This Data Processing Agreement ("DPA") forms part of the agreement between you ("Controller") and VTS Solutions ("we", "us", "our"), a company registered in the Netherlands under KVK number 70168741, with its registered address at Breitnerlaan 62, 2391 GC Rotterdam, The Netherlands ("Processor") for the Avitly service.
Subject matter
The Processor processes personal data on behalf of the Controller solely to provide the Service and in accordance with the Controller's documented instructions.
Duration
This DPA applies for as long as the Processor processes personal data on behalf of the Controller.
Nature and purpose
Processing includes hosting, storage, and handling of the customer, project, quote, and offer data and the files you upload into the Service.
Categories of data subjects
Your customers, contacts, and team members whose data you enter into the Service.
Processor obligations
- Process personal data only on documented instructions.
- Ensure persons authorised to process data are bound by confidentiality.
- Implement appropriate technical and organisational security measures.
- Assist the Controller with data-subject requests and security obligations.
- Delete or return personal data at the end of the engagement, subject to legal retention.
Sub-processors
The Controller authorises the Processor to engage the following sub-processors under written terms consistent with this DPA:
- Supabase (Supabase, Inc.): application database, authentication, and hosting (EU region).
- Cloudflare (Cloudflare, Inc.): object storage for files you upload and generated documents (floor plans, CAD drawings, product images, invoices, quotes, and proposals), and bot protection on sign-in (EU).
- Stripe (Stripe Payments Europe, Ltd.): subscription billing and payment processing on paid plans (EU/US).
- Resend (Resend, Inc.): sending transactional email (team invites, and the quotes, offers, and purchase orders you send) (US).
- AI provider (Google Ireland Ltd. by default): powering the in-app AI assistant; when you use it, the project, quote, customer, and product data needed to answer your request is sent to the provider (EU/US).
- Google Analytics (Google Ireland Ltd.): website traffic analytics, loaded only with your cookie consent (EU/US).
The Processor will give reasonable notice of changes to this list and remains responsible for its sub-processors' compliance.
International transfers
Transfers outside the EEA are covered by appropriate safeguards such as the EU Standard Contractual Clauses.
Audits
The Processor will make available information reasonably necessary to demonstrate compliance and allow for audits under reasonable conditions.
Contact
To request a signed copy or the sub-processor list, email info@avitly.com.