Data Processing Addendum

Version 2.0 · Last updated 15 October 2026 · Applies to new accounts from 15 October 2026 and to existing account holders from 16 November 2026

This Data Processing Addendum (DPA) forms part of every agreement under which Euverify provides services to a customer (the Agreement), including the Website and Platform Terms, the Authorised Representative and Responsible Person Agreement, the Device Mandate Agreement, the GDPR Article 27 Representative Appointment Agreement and any other service agreement. It sets out the terms on which Euverify processes personal data on the customer’s behalf. By accepting the Agreement the customer accepts this DPA.

1. Parties and definitions

1.1Euverify means Euverify Ltd, a company registered in England and Wales (company number 16146525), registered office 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom, and Euverify Limited, a company registered in Ireland (company number 781168), registered office Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland, each acting as processor for the services it performs. Customer means the business that has entered into the Agreement.

1.2Data Protection Law means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679) and any legislation implementing, supplementing or replacing them. Controller, processor, personal data, processing, personal data breach and sub-processor have the meanings given in Data Protection Law. Customer Data means personal data that Euverify processes on the Customer’s behalf in connection with the services. Standard Contractual Clauses means the clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), and UK Addendum means the International Data Transfer Addendum to those clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, or the UK International Data Transfer Agreement, as applicable.

2. Roles of the parties

2.1For Customer Data, the Customer is the controller (or a processor acting on behalf of another controller) and Euverify is the processor. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

2.2Euverify acts as an independent controller, and this DPA does not apply, where Euverify processes personal data to comply with its own legal obligations as authorised representative, responsible person or GDPR Article 27 representative — including the retention of technical documentation and records for the statutory period, the provision of information to competent authorities, notifications to authorities, and the keeping of records of the mandates it holds — and where Euverify processes the personal data of the Customer’s users and contacts for account, billing, support and marketing purposes. Euverify’s Privacy Policy describes that processing.

2.3The Customer warrants that it has a lawful basis for the processing of Customer Data, has provided any notices required by Data Protection Law to the individuals concerned, and is entitled to instruct Euverify to process it.

3. Euverify’s obligations as processor

Euverify shall:

• process Customer Data only on the Customer’s documented instructions, which are set out in the Agreement, this DPA and the settings and requests made through the platform, unless required to do otherwise by law, in which case Euverify will inform the Customer before processing unless the law prohibits it;
• inform the Customer if, in Euverify’s opinion, an instruction infringes Data Protection Law;
• ensure that persons authorised to process Customer Data are bound by obligations of confidentiality;
• implement the technical and organisational measures described in Annex 2;
• engage sub-processors only in accordance with section 5;
• assist the Customer, taking into account the nature of the processing, in responding to requests from data subjects and in meeting its obligations relating to security, breach notification, data protection impact assessments and prior consultation;
• delete or return Customer Data at the end of the services in accordance with section 8;
• make available the information necessary to demonstrate compliance with this DPA and allow for audits in accordance with section 7.

4. Customer’s obligations

• provide documented instructions to Euverify and use the platform in accordance with the Agreement;
• not upload special category data unless necessary for the service and lawful;
• keep its account contact details current so that notices under this DPA reach it;
• respond to requests from Euverify relating to data subject requests, authority requests and breaches within the time required.

5. Sub-processors and subcontractors

5.1The Customer gives Euverify general authorisation to engage the sub-processors listed at euverify.com/subprocessor-list, including Euverify’s engineering and support subcontractor, Sweans Technologies Private Limited (India), and the AI-service providers listed there.

5.2Euverify will give account administrators at least 30 days’ notice, by email or platform notice, before adding or replacing a sub-processor that processes Customer Data. The Customer may object on reasonable data-protection grounds within that period by emailing gdpr@euverify.com. If the parties cannot resolve the objection, the Customer may terminate the affected service with a pro-rata refund of prepaid fees.

5.3Euverify will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA and remains liable to the Customer for the performance of its sub-processors.

6. International transfers

6.1Customer Data is hosted in the United Kingdom or the European Economic Area. Euverify may transfer Customer Data to sub-processors and subcontractors outside the UK and the EEA, including in the United States and India, only where the transfer is covered by an adequacy decision or by appropriate safeguards.

6.2For transfers from the EEA the Standard Contractual Clauses apply, and for transfers from the UK the UK Addendum applies, in each case entered into by Euverify with the relevant sub-processor, together with any supplementary measures required. Where a United States provider is certified under the EU-US Data Privacy Framework and its UK Extension, Euverify may rely on that certification. Copies of the transfer safeguards are available on request to gdpr@euverify.com.

