This Data Processing Agreement With Stripe ("DPA") is made as of 23-08-2024 23th August 2024, by and between:
- Velvox Gamehosting, a company incorporated under the laws of The Netherlands, Acts as the "Data Controller"; and
- Stripe, Inc., a company incorporated under the laws of the State of Delaware, USA, with its principal place of business at 354 Oyster Point Blvd, South San Francisco, CA 94080, USA ("Stripe" or "Data Processor").
1. Purpose
This DPA governs the processing of Personal Data by Stripe on behalf of the Data Controller in connection with the services provided under the https://stripe.com/nl/legal/dpa between the parties (the "Agreement").
2. Data Processing Roles
- Data Controller: The Data Controller determines the purposes and means of processing Personal Data.
- Data Processor: Stripe processes Personal Data on behalf of the Data Controller in accordance with this DPA.
3. Processing Details
- Nature of Processing: Stripe will process Personal Data to provide payment processing, fraud prevention, and related services as outlined in the Agreement.
- Purpose of Processing: To enable transactions, manage accounts, and provide customer support.
- Duration of Processing: For the duration of the Agreement and any subsequent period required to fulfill post-termination obligations.
- Types of Personal Data: Names, addresses, payment details, email addresses, and other identifiers necessary for transaction processing.
- Categories of Data Subjects: Customers, employees, and other individuals whose data is processed in the course of the services provided.
4. Obligations of Stripe
- Compliance with Instructions: Stripe will process Personal Data only in accordance with the Data Controller’s documented instructions.
- Confidentiality: Stripe will ensure that personnel authorized to process Personal Data are bound by confidentiality obligations.
- Sub-processors: Stripe may engage sub-processors to perform specific processing activities. Stripe will ensure that any sub-processors are bound by similar data protection obligations. A list of sub-processors is available at https://stripe.com/nl/legal/service-providers.
- Data Security: Stripe will implement appropriate technical and organizational measures to ensure the security of Personal Data, including encryption, access controls, and secure data storage.
- Data Subject Requests: Stripe will assist the Data Controller in responding to requests from Data Subjects exercising their rights under applicable data protection laws, including access, rectification, erasure, and restriction of processing.
- Data Breaches: Stripe will notify the Data Controller without undue delay of any data breach involving Personal Data, providing sufficient information to allow the Data Controller to comply with its legal obligations.
- Audit Rights: Stripe will provide reasonable assistance for audits and inspections to verify compliance with this DPA, including access to relevant records and documentation.
5. Data Controller Obligations
- Lawful Instructions: The Data Controller will provide lawful instructions to Stripe and ensure that any processing instructions are compliant with applicable data protection laws.
- Compliance with Laws: The Data Controller is responsible for ensuring compliance with applicable data protection laws, including obtaining necessary consents and providing necessary notices to Data Subjects.
- Data Subject Rights: The Data Controller will handle requests from Data Subjects regarding their rights under data protection laws and inform Stripe of such requests as necessary for Stripe to assist in fulfilling these requests.
6. International Data Transfers
- Data Transfers: Stripe may transfer Personal Data outside the European Economic Area (EEA), Switzerland, or the United Kingdom. Transfers will be subject to appropriate safeguards such as Standard Contractual Clauses (SCCs) in accordance with applicable data protection laws.
7. Data Retention and Deletion
- Retention: Stripe will retain Personal Data only for as long as necessary to fulfill its obligations under the Agreement and this DPA.
- Deletion: Upon termination of the Agreement, Stripe will delete or return Personal Data as requested by the Data Controller, unless retention is required by law.
8. Liability
- Limitation of Liability: Stripe’s liability for breaches of this DPA is limited as specified in the Agreement, except where prohibited by applicable law.
9. Changes to the DPA
- Amendments: This DPA may be amended from time to time to reflect changes in data protection laws or operational requirements. Any amendments will be in writing and agreed by both parties.
10. Governing Law
- Jurisdiction: This DPA will be governed by and construed in accordance with the laws of The Netherlands.
11. Signatures
By signing below, the parties agree to the terms of this Data Processing Agreement.
Velvox Gamehosting
Email: support@velvox.net
PGP: PGP email End-2-End Encryption
Stripe, Inc.
For contact details, please refer to: Stripe Contact Information
