Data Processing Agreement

01What this agreement is for

In short: when your store uses Vertia, we process customer and creator data on your behalf. This agreement sets out what we may and may not do with it.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you, the person or company that subscribes to Vertia for a store, and VERT TECH TECNOLOGIA E DESENVOLVIMENTO LTDA ("Vertia", "we", "us"), Brazilian company ID (CNPJ) 68.582.744/0001-03.

By accepting the Terms, you also accept this DPA, including its annexes and the transfer clauses in section 15. Your electronic acceptance counts as your signature on all of them. No separate signed copy is needed.

This DPA meets the requirements of Brazil's General Data Protection Law (LGPD, Law 13,709/2018, art. 39), the EU GDPR and the UK GDPR (art. 28), US state privacy laws such as California's (CCPA/CPRA), and Canadian law (PIPEDA and Quebec's privacy law).

02Roles

In short: your store is the controller of its customers' and creators' data. Vertia is the processor and only processes that data to provide the service.

• You are the controller of the personal data of your store's customers, your storefront visitors and the creators your store registers. The store, the customers and the purposes are yours.
• Vertia is the processor (a "service provider" under the CCPA). We process that data on your behalf, only to provide the service and only on your instructions.
• If you act for another business, such as an agency running a client's store, you are that business's processor and Vertia becomes a sub-processor. You confirm that the business has authorised you to give us the instructions in this DPA.
• Outside this DPA is the data Vertia processes as a controller: your account and your team, the creator's global portal account, visitors to our website, and access logs. That data is covered by the Privacy Policy.

03What we process, for how long and why

In short: we process the data your store brings into Vertia, for as long as the contract lasts, to make the CRM work.

• Subject matter: the personal data Vertia receives from your store platform, from you, from your team, and from your customers and creators when they use the service.
• Duration: the term of the contract, plus the deletion period in section 13.
• Nature: collection through your store platform, storage, organisation, segmentation, sending messages, recording their results, calculating commissions, and deletion.
• Purpose: providing the service you subscribed to: segmenting customers, sending email and WhatsApp campaigns and automations, measuring results, and managing creators and their commissions.
• Data subjects and data: the categories are listed in Annex I.

Sensitive data. The service does not ask for sensitive data (health, racial or ethnic origin, religion, political opinions, sex life, biometrics and the other special categories in LGPD art. 5(II) and GDPR art. 9). Do not put it into Vertia, including in free-text fields such as notes, tags or imported spreadsheets.

04Your instructions

In short: we only do with the data what you tell us to, through the dashboard, your store settings or in writing. If an instruction is unlawful, we will tell you.

What counts as an instruction. This DPA, the Terms, what you configure in the dashboard (campaigns, automations, groups, integrations), and what you ask of us in writing through the support email.

What we don't do. We do not process your store's data for our own purposes. In particular, we:

• do not sell, rent or share it;
• do not use it for advertising, ours or anyone else's;
• do not combine it with other stores' data;
• do not use it to train artificial intelligence models, including in anonymised, aggregated or derived form. This applies with particular force to WhatsApp data, which Meta's terms prohibit using that way.

Legal requirements. If the law requires us to process data outside your instructions, for example under a court order, we will tell you first, unless that law prohibits it.

Unlawful instructions. If we believe an instruction of yours breaches data protection law, we will tell you immediately and may suspend that operation until the question is resolved.

Outbound webhooks and integrations. When one of your store's administrators registers an outbound webhook URL or connects an integration, the data you selected is sent to that destination. That transfer is your instruction. Vertia signs each delivery so the destination can verify where it came from, but the destination is your choice: you are responsible for what happens to the data once it arrives, and the destination is not a Vertia sub-processor. Customer events sent by webhook can currently include name, email, phone, tax ID (Brazilian CPF or CNPJ), date of birth, gender, city and consent status.

05Law-specific terms

In short: the obligations above apply everywhere. This section shows how they map to each law.

