Data Processing Agreement

Between the business customer ("Controller") and SMARTEDTECH SL, NIF B66970831 ("Processor"), for personal data the Controller brings into VUNZY.

1. Subject and duration The Processor processes personal data only to provide VUNZY to the Controller, for the duration of the subscription.

2. Instructions The Processor acts only on the Controller's documented instructions, including these terms and the Controller's configuration of VUNZY.

3. Confidentiality and security People with access are bound by confidentiality. Measures include tenant isolation at database level (row-level security), encryption in transit and at rest, least-privilege runtime roles, audit logging and regular access reviews.

4. Sub-processors Current categories: hosting and database, e-mail and notifications, payments, e-signature, identity verification, research panels, maps and AI providers. The up-to-date list is in our vendor register. We give notice of changes and the Controller may object.

5. Assistance The Processor helps the Controller answer data subject requests, carry out impact assessments and notify breaches without undue delay (target: within 48 hours of becoming aware).

6. Return and deletion At the end of the service the Processor returns or deletes the data, unless the law requires retention.

7. Audits The Processor makes available the information needed to demonstrate compliance and allows reasonable audits.

Enterprise customers can agree a specific annex.

Version 1.0.0 · effective 2026-10-15 · fingerprint 89af5e2a35c3