Data Processing Addendum

• Subject: hosting and processing the organization's workspace content to provide Veruno.
• Duration: as long as the organization uses Veruno, plus the deletion periods in the Privacy Policy.
• Nature: storage, organization, retrieval, display, transmission to the subprocessors below, generation of reports, deletion.
• Purpose: helping the organization triage claims and keep its evidence, as instructed through its use of the service.

• Data: names, statements, images (which may show people), social account names and public profile figures, links, notes and files, and any other personal data the organization chooses to include. Special categories may appear in news content; the organization decides whether to process them.
• Data subjects: people mentioned in claims, news and documents; holders of social accounts or websites checked; people in images; the organization's own members.

• We process the data only on the organization's documented instructions (its use of Veruno and these Terms), unless the law requires otherwise; we tell the organization if an instruction seems to break the law.
• Everyone who can access the data is bound by confidentiality.
• We apply appropriate security measures (art. 32), described in the Privacy Policy. Platform administrators see operational data (organization name, plan, members, token use) but not workspace content.
• We use the subprocessors listed below. We give at least 14 days' notice of a new subprocessor by email or in the app; the organization can object on reasonable grounds and, if we cannot address the objection, stop using the service.
• We impose the same data protection obligations on our subprocessors and remain responsible for them.
• We help the organization answer data subject requests and meet its obligations on security, breach notification, impact assessments and prior consultation, as far as our role allows.
• At the end of the service we delete or return the data, at the organization's choice, unless the law requires us to keep it; backups rotate out within the period in the Privacy Policy.
• We provide the information needed to show compliance and allow reasonable audits, on request, with reasonable notice and confidentiality.

We notify the organization without undue delay after becoming aware of a breach affecting its data, with what we know (nature, likely consequences, measures taken), and keep it updated. Notifications go to the organization's owners and administrators by email, from contact@veruno.eu.

Only the providers needed for the features the organization uses receive its data:

The organization is responsible for having a legal basis for the data it puts in Veruno, for informing data subjects where required, and for the instructions it gives through its use of the service.