Data processing agreement
Effective from January, 2026. Last updated 6 October 2026.
This Data Processing Agreement (“DPA”) forms part of the agreement between Vera Services Inc (“Vera” or “Processor”) and the customer (“Customer”) and governs the processing of personal data in connection with the Services.
1. Scope and Roles
This DPA applies where Vera processes personal data on behalf of the Customer in connection with the Services. The Customer acts as the data controller, and Vera acts as the data processor.
The Services include the Vera platform and the Vera app for iOS and Android, both used by Customer personnel, and the certificate pages presented to end users under the Customer’s brand.
2. Purpose of Processing
Vera processes personal data solely to provide the Services, including enabling product authentication, ownership tracking, lifecycle interaction, and related functionality associated with connected products.
3. Categories of Data
Vera may process personal data including Customer account data, end-user contact information such as email addresses, product interaction data, device and usage data, and precise geolocation data where the Customer has enabled location collection and the end user has consented to it. Data subjects may include Customer personnel and end users interacting with the Services.
4. Product Interaction Data
The Service may collect data generated when end users scan or interact with products. This may include timestamps, IP address, device and browser information, and user-submitted information. Customer acknowledges that such data is necessary to provide authentication, tracking, and engagement functionality and is responsible for ensuring lawful collection and appropriate disclosures.
Geolocation is treated separately. Precise location is collected only on certificate pages, and only where two conditions are both met: the Customer has enabled location collection, and the end user has given consent at the point of collection. If either condition is absent, no location is requested and none is stored. Where both are met, the coordinates are supplied by the end user’s browser and are resolved into a city, state, and country by a third-party geocoding provider.
Vera does not derive geolocation from IP address, and the Vera app for iOS and Android has no location capability. Because location collection is enabled by the Customer, the Customer is responsible for the lawful basis for that collection and for the consent and notice presented to end users.
5. Processing Instructions
Vera shall process personal data only on documented instructions from the Customer and shall not sell or use personal data for unrelated purposes.
6. Confidentiality
Vera shall ensure that all personnel authorized to process personal data are subject to confidentiality obligations and appropriate training.
7. Security Measures
Vera shall implement appropriate technical and organizational measures to protect personal data, including access controls, encryption where appropriate, monitoring and logging, and secure infrastructure practices aligned with industry standards.
8. Subprocessors
Vera may engage subprocessors to provide portions of the Services and shall ensure that such subprocessors are subject to data protection obligations consistent with this DPA.
The following subprocessors are currently used in connection with the Services:
| Company | Category | Location |
|---|---|---|
| Google LLC (Google Cloud Platform) | Cloud infrastructure, hosting, and data storage | United States |
| Stripe, Inc. | Billing and payment processing | United States |
| Twilio, Inc. | Messaging and communication delivery | United States |
| Twilio SendGrid | Transactional email delivery | United States |
| Shopify, Inc. | Commerce and product integrations | United States |
| WorkOS, Inc. | Authentication, SSO, and identity infrastructure | United States |
| Google LLC | Generative AI processing for in-product assistance | United States |
| Google LLC | Geocoding of scan locations and map display | United States |
| Google LLC | Web font delivery on certificate pages | United States |
| 650 Industries, Inc. (Expo) | Mobile app update delivery | United States |
Vera shall provide notice of material changes to subprocessors.
9. Data Subject Rights
Vera shall assist the Customer, where reasonably possible, in responding to data subject requests, including requests for access, correction, deletion, or portability of personal data.
10. Data Breach Notification
Vera shall notify the Customer without undue delay upon becoming aware of a personal data breach affecting Customer data and shall provide reasonable information to support Customer’s compliance obligations.
11. International Transfers
Where personal data is transferred outside the European Economic Area, Vera shall implement appropriate safeguards, including the European Commission’s Standard Contractual Clauses (“SCCs”), which are incorporated by reference into this DPA.
12. Data Retention and Deletion
Vera shall retain personal data only as long as necessary to provide the Services or as required by applicable law. Upon termination of the Services, Vera shall, upon request, delete or return such data unless retention is legally required.
13. AI and Data Usage
Vera may use aggregated, anonymized, or de-identified data derived from the Services to improve platform performance, develop analytics, and enhance functionality. Vera shall not use Customer-identifiable personal data for such purposes without authorization.
14. Compliance with Laws
Each party shall comply with applicable data protection laws. Customer is responsible for ensuring that it has a lawful basis for collecting and sharing personal data with Vera.
15. Liability
Liability under this DPA shall be subject to the limitations set forth in the governing agreement between the parties.
16. Contact
For data protection inquiries, please contact: