VeloDB Data Processing Addendum

Effective Date: June 3, 2026

Last Updated: October 28, 2026

View the archived version of June 15, 2026.

This Data Processing Addendum ("DPA") supplements the VeloDB agreement, order form, or other written terms under which VeloDB provides Services to Customer (the "Agreement"). This DPA applies when VeloDB Processes Customer Personal Data on behalf of Customer in connection with the Services.

1. Scope and Roles

1.1 Scope. This DPA applies to VeloDB's Processing of Customer Personal Data as a Processor, Subprocessor, service provider, or contractor on Customer's behalf in connection with the Services.

1.2 Customer Role. Customer is the Controller of Customer Personal Data, or a Processor acting on behalf of another Controller. Customer is responsible for the lawfulness of Customer Personal Data, Customer's instructions, and Customer's use of the Services.

1.3 VeloDB Role. VeloDB will Process Customer Personal Data only on Customer's documented instructions, except where required by applicable law.

1.4 Relationship Data. This DPA does not govern VeloDB's independent Processing of business contact, account, billing, marketing, website, contract, or relationship information, which is handled under VeloDB's Privacy Policy and applicable law.

2. Definitions

"Affiliate" has the meaning given in the Agreement. "Authorized Affiliate" means a Customer Affiliate that is permitted to use the Services under the Agreement.

"Applicable Data Protection Laws" means privacy, data protection, and data security laws applicable to VeloDB's Processing of Customer Personal Data under the Agreement.

"Customer Personal Data" means Personal Data Processed by VeloDB on Customer's behalf in connection with the Services.

"Data Privacy Framework" or "DPF" means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework, each as administered by the U.S. Department of Commerce.

"EU SCCs" means the standard contractual clauses for the transfer of personal data to third countries approved by European Commission Implementing Decision (EU) 2021/914 of June 4, 2021, as amended or replaced from time to time.

"Europe" means the European Economic Area (EEA), the United Kingdom, and Switzerland. "European Data Protection Laws" means the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), the EU GDPR as retained in United Kingdom law ("UK GDPR"), and the Swiss Federal Act on Data Protection ("Swiss FADP"), in each case as applicable to the Processing.

"Restricted Transfer" means a transfer, including an onward transfer or remote access, of Customer Personal Data subject to European Data Protection Laws to a country outside Europe that is not covered by an adequacy decision issued under the applicable European Data Protection Laws.

"Personal Data," "Controller," "Processor," "Process," "Processing," "Data Subject," and similar terms have the meanings given under Applicable Data Protection Laws. Where Applicable Data Protection Laws use analogous terms, those terms will be interpreted to cover the corresponding concepts.

"Security Incident" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data Processed by VeloDB or its Subprocessors.

"Subprocessor" means a VeloDB Affiliate or a third party engaged by VeloDB to Process Customer Personal Data on Customer's behalf in connection with the Services.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, as amended or replaced from time to time.

"VeloDB" means the VeloDB contracting entity for the Agreement, determined under the Agreement and the VeloDB Contracting Entities page. VeloDB's Affiliates that Process Customer Personal Data are Subprocessors under this DPA.

3. Processing Instructions

Customer instructs VeloDB to Process Customer Personal Data to:

• provide, operate, maintain, secure, support, and troubleshoot the Services;
• perform obligations and exercise rights under the Agreement and applicable order forms;
• comply with Customer's written instructions accepted by VeloDB; and
• comply with applicable law.

If VeloDB reasonably believes an instruction violates Applicable Data Protection Laws, VeloDB will notify Customer unless prohibited by law and may suspend the affected Processing until the instruction is modified or confirmed as lawful.

4. Purpose and Use Restrictions

VeloDB will not retain, use, or disclose Customer Personal Data except as necessary to provide, maintain, support, secure, and improve the Services; comply with Customer's instructions; comply with applicable law; or as otherwise permitted by the Agreement and this DPA.

VeloDB will not sell Customer Personal Data, use it for cross-context behavioral advertising, or use identifiable Customer Personal Data or Customer Data to train generalized artificial intelligence models unless Customer expressly authorizes that use in writing.

5. Customer Responsibilities and Restricted Data

Customer is responsible for providing notices, obtaining consents, establishing legal bases, and ensuring that Customer's submission and use of Customer Personal Data comply with Applicable Data Protection Laws.

Customer will not submit restricted data, including protected health information, payment card data, children's data, biometric data, or data subject to specialized legal regimes, unless VeloDB has confirmed support for that use case in writing and the parties have executed any required additional terms.

6. Security and Confidentiality

VeloDB will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful Processing and accidental loss, destruction, or damage.

VeloDB will ensure that personnel authorized to Process Customer Personal Data are subject to confidentiality obligations and access Customer Personal Data only as needed for authorized purposes.

Security documentation, audit reports, certifications, questionnaires, and other assurance materials may be made available where approved by VeloDB and subject to applicable confidentiality, security, legal, and sharing restrictions.

7. Subprocessors

Customer generally authorizes VeloDB to use Subprocessors to Process Customer Personal Data. VeloDB will impose written data protection obligations on Subprocessors that are no less protective in material respects than those imposed on VeloDB under this DPA, to the extent applicable to the Subprocessor's Processing.

VeloDB will provide at least thirty (30) calendar days' advance notice before a new or replacement Subprocessor begins Processing Customer Personal Data, except where, to the extent permitted by Applicable Data Protection Laws, shorter notice is reasonably required for security, continuity, emergency, legal, or similar reasons. VeloDB will update the Subprocessor List and send notice of that update by email to the individuals who have signed up to receive Subprocessor updates through the mechanism described on the Subprocessor List. Customer may object within ten (10) calendar days after receiving that notice, on reasonable grounds relating to data protection, by written notice to privacy@velodb.io. If Customer objects, the parties will discuss the objection in good faith, and VeloDB may proceed with the new or replacement Subprocessor for Customer only if Customer does not submit a timely objection or a timely objection is resolved. This paragraph is the DPA notice process referenced in Section 7.5 of the General Terms and Conditions and Section 10 of the Security Addendum.

VeloDB remains responsible for Subprocessors' performance of their data protection obligations to the extent required by the Agreement and Applicable Data Protection Laws.

VeloDB will provide Subprocessor information where required by the Agreement, an applicable order form, an approved Subprocessor disclosure, or Applicable Data Protection Laws. Providers that Customer enables or controls, including Customer's cloud provider for Customer-controlled cloud resources, identity provider, monitoring destination, data source, data sink, webhook destination, marketplace, or other third-party integration, are Customer's responsibility unless the applicable Agreement, order form, or approved Subprocessor disclosure states otherwise.

8. Security Incident Notice

VeloDB will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. VeloDB will provide information reasonably available to VeloDB regarding the nature of the Security Incident, affected data categories, measures taken or proposed, and a contact point for follow-up.

VeloDB will take reasonable steps to contain, investigate, and mitigate Security Incidents. Notice of a Security Incident is not an admission of fault or liability.

9. Data Subject Requests and Regulatory Assistance

Taking into account the nature of Processing and information available to VeloDB, VeloDB will provide reasonable assistance for Customer to respond to Data Subject requests and meet applicable obligations for data protection impact assessments, consultations, or regulator inquiries.

If VeloDB receives a request from a Data Subject relating to Customer Personal Data, VeloDB will notify Customer where legally permitted and will not respond except on Customer's instruction or as required by law.

10. Government and Third-Party Demands

If VeloDB receives a legally binding demand for Customer Personal Data from a governmental authority or other third party, VeloDB will notify Customer before disclosure unless legally prohibited. VeloDB will review the legality of the demand, disclose only the Customer Personal Data it is legally required to disclose, and use reasonable efforts to allow Customer to seek protective measures where appropriate.

11. Return and Deletion

Upon termination or expiration of the Services, VeloDB will delete or return Customer Personal Data in VeloDB-controlled systems in accordance with the Agreement, applicable order form, Customer's documented instructions, approved retention materials, and standard deletion practices, unless retention is required or permitted by applicable law.

Deletion and return may require time to propagate through applicable systems, backups, and Subprocessors. Until Customer Personal Data is deleted or returned, VeloDB will continue to protect it under this DPA and limit further Processing to deletion, return, export, security, backup, audit, compliance, dispute, legal-hold, or lawful retention purposes.

Backup, archive, security, audit, legal, tax, accounting, support, dispute, and legal-hold records may follow separate retention or deletion treatment where permitted by the Agreement, applicable retention materials, applicable law, or Customer's documented instructions.

Customer remains responsible for exporting, retaining, deleting, or deprovisioning Customer Personal Data in Customer-controlled systems, Customer-configured destinations, and Customer-controlled cloud resources.

12. Audits and Compliance Evidence

VeloDB will make available information reasonably necessary to demonstrate compliance with this DPA, subject to appropriate confidentiality, security, and non-disruption requirements. Where available and adequate for Customer's verification purpose, independent audit reports, certifications, security documentation, questionnaires, control mappings, and written responses may be used first to satisfy reasonable audit requests.

Any additional audit must be limited to controls relevant to Customer Personal Data, conducted by Customer or an independent auditor under appropriate confidentiality obligations, and designed not to compromise VeloDB systems, security controls, or data of other customers.

Nothing in this Section limits the audit or investigation powers of a competent regulator under Applicable Data Protection Laws.

13. International Transfers

13.1 General. VeloDB will not transfer Customer Personal Data in violation of Applicable Data Protection Laws. Customer authorizes VeloDB and its Subprocessors to transfer Customer Personal Data to the locations described in Section 13.6, subject to this Section.

13.2 Standard Contractual Clauses. For each Restricted Transfer from Customer to VeloDB, the EU SCCs, completed as described in Annex B, are incorporated into this DPA by reference and apply between Customer as data exporter and VeloDB as data importer. For Restricted Transfers subject to the UK GDPR, the EU SCCs apply as amended by the UK Addendum. For Restricted Transfers subject to the Swiss FADP, the EU SCCs apply with the Swiss modifications in Annex B. The parties' acceptance of the Agreement is treated as execution of the applicable clauses, and no separate signature is required.

13.3 Data Privacy Framework. VELODB INC. has certified its adherence to the Data Privacy Framework Principles. Where VELODB INC. receives Customer Personal Data from Europe in reliance on the Data Privacy Framework, VELODB INC. will Process that data in accordance with the Data Privacy Framework Principles. While VELODB INC.'s certification is in effect, a transfer to VELODB INC. that the Data Privacy Framework covers is not a Restricted Transfer, and the Data Privacy Framework applies to it instead of the Standard Contractual Clauses. If VELODB INC.'s certification lapses, or a decision invalidates or suspends the Data Privacy Framework, those transfers become Restricted Transfers and the clauses described in Section 13.2 apply to them automatically, without further action by the parties. Transfers to other VeloDB entities, including VeloDB Technology International Pte. Ltd., are not covered by the Data Privacy Framework and are governed by Section 13.2. VeloDB will notify Customer without undue delay if VELODB INC. ceases to participate in the Data Privacy Framework.

13.4 Onward Transfers. Where VeloDB makes an onward Restricted Transfer to a VeloDB Affiliate or another Subprocessor, VeloDB will ensure that the transfer is covered by a valid transfer mechanism, such as the EU SCCs (Module Three, Processor to Processor), the UK Addendum, the Subprocessor's Data Privacy Framework certification, or an adequacy decision, and that the Subprocessor is bound by written obligations consistent with Section 7.

13.5 Changes to Transfer Mechanisms. If the EU SCCs or the UK Addendum are amended or replaced, or if a competent court or supervisory authority determines that a transfer mechanism in this Section cannot lawfully be relied on, VeloDB may adopt the amended, replacement, or alternative mechanism by notice to Customer, and the parties will cooperate in good faith to implement any additional measures reasonably required for the lawful transfer of Customer Personal Data.

13.6 Processing and Access Locations. For VeloDB Cloud, Customer selects the cloud provider and region that host Customer's warehouse data. The VeloDB control plane, including the console, sign-in, account metadata, and the SQL editor, is hosted in the United States. Support, operations, and security personnel of VeloDB and its Affiliates may access Customer Personal Data from the locations described in the Subprocessor List to the extent needed for the purposes in Section 3. For BYOC Services, warehouse data remains in Customer's own cloud account, and VeloDB access is governed by the BYOC Addendum.

13.7 Transfer Impact Assessments. VeloDB will provide information reasonably available to VeloDB that Customer needs to assess a Restricted Transfer, including information about the legal environment of the destination country, VeloDB's handling of government demands under Section 10, and the technical and organizational measures in the Security Addendum, subject to the confidentiality provisions of the Agreement.

13.8 Other Jurisdictions. Where Applicable Data Protection Laws outside Europe restrict cross-border transfers of Customer Personal Data, the parties will rely on the measures in this DPA and will cooperate in good faith to execute any additional transfer terms those laws require.

14. Term, Precedence, and Liability

This DPA remains in effect for as long as VeloDB Processes Customer Personal Data subject to the Agreement.

If this DPA conflicts with the Agreement regarding Processing of Customer Personal Data, this DPA controls for that subject matter. If this DPA or the Agreement conflicts with the Standard Contractual Clauses incorporated under Section 13, the Standard Contractual Clauses control.

Liability arising from this DPA, including the Standard Contractual Clauses, is subject to the limitations and exclusions in the Agreement, unless Applicable Data Protection Laws prohibit those limitations. Those limitations do not limit a Data Subject's rights as a third-party beneficiary under the Standard Contractual Clauses.

This DPA is governed by the governing law and dispute resolution terms of the Agreement, except that the Standard Contractual Clauses are governed by the law and forum selected in Annex B, as required by European Data Protection Laws.

Annex A - Processing Details

This Annex A also serves as Annex I.B (Description of the Transfer) of the Standard Contractual Clauses.

Item	Description
Subject matter	Processing of Customer Personal Data to provide, maintain, support, secure, and improve the Services ordered by Customer.
Duration	For the term of the applicable Services and any limited period required for deletion, return, security, backup, audit, compliance, dispute, or legal retention purposes.
Nature and purpose	Hosting, processing, transmission, storage, service administration, monitoring, reliability, troubleshooting, support, security operations, customer-instructed export or deletion, and compliance assistance.
Categories of Data Subjects	Customer users and administrators; Customer employees, contractors, customers, prospects, or other individuals whose Personal Data Customer submits to or processes using the Services; business contacts included in support requests where Processed on Customer's behalf.
Categories of Customer Personal Data	Customer-submitted data to the extent it is Personal Data; account and user identifiers; technical, operational, access, security, diagnostic, and support information that constitutes Personal Data and is Processed on Customer's behalf.
Sensitive data	No restricted or sensitive category data is approved unless expressly authorized in an order form or additional written addendum.
Subprocessors	Subprocessors, if any, are identified in VeloDB's approved Subprocessor disclosure, applicable order form, or customer-specific exhibit.
Frequency of transfer	Continuous for the term of the Services.
Retention	As described in Section 11 and the Agreement.

Annex B - Standard Contractual Clauses

B.1 Transfers Subject to the EU GDPR

For Restricted Transfers subject to the EU GDPR, the EU SCCs apply as follows:

SCC provision	Election
Modules	Module Two (Controller to Processor) applies where Customer is a Controller. Module Three (Processor to Processor) applies where Customer is a Processor.
Clause 7 (Docking clause)	The optional docking clause applies. Authorized Affiliates may accede to the clauses on the same terms as Customer, subject to the parties' mutual agreement.
Clause 9(a) (Use of sub-processors)	Option 2 (General written authorization) applies. The notice period and objection process are set out in Section 7 of this DPA.
Clause 11(a) (Redress)	The optional independent dispute resolution language does not apply.
Clause 13(a) (Supervision)	The competent supervisory authority is determined as described in Annex I.C below.
Clause 17 (Governing law)	Option 1 applies. The clauses are governed by the laws of Ireland.
Clause 18(b) (Choice of forum and jurisdiction)	Disputes arising from the clauses are resolved by the courts of Ireland.
Annex I.A (List of parties)	The data exporter is Customer, including any Authorized Affiliate that accedes under Clause 7, acting as Controller or Processor. The data importer is VeloDB, acting as Processor. Contact details are those in the applicable Order Form or account records. The activities relevant to the transfer are the provision of the Services under the Agreement.
Annex I.B (Description of the transfer)	As described in Annex A of this DPA.
Annex I.C (Competent supervisory authority)	If Customer is established in an EU Member State, the supervisory authority of that Member State. If Customer is not established in the EU but falls within Article 3(2) of the EU GDPR and has appointed a representative, the supervisory authority of the Member State where the representative is established. Otherwise, the supervisory authority of the Member State where the Data Subjects whose Personal Data is transferred are located, as determined under Clause 13(a).
Annex II (Technical and organizational measures)	The measures described in the Security Addendum.
Annex III (List of sub-processors)	The Subprocessors identified in the Subprocessor List.

B.2 Transfers Subject to the UK GDPR

For Restricted Transfers subject to the UK GDPR, the EU SCCs completed under B.1 apply as amended by the UK Addendum. Part 2 (Mandatory Clauses) of the UK Addendum is incorporated by reference. Tables 1 to 3 of Part 1 are completed with the information in B.1, Annex A of this DPA, and the Security Addendum. In Table 4, neither party may end the UK Addendum as permitted by Section 19 of the UK Addendum. Any conflict between the EU SCCs and the UK Addendum is resolved under Sections 10 and 11 of the UK Addendum.

B.3 Transfers Subject to the Swiss FADP

For Restricted Transfers subject to the Swiss FADP, the EU SCCs completed under B.1 apply with the following modifications:

1. References to the EU GDPR are read as references to the Swiss FADP, and references to specific articles of the EU GDPR are read as references to the equivalent provisions of the Swiss FADP.
2. References to the "EU," the "Union," "Member State," and "Member State law" are read as references to Switzerland and Swiss law, as applicable.
3. The competent supervisory authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner.
4. The clauses are governed by the laws of Switzerland, and disputes arising from them are resolved by the competent courts of Switzerland. Data Subjects with their habitual residence in Switzerland may also bring legal proceedings before the courts of Switzerland under Clause 18(c).

B.4 Clarifications

The parties agree to the following interpretations of the Standard Contractual Clauses. A party that acts in line with these interpretations is treated as complying with the corresponding clauses.

1. Customer as Processor. Where Customer is a Processor acting on behalf of a third-party Controller, VeloDB may interact solely with Customer, and Customer is responsible for forwarding any notices to, and obtaining any authorizations from, that Controller.
2. Instructions. This DPA and the Agreement are Customer's complete instructions for the purposes of Clause 8.1, subject to Section 3 of this DPA.
3. Audits. Audits under Clauses 8.9(c) and 8.9(d) are carried out as described in Section 12 of this DPA.
4. Deletion certificates. The certification of deletion described in Clauses 8.5 and 16(d) is provided on Customer's written request.
5. Government access. For Clause 15.1(a), VeloDB will notify Customer, and Customer is responsible for notifying affected Data Subjects where required.
6. Liability. Clause 12 is subject to Section 14 of this DPA, except for claims brought by Data Subjects as third-party beneficiaries.