing operations, categories of data subjects, categories of personal information, and any special restrictions. Typical workflow records may refer to employees, contractors, and commercial contacts, but that fact alone does not establish that the hosted platform processes any particular dataset. Actual processing must be documented against the contracted service and the technical architecture in use.
11. Security measures and incident handling
Before execution, the parties should agree on applicable technical and organizational measures including authentication, access control, confidentiality duties, change management, backup arrangements, incident identification and escalation, and secure deletion. An addendum should specify how and when the service provider reports confirmed personal data incidents, taking account of applicable law and the information available. No particular certification, encryption scheme, geographic storage location, or incident response deadline is represented as already operating unless verified and documented.
12. Personnel and subprocessors
Any personnel granted access to personal information should be bound by suitable confidentiality obligations and limited to authorized functions. The parties should agree on a process for identifying and approving any actual subprocessors, notice of material changes, allocation of responsibilities, and required contractual safeguards. A register should identify only providers actually used for the contracted processing. Infrastructure serving the public website and infrastructure serving a future customer workspace are not necessarily identical.
13. Assistance and individuals’ rights
Where required by an executed agreement and applicable law, the service provider should reasonably assist the customer with requests for access, correction, deletion, and other privacy rights, as well as with information necessary for data protection assessments and incident reporting. Assistance may be subject to contractual limits and lawful instructions. The client remains responsible for communicating with its own data subjects where it is the controller.
14. International transfers
Transfers subject to GDPR, UK GDPR, or another cross-border data rule must be assessed using the actual data flows and receiving entities. Contractual safeguards, transfer impact assessments, supplementary measures, or other lawful mechanisms may be necessary in some circumstances. This draft does not itself constitute executed standard contractual clauses or guarantee that a particular transfer mechanism has been put in place.
15. Return, deletion, and audit
The executed addendum should describe return or deletion of customer personal information after service termination, subject to mandatory retention and backup behavior. It should also state the customer’s rights to obtain information needed to demonstrate compliance, confidentiality obligations on auditors, and reasonable limits to avoid disruption or exposure of other customers. Unbounded audit access to facilities or systems should not be inferred from these proposed terms.
16. Order of precedence
The signed project agreement, the executed addendum, and any incorporated schedules should identify their order of precedence. In the event of a conflict involving personal-data processing, the executed addendum would ordinarily be given priority to the extent the contract specifies. This website publication is informational and does not amend any existing agreement without express acceptance by the relevant parties.
Contact Information
For questions about this document or requests that concern your information or use of the site, you may contact Valmera Labs using the details below. Please do not send passwords, financial account numbers, or unnecessary sensitive personal information in an inquiry.
EMAIL: projects@valmeralabs.com
ADDRESS: 2520 Terra Crossing Blvd, Louisville, KY 40245
PHONE: +1 (502) 693-1012