Brazil (LGPD). We process data on your instructions (art. 39), keep records of processing operations (art. 37), apply the security measures required by art. 46, and are liable as set out in art. 42.

European Union and United Kingdom (GDPR and UK GDPR). This DPA covers each point of art. 28(3):

California (CCPA/CPRA). For personal information of California residents, Vertia is your service provider and processes it only for the business purposes in section 3. Vertia:

• does not sell or share the personal information;
• does not retain, use or disclose it outside the direct business relationship with you, or for any purpose other than those specified in this DPA;
• does not combine it with personal information received from others or collected on its own behalf, except as the law permits;
• complies with the CCPA and gives the information the same level of protection the law requires of you;
• will notify you if it can no longer meet these obligations;
• allows you to take reasonable steps to stop and remediate unauthorised use;
• passes personal information to subcontractors only under a written contract with the same obligations.

Vertia certifies that it understands and will comply with these restrictions.

Other US states (such as Virginia, Colorado, Connecticut and Texas). As a processor, Vertia follows your instructions, keeps the data confidential, deletes or returns it at the end, provides the information needed to demonstrate compliance, cooperates with assessments, and engages subcontractors only under written contracts with equivalent obligations.

Canada (PIPEDA). Vertia gives the data a level of protection comparable to the one you must provide (Principle 4.1.3). Data may be processed outside Canada, in the countries listed under Sub-processors.

Quebec (Law 25). This DPA is the written mandate required by s. 18.3: Vertia uses the data only for the mandate, applies the measures in Annex II, does not keep the data after the contract ends, and notifies you without delay of any breach of confidentiality. On request, we provide the information you need for your privacy impact assessment before contracting (s. 17).

06Confidentiality

In short: everyone who handles your store's data is bound by confidentiality.

Only authorised people process your store's data, and only as far as needed to provide the service, give support you asked for, or comply with the law. Each of them is bound by a contractual or statutory duty of confidentiality that continues after they stop working with Vertia.

07Security

In short: we maintain the technical and organisational measures in Annex II and only replace them with measures that protect at least as well.

Vertia applies the measures described in Annex II, appropriate to the risk of the processing, as required by LGPD art. 46 and GDPR art. 32. We may update these measures as long as the level of protection does not drop. Our Security page explains them in plain language.

08Sub-processors

In short: you authorise the sub-processors on our list. Before adding or replacing one, we email notice 15 days in advance, and you can object.

General authorisation. You authorise Vertia to use the sub-processors published under Sub-processors (Annex III).

Same obligations. Each sub-processor accepts, in a written contract, data protection obligations at least as protective as those in this DPA. Vertia remains liable to you for what its sub-processors do.

Notice of changes. Before adding or replacing a sub-processor, we update the page and email notice at least 15 days in advance to everyone who has subscribed. To subscribe, email privacidade@usevertia.com with the subject line "Subscribe to sub-processor notices".

Objection. Within those 15 days, you may object in writing on reasonable data protection grounds. We will work with you on a solution, such as not using that sub-processor for your store. If there is no solution, you may terminate the contract before the change takes effect, without penalty.

Emergencies. If we have to replace a sub-processor urgently, to protect the data or keep the service running, we will notify you as soon as possible, and your right to object still applies.

09Data subject requests

In short: if one of your customers asks to access, correct or delete their data, we help you respond on time.

• The dashboard shows requests that arrive through your store platform and lets you export a customer's data. A customer is deleted through the platform's privacy request or, at your written request, by us, within 30 days.
• If a data subject contacts Vertia directly about your store's data, we forward the request to you within 2 business days and do not answer on your behalf unless you ask us to.
• On request, we help with anything the dashboard does not cover, as far as is reasonable given the nature of the service.

10Impact assessments and prior consultation

In short: if you need to assess the risk of the processing, we give you the information we have.

On request, we provide the information you need for a data protection impact report (LGPD art. 38), a data protection impact assessment (GDPR art. 35, or Quebec's privacy impact assessment), or a prior consultation with a supervisory authority (GDPR art. 36). This includes where the data is stored, who processes it, and the measures in Annex II.

