Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between VVECON (trading as TRYSO) ("Processor", "we") and the customer organization ("Controller", "you"). It applies whenever we process personal data contained in Customer Data on your behalf. It is designed to meet Article 28 of the EU and UK GDPR, the processor provisions of the Sri Lanka Personal Data Protection Act No. 9 of 2022, the service-provider requirements of the CCPA/CPRA and equivalent laws. No signature is needed; if you need a countersigned copy, email [email protected].

1. Roles and scope

1. You are the controller (or, where you act for another controller, a processor, in which case we are your sub-processor). We are your processor.
2. Subject matter and duration: providing the Service for the term of the Terms plus the deletion period in section 10.
3. Nature and purpose: hosting, storage, retrieval, computation, transmission, backup, display, support and the other operations needed to provide the Service and features you enable.
4. Categories of data subjects: your members and employees, contractors, customers and End Customers, suppliers, leads and other people whose data you put into the Service.
5. Categories of personal data: identification and contact details, account credentials, order and transaction history, delivery addresses, invoices, employment and payroll data (including salary, statutory fund numbers and bank details) where you use HR and payroll apps, device and usage data from storefronts, and any other data you choose to store.
6. Special categories: only if you choose to store them (for example health information in HR records). You are responsible for having a lawful basis and must tell us if extra safeguards are needed.

2. Our obligations

We will:

1. process personal data only on your documented instructions — these Terms, your configuration of the Service and your written requests — unless the law requires otherwise, in which case we will tell you first unless the law prohibits it;
2. tell you if we believe an instruction infringes data protection law;
3. ensure everyone we authorise to process the data is bound by confidentiality;
4. implement the technical and organisational measures in section 5;
5. only use sub-processors under section 6;
6. assist you, taking into account the nature of processing, with data subject requests, security, breach notification, data protection impact assessments and consultations with authorities;
7. delete or return personal data at the end of the Service under section 10; and
8. make available information needed to demonstrate compliance and allow audits under section 9.

We will not sell or share your personal data, retain, use or disclose it for any purpose other than providing the Service, or combine it with data from other sources except as needed to provide the Service. We certify that we understand and will comply with these restrictions.

3. Your obligations

You are responsible for the lawfulness of the personal data you give us and of your instructions, for providing notices and obtaining consents (including for storefront cookies and pixels), and for configuring the Service's security features and user roles appropriately.

4. Data subject requests

If we receive a request from one of your data subjects, we will direct them to you and not respond ourselves unless you authorise it. The Service lets you find, correct, export and delete personal data; where you cannot do so yourself, we will help within a reasonable time.

5. Security measures

• Encryption in transit using TLS 1.2 or higher for all public endpoints.
• A logically separate database for each organization.
• Encryption at rest of access tokens, API credentials and other secrets; passwords stored with a strong one-way hash (bcrypt).
• Role-based access control in the Service and least-privilege, logged access for our staff, who access Customer Data only to provide support you request, to maintain the Service, or where the law requires.
• Restricted, key-based administrative access to production infrastructure, with multi-factor authentication on the provider accounts that control it.
• Network firewalls, regular operating-system patching and dependency updates.
• Regular backups, stored separately from the primary servers and tested periodically.
• Application activity logs for each organization and monitoring for abuse.
• A documented incident response process.

We may update these measures as long as the overall level of security is not reduced.

6. Sub-processors

1. You give general authorisation for us to use the sub-processors listed on our Sub-processors page.
2. We will give at least 30 days' notice before adding or replacing a sub-processor, by updating that page and emailing organization owners who have subscribed to updates (email [email protected] to subscribe).
3. You may object on reasonable data protection grounds within that period. We will try to resolve the objection; if we cannot, you may terminate the affected Service and receive a pro-rata refund of prepaid fees.
4. We impose data protection terms on each sub-processor that are at least as protective as this DPA and remain responsible for their performance.
5. Third-Party Services you connect yourself (for example Google, Meta, TikTok, Cloudflare, Shopify, payment gateways and couriers) are not our sub-processors; they are your own providers acting under their terms with you.

7. International transfers

Where personal data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2 controller-to-processor, or Module 3 processor-to-processor) and, for the UK, the International Data Transfer Addendum, are incorporated by reference. For the Clauses, Clause 17 is governed by the law of Ireland and Clause 18 disputes go to the courts of Ireland (for the UK Addendum, the law and courts of England and Wales), the optional docking clause applies, and the annexes are completed with the information in sections 1 and 5 of this DPA. For transfers under the Sri Lanka PDPA we rely on the mechanisms permitted by that Act and any rules made by the Data Protection Authority.

8. Personal data breach

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your data. The notice will describe, as far as known, the nature of the breach, categories and approximate number of data subjects and records, likely consequences and the measures taken or proposed. We will update you as more information becomes available. Notification is not an admission of fault.

9. Audits

We will answer reasonable security questionnaires once a year and provide summaries of our security measures. If that is not enough to demonstrate compliance, or a regulator requires it, you may carry out an audit, at your cost, with at least 30 days' notice, during business hours, no more than once a year, by an independent auditor bound by confidentiality, in a way that does not compromise other customers' data.

10. Return and deletion

You can export Customer Data at any time while the subscription is active and for 30 days after it ends. After that we delete it from live systems, and backups are overwritten within a further 35 days, unless the law requires us to keep it, in which case we will protect it and process it only for that purpose.

11. Liability and precedence

Liability under this DPA is subject to the limitation of liability in the Terms, except where the law does not allow it. If this DPA conflicts with the Terms, this DPA prevails on the processing of personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.

12. Contact

Data protection questions: [email protected].