(Trust)
Data Processing Agreement (DPA)
The DPA is the contract that makes Verne Software your processor. It is built on the European Commission's standard contractual clauses (Decision 2021/914), which we incorporate by reference and do not rewrite.
It is a contract only once both of us have signed it. The PDF below is unsigned and is here so that you, your lawyer or your investor can read it before you decide. Nothing on this page, and no click, accepts it.
Who gets it
Customers on the Pro plan or higher (Pro, Advanced, or a contract plan). The Free plan does not include a DPA.
Read the agreement
Download the unsigned DPA, version 1.1 (PDF). For reading only. The blank fields are filled in when we sign.
How to get a signed copy
- Write to support@vernesoft.com from the email address of your Verne account and ask for a signed copy. If you write from another address, we reply to the account's address and wait for the confirmation from there.
- We check that the account is on Pro or higher.
- You send us what Annex I.A needs: the legal name and address of your company, its registration or VAT number, a data protection contact (name, position, email) and your role: controller, or processor for a third party. A customer outside the EU also tells us which supervisory authority applies.
- We fill in our side, sign, and send you the PDF.
- You sign your column of section 15 and return the file. The agreement takes effect on the later of the two signature dates.
The agreement stays in force while we process your data, including after a later change of plan.
What it says, in short
| Subject | Terms | DPA reference |
|---|---|---|
| Parties | Maksim Zhuk PR Novi Sad, an entrepreneur registered in Serbia, doing business as Verne Software, and you | §1, Annex I.A |
| Roles | You are the controller, we are the processor. Where you are a processor for a third party, we are your sub-processor | §2.2 |
| Scope | Gate Identity, Passepartout, Relay and Clockwork. Not our own processing of your account, billing and contact details, or of website analytics: that is the privacy policy | §2.3, §2.4 |
| Instructions | We process only on your documented instructions: the Terms, the DPA, and how you configure the service. We tell you if an instruction seems to break the law | §3 |
| Security | The measures in Annex II, the same list as /security. We may update them, but not so as to lower the overall level of protection | §5, Annex II |
| Sub-processors | General authorisation for the list in /subprocessors. We write to you at least 30 days before adding or replacing one. You may object on reasonable data protection grounds in that period; if we cannot resolve it, you may end the affected services and get a refund of prepaid fees for the time after | §6 |
| Assistance | API endpoints to retrieve, correct and delete end users and to revoke sessions. Reasonable help with impact assessments and consultations with authorities | §7 |
| Breaches | We notify your data protection contact without undue delay after we become aware of a personal data breach, and say what we know as we learn it | §8 |
| Deletion | Within 30 days after the service ends we delete your data from every place we keep it, check again, and record it. Encrypted backups expire on their own, no later than 35 days after they were made. Logs, correspondence and payment records are handled as the DPA lists | §9 |
| Audit | We give you the information needed to show compliance with the DPA. If that is not enough, an independent auditor bound by confidentiality, at your cost, on at least 30 days' notice, once in 12 months unless a regulator requires it or after a breach | §10 |
| Transfers | Access from Serbia is a transfer to a third country. SCCs, Module Two (you are a controller) or Module Three (you are a processor), with the docking clause, general authorisation for sub-processors with the 30-day notice, French law and French courts. UK Addendum (B1.0) and Swiss changes included | §11 |
| Liability | The limits of the Terms apply, except what cannot be limited under the SCCs or applicable law | §12 |
| Law | The SCCs follow French law, French courts. Other disputes follow the Terms of Service (Serbian law) | §11.2, §13 |
| Precedence | If they conflict, the SCCs prevail over the DPA, and the DPA over the Terms | §13.3 |
| Changes | Only in writing, signed by both of us. The exceptions are Annex II and Annex III, which we update under §5.2 and §6.2 | §14 |
The three annexes
- Annex I: the parties, the categories of data subjects and data, how long each is kept, the supervisory authority.
- Annex II: the technical and organisational measures. Same text as /security.
- Annex III: sub-processors, sign-in providers you may turn on, and CrowdSec. Same text as /subprocessors.
Questions
Write to support@vernesoft.com. If your lawyer wants to discuss a clause, say which one.
Verne Software is the trade name of Maksim Zhuk PR Novi Sad, an entrepreneur registered in Serbia (VAT RS113630704), Zheleznichka 20, Novi Sad, Vojvodina 21101. Our servers are in France.
Last checked: 5 November 2026.