11Security incidents

In short: if an incident affects your store's data, we tell you within 48 hours of becoming aware of it.

Timing. We notify you without undue delay and within 48 hours of Vertia becoming aware of an incident affecting your store's personal data. That leaves you room to meet your own deadlines: 3 business days for Brazil's ANPD (ANPD Resolution 15/2024) and 72 hours for EU supervisory authorities (GDPR art. 33).

How we notify you. By email to the store administrator and by a notice in the dashboard.

What the notice covers. What we know so far about:

• the nature of the incident;
• the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures taken or proposed to contain the incident and limit harm;
• who can give you more information.

Anything we don't know yet, we send in stages as soon as we learn it.

After the notice. We cooperate with your investigation and with notifying authorities and data subjects, which is your responsibility as controller. We record every incident, whether or not it was notified, and keep that record for at least 5 years. Notifying you is not an admission of fault.

12Information and audits

In short: you can check that we comply with this DPA. We start with a questionnaire and documents; on-site visits happen only when the law requires them.

• Questionnaire. Once a year, and after any incident affecting your store, we answer a reasonable written security and privacy questionnaire.
• Report. Along with the answers, we provide documentation showing compliance with this DPA, such as the description of the Annex II measures and the current sub-processor list.
• On-site audit. An on-site audit takes place only when applicable law or a supervisory authority requires it and the questionnaire is not enough. It is scheduled with 30 days' notice, carried out by you or an auditor bound by confidentiality, during business hours, without access to other stores' data, at most once a year unless an authority requires otherwise, and at your expense.
• Where the EU Standard Contractual Clauses apply, audits follow their clause 8.9.

13End of the contract

In short: ask for an export before you leave. We delete your store's data within 30 days of the end.

Return. Before terminating the contract or uninstalling the app, you can ask suporte@usevertia.com for a copy of your store's data in a structured format. After uninstallation, your store platform may request deletion within days (48 hours on Shopify), after which a copy is no longer possible.

Deletion. We delete your store's data, including files and data received from Meta, within 30 days of the end of the contract or of uninstallation.

What remains. Only what the law requires us to keep, for the period it sets, under the same confidentiality and for that purpose only. We also keep a store identifier, with no customer data, so that a reinstallation cannot bring back data that has already been deleted.

Suppliers' technical logs, such as error and request logs, are deleted on each supplier's own retention cycle.

14Integrations you choose

In short: you contract Shopify, Nuvemshop and Meta yourself. The data we exchange with them is also governed by your own contracts with them.

Your store platform (Shopify or Nuvemshop) and Meta, for WhatsApp, are not Vertia sub-processors. You contract each of them directly, and your accounts with them are yours. Vertia receives data from them and sends data to them on your instructions. For WhatsApp, Meta processes messages as your business's processor, under the terms you accept with Meta, such as the WhatsApp Business Data Processing Terms. See the list and explanation.

15International transfers

In short: your store's data is stored in Brazil. Where a supplier processes data abroad, we use the legal transfer mechanism each region requires.

Where the data is. The database and files are stored in São Paulo, Brazil. Some suppliers process data in other countries, mainly the United States. Each supplier's country and transfer mechanism are listed under Sub-processors.

From the European Union to Brazil. The European Commission has recognised that Brazil provides an adequate level of protection (Decision C(2026) 373 of 26 January 2026). Transfers from your EU store to Vertia therefore need no additional clauses.

From the United Kingdom. The UK does not recognise Brazil as adequate. For UK data, the EU Standard Contractual Clauses apply together with the ICO's International Data Transfer Addendum (version B1.0), both incorporated into this DPA. The Addendum's tables are completed with the parties and details in Annex I, and neither party may end it under its clause 19.

From Switzerland. For Swiss data, the EU Standard Contractual Clauses apply with the adjustments Swiss law requires: the competent authority is the Federal Data Protection and Information Commissioner (FDPIC), "Member State" includes Switzerland, and data subjects may enforce their rights there.

