See what Vexa covers, how rollout is handled, and which conditions apply to active use.
Data Processing Agreement
Data Processing Agreement
This agreement sets the processor obligations, security controls, subcontractor rules, and assistance terms for customer data handled by Vexa.
What to expect
Clear obligations, privacy handling, and commercial context
Understand account access, lawful data use, and internal approval discipline.
Review the data categories, retention context, and processor protections that apply.
Agreement scope
How the DPA is structured
Roles
The customer is the controller or business owner, and Vexa acts as processor or service provider except where a separate legal obligation applies.
Processing purpose
Processing covers service delivery, authentication, access control, audit logging, privacy workflows, connector execution, and support.
Subprocessors
The operator may engage subprocessors needed to run the service, with contractual safeguards in place.
Security and incidents
The operator uses access control, tenant-scoped authorization, audit logging, and incident handling proportionate to service maturity.
Customer duties
The customer is still responsible for lawful instructions
- Confirm it has the right to submit the data.
- Provide lawful instructions for processing.
- Keep internal access and credentials under control.
- Coordinate any audit request through the agreed process.
Operator commitments
The operator must assist within the service context
- Maintain confidentiality and security measures.
- Provide reasonable assistance for privacy requests and incidents.
- Return or delete data when required by the agreement.
- Use safeguards for any cross-border processing.
FAQ
DPA questions
Does the DPA replace the customer agreement?
No. It supplements the applicable customer contract and follows its order of precedence.
Can Vexa engage subprocessors?
Yes. Subprocessors may be used when needed to operate the service under appropriate safeguards.
How are security incidents handled?
Confirmed incidents are notified without undue delay, subject to verification and operational constraints.
Need a commercial or legal conversation?
Talk with the Vexa team if you need clarification on rollout scope, privacy handling, or contract terms.