Data Processing Agreement (DPA)

• Data Controller: The customer (the business entity that has subscribed to VEXORS). The Controller determines the purposes and means of processing personal data uploaded to or generated on the platform.
• Data Processor: VEXORS FZC. VEXORS processes personal data solely on the Controller's instructions and for the purpose of providing the VEXORS platform.

VEXORS processes the following categories of personal data on behalf of the Controller:

• User account data: name, email address, job title, hashed password
• Company profile data: company name, country, registration number, business categories
• Platform activity: requests, bids, messages, catalog items, timestamps of actions
• Technical data: IP address, device identifiers, session tokens (for authentication)

VEXORS does not process sensitive personal data (special categories under GDPR Article 9) except where the Controller uploads such data as part of procurement documents.

VEXORS processes personal data solely to:

• Provide and operate the VEXORS platform and its features
• Communicate service notifications, support responses, and security alerts
• Monitor platform performance and detect errors (using anonymised or aggregated data)
• Comply with legal obligations

VEXORS will not process personal data for its own commercial purposes, will not sell personal data, and will not use personal data for advertising.

VEXORS implements the following technical and organisational measures to protect personal data:

• AES-256 encryption for all data at rest
• TLS 1.3 encryption for all data in transit; HSTS enforced
• Role-based access control (RBAC) and PostgreSQL Row-Level Security for tenant isolation
• Multi-factor authentication (MFA) for all admin accounts; available for all users
• AWS Secrets Manager with automatic credential rotation
• Immutable audit logging with actor, timestamp, and context
• Dependabot and CI pipeline blocking on HIGH/CRITICAL CVEs

Full details of our security posture are available on our Security & Trust page.

VEXORS uses the following sub-processors to provide the platform. Each has been reviewed for data protection compliance:

VEXORS will notify Controllers of any material changes to the sub-processor list with reasonable advance notice.

VEXORS will assist the Controller in responding to Data Subject requests (access, correction, deletion, portability, restriction, and objection) by:

• Providing data export functionality in the platform (Settings → Account)
• Processing verified deletion requests within 30 days
• Supporting portability via JSON data export
• Responding to Controller instructions within reasonable timeframes

The Controller is responsible for handling Data Subject requests in the first instance. VEXORS will provide technical assistance where required.

Personal data is processed primarily on AWS infrastructure in the United States (us-east-1). Transfers of personal data from the European Economic Area (EEA) to the United States are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission (2021/914).

EU region hosting (AWS eu-west-1) is planned for a future infrastructure phase. Enterprise customers with contractual data residency requirements should contact us to discuss arrangements.

In the event of a personal data breach, VEXORS will:

• Notify the Controller without undue delay upon becoming aware of the breach
• Provide details of the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed
• Cooperate with the Controller to enable the Controller to meet any notification obligations to supervisory authorities or Data Subjects

Upon termination of the subscription, VEXORS will:

• Retain personal data for the period specified in the Privacy Policy (Explore: 90 days after account closure; Grow: 1 year; Scale: by agreement)
• Delete or anonymise personal data after the retention period expires, unless retention is required by applicable law
• Provide a data export on request prior to deletion

Scale tier customers may request an expedited deletion or a longer contractual retention period by contacting privacy@vexors.com.