Fallback: EU Standard Contractual Clauses. If the adequacy decision ceases to apply, or does not cover a transfer, the Standard Contractual Clauses approved by Decision (EU) 2021/914 apply: Module 2 where you are a controller and Module 3 where you are a processor. Under them:

• clause 7 (docking clause) applies;
• under clause 9, option 2 (general written authorisation) applies, with the 15-day notice in section 8;
• the optional independent dispute resolution wording in clause 11 does not apply;
• under clauses 17 and 18, the law and courts of the Member State where you are established apply; if that law does not allow for third-party beneficiary rights, Irish law applies;
• the annexes are Annexes I, II and III of this DPA.

Transfers out of Brazil. When your store's data leaves Brazil for a sub-processor in a country that the ANPD has not recognised as adequate, the transfer follows LGPD art. 33. Vertia is formalising the ANPD standard contractual clauses (ANPD Resolution 19/2024, option B, for transfers between processors, art. 33(II)(b)) with each of those sub-processors; the Sub-processors page shows where each one stands. The ANPD recognises the European Union as adequate (ANPD Resolution 32/2026); for sub-processors there, LGPD art. 33(I) applies. You publish information about these transfers in your store's privacy policy (Resolution 19/2024, art. 17), and we give you what you need to do so.

Onward transfers. A sub-processor only receives data from outside its country of origin under a mechanism valid for that transfer, and protection must not drop at any step.

16Liability

In short: liability under this DPA follows the cap in the Terms, except where the law does not allow it to be limited.

Between you and Vertia, liability under this DPA is governed by the liability section of the Terms, including the cap of 12 months' fees and the exceptions set out there. The cap does not limit data subjects' rights or any liability the law does not allow to be limited, such as under LGPD art. 42 and GDPR art. 82, and does not apply to the transfer clauses in section 15 to the extent they do not allow limitation.

17Order of precedence

In short: for personal data, this DPA prevails over the Terms. The transfer clauses prevail over this DPA.

In case of conflict, the following order applies:

1. the transfer clauses in section 15 (EU Standard Contractual Clauses, UK Addendum, Swiss adjustments and ANPD standard contractual clauses), where they apply;
2. this DPA and its annexes;
3. the Terms of Service;
4. our other policies.

This DPA is governed by the law and jurisdiction set out in the Terms, except where the transfer clauses provide otherwise. Changes follow the change rules in the Terms. As in the Terms, the Portuguese version prevails over the English one.

18Contact

In short: questions about this DPA go to our privacy channel.

• Data protection officer under the LGPD (encarregado): Brunno Vert Visani Carvalho, at privacidade@usevertia.com.
• EU and UK representatives and DPO (GDPR): Vertia will appoint its EU representative (GDPR art. 27), its UK representative (UK GDPR art. 27) and its data protection officer (DPO) before offering the service to customers in the European Economic Area and the United Kingdom, and will publish their names and contact details on this page. Until then, send requests to privacidade@usevertia.com.
• Incidents and vulnerabilities: seguranca@usevertia.com.

19Annex I

In short: the parties and the data covered by this DPA, in the format of Annex I to the EU Standard Contractual Clauses.

A. List of parties

Activities: the exporter sells online; the importer provides CRM and messaging software for online stores. Signature and date: electronic acceptance of the Terms, on the recorded date.

B. Description of processing and transfer

Data subjects:

• the store's customers and former customers, including people who only left their contact details at checkout;
• subscribers and contacts you import;
• creators (influencers and affiliates) the store registers;
• people who receive the store's messages by email or WhatsApp.