7. Audit

7.1On reasonable written request, not more than once in any 12 months unless required by a supervisory authority or following a personal data breach, Euverify will make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of its security measures, certifications and third-party audit reports where available.

7.2Where that information is not sufficient to demonstrate compliance, the Customer or an independent auditor bound by confidentiality may carry out an audit of Euverify’s relevant processing on at least 30 days’ notice, during business hours, in a manner that minimises disruption, and at the Customer’s cost.

8. Retention, return and deletion

8.1At the end of the services, Euverify will delete or, at the Customer’s request made within 30 days, return Customer Data, and will delete remaining copies within six months, except for data that Euverify is required to retain by law or by the Agreement.

8.2Technical documentation, declarations, notifications and related records held as authorised representative or responsible person are retained for the period required by product legislation (normally 10 years from the placing on the market of the last unit of the product), and records held as GDPR Article 27 representative are retained for the period stated in the GDPR Article 27 Representative Appointment Agreement. During those periods Euverify processes that data as an independent controller under section 2.2.

9. Personal data breaches

9.1Euverify will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data, and will provide the information reasonably available to it about the nature of the breach, the categories and approximate numbers of data subjects and records affected, the likely consequences and the measures taken or proposed, supplementing the notice as further information becomes available.

9.2Euverify will cooperate with the Customer and take reasonable steps to contain and remedy the breach. Euverify’s notification is not an admission of fault or liability.

10. Data subject requests and authority requests

10.1Euverify will forward to the Customer, within two business days, any request from a data subject that it receives in relation to Customer Data (other than requests handled as GDPR Article 27 representative under the GDPR Article 27 Representative Appointment Agreement, which are handled as that agreement provides), and will assist the Customer as reasonably required.

10.2Where a competent authority requests Customer Data from Euverify in its capacity as representative, Euverify provides it under its own legal obligation (section 2.2) and will notify the Customer as described in the Agreement.

11. Liability

11.1Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, which apply in aggregate to the Agreement and this DPA together. Nothing in this DPA limits the rights of data subjects under Data Protection Law.

12. Term, precedence and changes

12.1This DPA applies for as long as Euverify processes Customer Data. If this DPA conflicts with the Agreement in relation to the processing of personal data, this DPA prevails; if it conflicts with the Standard Contractual Clauses or the UK Addendum, those prevail.

12.2Euverify may update this DPA to reflect changes in Data Protection Law, in its sub-processors or in its services, and will notify account administrators of material changes at least 30 days before they take effect.

12.3This DPA is governed by the law governing the Agreement.

Annex 1 — Description of processing

Item	Description
Subject matter	Provision of the Euverify platforms and compliance services described in the Agreement.
Duration	The term of the Agreement plus the return and deletion period in section 8, subject to the statutory retention in section 8.2.
Nature and purpose	Hosting, storage, review (including AI-assisted review), classification, translation, transmission to authorities and marketplaces where instructed or required, and support, for the purpose of providing product compliance, representative and GDPR Article 27 services.
Categories of data subjects	Customer personnel and platform users; signatories of declarations and agreements; the Customer’s suppliers, manufacturers, importers and distributors and their personnel; data subjects who make requests to the Customer or to Euverify as Article 27 representative; support contacts.
Categories of personal data	Names, job titles, business contact details, signatures and signature audit data, identifiers and correspondence; personal data contained in technical documentation, product information files, records of processing, data subject requests and supporting documents; product liability insurance certificates.
Special category data	Not intended to be processed. Cosmetic product safety reports and product information files may occasionally contain references to health effects reported by consumers; the Customer must minimise such data.

Annex 2 — Technical and organisational measures

• Hosting in UK and EEA regions with providers that maintain recognised security certifications; encryption of data in transit (TLS) and at rest.
• Role-based access control, least-privilege access, multi-factor authentication for Euverify staff, and logging of access to customer documents.
• Segregation of customer accounts; secure development practices; vulnerability management and patching; monitoring and alerting.
• Backups with defined retention and tested restoration.
• Confidentiality obligations for all staff and subcontractor personnel; data-protection training.
• Written contracts with sub-processors and subcontractors containing data-protection, confidentiality and security obligations.
• Incident response procedure with the notification commitments in section 9.
• Cyber Essentials certification; SOC 2 programme in progress.