Data Processing Agreement

Last updated: July 14, 2026

⚠

DRAFT - Pending Execution. This Data Processing Agreement is prepared and ready for execution once Veyrateam LLC receives final state approval. No party shall sign or execute this document until the LLC is legally registered. This draft is provided for review purposes only.

This Data Processing Agreement ("DPA") is entered into by and between Veyrateam LLC ("Processor") and the client entity identified in the signed Service Agreement ("Controller"). This DPA forms part of and is incorporated into the Veyra Team Service Agreement and Terms of Service available at veyrateam.com/terms.

1. Definitions

Personal Data - any information relating to an identified or identifiable natural person, as defined by applicable data protection laws (GDPR, CCPA, and Florida Digital Bill of Rights).
Controller - the client who determines the purposes and means of processing Personal Data.
Processor - Veyrateam LLC, which processes Personal Data on behalf of the Controller.
Sub-processor - any third-party service engaged by Veyrateam LLC that may access or process Personal Data.
Processing - any operation performed on Personal Data (collection, storage, transmission, deletion, etc.).

2. Scope and Purpose

Veyrateam LLC processes Personal Data on behalf of the Controller solely for the purpose of providing the services described in the Service Agreement, including but not limited to:

Website contact form submissions (name, email, phone, message)
Voice AI receptionist call data (caller name, phone number, call transcripts, booking details)
Lead capture and management data stored in the Veyra Team CRM
Email and SMS communications related to the Controller's business

Veyrateam LLC shall not process Personal Data for any purpose other than providing the agreed services. No data is sold, shared for advertising, or used for Veyrateam LLC's own commercial purposes beyond the portfolio rights granted in the Service Agreement (which cover only the visual design of the website, not Personal Data).

3. Data Types Processed

Category	Examples	Retention
Contact Information	Names, email addresses, phone numbers from client contact forms	Duration of service + 30 days
Voice Call Data	Caller name, phone number, call transcript, booking outcome	Duration of service + 30 days
Lead / CRM Data	Prospect names, contact details, interaction notes	Duration of service + 30 days
Business Data	Business name, address, hours, FAQ content provided by Controller	Duration of service

4. Processor Obligations

Veyrateam LLC agrees to:

4.1 Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organization, unless required to do so by law.

4.2 Ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3 Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of Personal Data in transit (TLS 1.2+ for all web traffic and API calls)
Encryption of Personal Data at rest where technically feasible
Access controls limiting Personal Data access to authorized personnel only
Regular security monitoring and incident response procedures
Secure deletion of Personal Data upon contract termination

4.4 Notify the Controller without undue delay (and in any case within 72 hours) after becoming aware of a Personal Data breach, providing all relevant details and cooperating with the Controller's breach response.

4.5 Assist the Controller in responding to data subject requests (access, deletion, correction, portability) where applicable.

4.6 Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits.

5. Sub-Processors

Veyrateam LLC engages the following third-party services that may access or process Personal Data in the course of providing services to the Controller. The Controller grants Veyrateam LLC general authorization to use these sub-processors. Veyrateam LLC shall remain liable for the performance of each sub-processor.

Sub-Processor	Service	Data Accessed
Stripe, Inc.	Payment processing	Billing data (not Personal Data from contact forms)
Google (Workspace, Places API)	Email, business data enrichment	Email metadata, business listing data
Vapi.ai	Voice AI receptionist	Caller phone number, call audio/transcript
Base44 (platform infrastructure)	Database hosting, backend services	All Personal Data stored in CRM entities
Cloudflare, Inc.	CDN, DNS, hosting	Website traffic metadata
DocuSign, Inc.	Electronic signatures	Signer name, email, signature
Calendly	Appointment scheduling	Booking name, email, phone (Controller's Calendly account)

Veyrateam LLC will notify the Controller at least 14 days in advance of any new sub-processor, giving the Controller the opportunity to object.

6. Data Security Measures

Veyrateam LLC maintains the following security measures:

Access control: Role-based access; only authorized Veyrateam LLC personnel can access Personal Data stored in the CRM.
Encryption: All web traffic uses TLS 1.2+. API keys and credentials are stored as encrypted environment variables, never in plaintext.
Logging: API usage is logged for diagnostic purposes. Logs do not contain Personal Data payloads.
Incident response: Veyrateam LLC will document and investigate any suspected breach within 24 hours of discovery and notify affected Controllers within 72 hours.
Training: Personnel with access to Personal Data are instructed on data handling best practices and confidentiality obligations.

7. Data Breach Notification

In the event of a Personal Data breach, Veyrateam LLC will:

7.1 Notify the Controller without undue delay and in any case within 72 hours of becoming aware of the breach.

7.2 Provide the Controller with: (a) the nature of the breach, (b) categories and approximate number of data subjects and records concerned, (c) likely consequences, and (d) measures taken or proposed to address the breach and mitigate its effects.

7.3 Cooperate with the Controller in any notification to data subjects or regulatory authorities where required by law.

7.4 Document all breaches, including facts, effects, and remedial action, for future audit.

8. Data Deletion and Return

Upon termination of the Service Agreement, and at the Controller's request, Veyrateam LLC will:

8.1 Return all Personal Data to the Controller in a machine-readable format (JSON or CSV export) within 30 days of termination.
8.2 Delete all copies of Personal Data from Veyrateam LLC's systems and databases within 30 days of transfer, unless retention is required by law.
8.3 Provide written confirmation of deletion upon request.
8.4 Note: Sub-processors may retain data per their own policies and applicable laws. Veyrateam LLC will request deletion from sub-processors where technically possible.

9. Controller Obligations

The Controller agrees to:

9.1 Provide Veyrateam LLC with accurate and complete information necessary for the provision of services.
9.2 Ensure that any Personal Data provided to Veyrateam LLC has been collected in compliance with applicable data protection laws, including obtaining necessary consents from data subjects.
9.3 Respond promptly to Veyrateam LLC's requests for instructions or clarification regarding Personal Data processing.
9.4 Maintain any necessary notices, consents, or privacy policies on the Controller's own website or business.

10. Audit Rights

The Controller may, at its own expense and with reasonable notice (at least 14 days), audit Veyrateam LLC's compliance with this DPA. Audits may be conducted internally or by a third-party auditor, provided the auditor signs a confidentiality agreement. Veyrateam LLC will provide reasonable access to relevant documentation and systems.

11. Confidentiality

Both parties agree to maintain the confidentiality of any Personal Data and proprietary information shared under this DPA. This obligation survives termination of the Service Agreement.

12. Governing Law

This DPA is governed by the laws of the State of Florida, without regard to conflict of law principles. Any disputes arising from this DPA shall be resolved in the courts of Orange County, Florida, or as otherwise agreed in the Service Agreement.

13. Changes to This DPA

Veyrateam LLC may update this DPA from time to time to reflect changes in law, technology, or business practices. Material changes will be communicated to the Controller at least 30 days in advance. Continued use of services after the effective date constitutes acceptance of the updated DPA.

14. Contact

For questions about this DPA or data handling practices, contact:
Veyrateam LLC
Email: partner@veyrateam.com
Orlando, FL

15. Execution

This DPA becomes effective upon signature by both parties. It remains in effect for the duration of the Service Agreement and survives termination solely for the purpose of completing data deletion obligations.

Signatures

Processor - Veyrateam LLC

Authorized Signature

Print Name: Ashton Gray

Title: Founder

Date

Pending execution - to be signed once Veyrateam LLC state registration is finalized.

Controller - Client

Authorized Signature

Print Name

Title

Date