Personal data:

• identity and contact details: name, email, phone, phone number country, tax ID (CPF or CNPJ, where the platform or you provide it), date of birth and gender, where available;
• location: city, state and country; full address, IP address and browser of the order, where included in the raw notification the platform sends;
• purchases: orders, items, amounts, discount codes, sales channel, payment method, dates and refunds;
• consent: opt-in and unsubscribe status per channel, with dates;
• segmentation: tags, groups and purchase scoring (RFM);
• messages: content sent; delivery, open (with the IP address and email-client user agent reported by the provider), read and reply events reported by the channel; and the click recorded by our link;
• creators: name, contact details, social media handles, notes, acceptance of the store's agreement, attributed sales, settlements, payments, payment receipts and payout details (CPF or CNPJ, Pix key, company name);
• data subjects' privacy requests and the record of who did what in the store.

Sensitive data: none. See section 3.

Frequency: continuous, for the term of the contract.

Nature and purpose: as set out in section 3.

Retention: for the term of the contract, plus up to 30 days (section 13). Creator payment receipts are deleted 90 days after upload. A customer's data is removed when you, the data subject or the platform request deletion.

Transfers to sub-processors: subject matter, nature and duration are on the Sub-processors page.

C. Competent supervisory authority

The authority of the Member State where the data exporter is established. If the exporter is not established in the EU, the authority of the Member State where its representative is located (GDPR art. 27). In the United Kingdom, the Information Commission (formerly the ICO). In Switzerland, the FDPIC.

20Annex II

In short: the technical and organisational measures Vertia maintains. Those under Email apply from the moment a store's email channel is activated.

Where the data is stored

• Database and files on Supabase, in São Paulo (AWS region sa-east-1).
• Application and functions on Vercel, in São Paulo (region gru1).
• Store emails sent through Amazon SES, in São Paulo (sa-east-1), from activation of the email channel.

Encryption

• In transit: the website, the app and the APIs accept HTTPS only, with TLS 1.2 or 1.3.
• At rest: the database is encrypted by the provider (Supabase, AES-256).
• In the application: store platform access tokens and outbound webhook secrets are encrypted with AES-256-GCM, using a fresh random IV for each encryption and a key kept outside the database.

Separation between stores

• Every data table has row-level security enabled, and every row belongs to one store.
• Background jobs filter by store explicitly.
• Files are stored under separate paths per store. The receipts bucket is private, and each file opens through a signed link valid for 60 seconds.

Access within a store

• Administrator and member roles.
• Creators' payout details are kept in a separate table, visible only to administrators and only after the creator accepts the store's agreement.
• Passwords are kept only in the authentication service (Supabase Auth), never in our tables, with a 10-character minimum. Users can also sign in with a magic link or with Google.
• The activity log records who performed each operation in the store.

Integrations

• Notifications from Shopify and Nuvemshop are verified by HMAC signature before they are accepted.
• Outbound webhooks are signed so the destination can verify their origin.
• Connecting a store platform (OAuth) uses an encrypted state that expires in 10 minutes.
• When fetching external images, we only accept HTTPS to public addresses, with no redirects.

Data minimisation

• Error monitoring (Sentry) without personal data: no names, emails, IP addresses, cookies, headers or request bodies; error messages are replaced with generic text.
• Application logs contain only identifiers and reasons, never the data itself.
• No analytics tools, pixels or third-party cookies on the website or in the app.
• The email provider's click tracking is turned off on the email channel.

Email (from activation of the channel)

• Store email is sent from the store's own domain, authenticated with DKIM (2048-bit key), SPF on a dedicated subdomain, and DMARC.
• Every marketing email has one-click unsubscribe.

Retention and deletion

• Deletion per data subject and deletion of the entire store, including files, through Shopify and Nuvemshop privacy requests or on written request.
• A minimal record of each deleted customer prevents them from coming back in a later import.
• Creator payment receipts are deleted automatically 90 days after upload.

Organisation

• People bound by confidentiality, with access limited to what their role requires.
• Sub-processors under data protection contracts (section 8).
• An incident response process, with notice within 48 hours and a record of every incident (section 11).

21Annex III

In short: the sub-processor list lives on its own page, with its last-updated date.

The current list of sub-processors, with purpose, data processed, location and transfer mechanism, is at Sub-processors. It forms part of this DPA. Changes follow section 8.