Version 2026-10-26 · Last updated: 26 October 2026
This Data Processing Agreement (DPA) supplements the Velstrian Tenderworks Terms of Service between Velstrian Systems Ltd ("Velstrian Tenderworks", the processor) and the Customer (the controller) and applies whenever Velstrian Tenderworks processes personal data on behalf of the Customer. It is entered into under UK GDPR Article 28 and EU GDPR Article 28.
1. Subject matter, duration, nature, and purpose
Subject matter: the provision of the Velstrian Tenderworks platform services (bid and tender management, Social Value scoring, buyer-side social value evaluation, billing).
Duration: for the term of the Customer's subscription plus the retention periods set out in our Data Retention Policy.
Nature and purpose: hosting, storage, retrieval, modification, processing, and deletion of Customer personal data to deliver the services.
2. Categories of data and data subjects
Data subjects: Customer employees, contractors, and representatives who use the Velstrian Tenderworks platform under the Customer's account.
Categories: name, work email, job title, company, authentication metadata (password hash, MFA secrets), product usage events, billing and VAT identifiers, IP address, and error telemetry.
Special categories: none. The Customer must not upload special- category data under UK GDPR Article 9 to the platform.
3. Processor obligations
Velstrian Tenderworks shall:
- Process personal data only on documented instructions from the Customer, including for international transfers, unless required to do otherwise by UK or EU law (in which case Velstrian Tenderworks shall inform the Customer before processing).
- Ensure that persons authorised to process personal data are bound by confidentiality.
- Implement appropriate technical and organisational measures as set out in Section 8 below.
- Assist the Customer, by appropriate technical and organisational measures, in responding to data subject requests (access, rectification, erasure, portability, restriction, objection).
- Assist the Customer in complying with the obligations in UK GDPR Articles 32 to 36 (security, breach notification, DPIA, prior consultation) taking into account the information available to Velstrian Tenderworks.
- Delete or return all personal data at the Customer's choice at the end of the provision of services, in line with the Data Retention Policy.
- Make available to the Customer all information necessary to demonstrate compliance with this Article, and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer.
4. Sub-processors
The Customer provides a general authorisation for Velstrian Tenderworks to engage sub-processors listed on our Sub-processors page. We will tell you at least 30 days before a new sub-processor starts, by email to the billing contact and on the public sub-processor page. If we must replace a sub-processor sooner for security or continuity, we will tell you as soon as we can. You may object on reasonable data protection grounds within 14 days of the notice. If we cannot resolve it, you may end the affected service and we will refund prepaid fees for it. This is your only remedy for the objection.
Velstrian Tenderworks imposes the same data protection obligations on each sub-processor by written contract (SCC-based DPA or equivalent), and remains fully liable to the Customer for the performance of its sub-processors.
5. Data subject rights
Velstrian Tenderworks shall, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests to exercise data subject rights. Platform self-service tooling covers access (via account export), rectification (via profile editing), and erasure (via account deletion). For other requests, Customer should email [email protected]. We acknowledge the request within 72 hours and give you what you need to answer the person within one calendar month of their request.
Help through the product's own export, delete and settings tools is included. For other help with requests from individuals, data protection impact assessments or regulator contact, we may charge our reasonable costs and will give you an estimate first.
6. Personal data breaches
Velstrian Tenderworks will tell the Customer without undue delay after we become aware of a personal data breach affecting Customer data, and in any event within 72 hours of becoming aware. We become aware when we have reasonable certainty that a breach has happened. We will keep the Customer updated as we learn more. The notification will describe the nature of the breach, categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it.
7. International transfers
The primary store of Customer personal data is in the UK and EEA, as set out on our Data Residency page. Some named sub-processors, listed on our Sub-processors page, process it outside the UK and EEA. Those transfers are governed by the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs) with the UK Addendum, together with a transfer risk assessment where the law requires one, and additional safeguards (encryption in transit and at rest, minimisation, access control) as required.
8. Security measures (Annex II)
8.1 Access control
- Role-based access control with least-privilege defaults.
- Row level security on tenant tables, so one organisation cannot read another's data.
- Multi-factor authentication for every user, with a server-side step-up check before sensitive actions such as account deletion, data export and API key changes once a factor is enrolled.
- Access is granted by role and can be withdrawn at once, including ending a member's active sessions and revoking issued tokens.
8.2 Encryption
- TLS 1.2 or higher for all data in transit between browser, edge and origin, with TLS 1.3 where the client supports it and HSTS preload.
- Encryption at rest for the database and file storage, managed by our hosting provider.
- AES-256-GCM application-layer encryption for stored third-party integration credentials.
8.3 Resilience
- Automated daily database backups managed by our hosting provider.
- A documented backup and restore procedure and business continuity plan.
- Documented incident-response runbook with 24-hour RTO, 1-hour RPO targets.
8.4 Monitoring
- Centralised audit logging of administrative and security-sensitive actions.
- Error telemetry (Sentry) with personal data scrubbed before it is sent.
- Static code analysis, secret scanning and dependency audits on every code pull request, a pre-commit check that blocks secret values from being committed, and a documented key rotation procedure.
- Weekly automated dependency and web application security scans.
9. Audits
First, we will give you our latest security documentation (the controls described in section 8 above) and answer reasonable written questions. If that does not meet what the law requires, you may audit us once in any 12 months, on 30 days' written notice, in working hours, subject to confidentiality and without access to other customers' data. You pay the cost, including our reasonable time. A regulator's request, or a personal data breach affecting your data, allows an extra audit.
10. Liability and governing law
Our liability under this DPA counts towards the limits in the Terms of Service and does not add to them. This does not affect any right a person has under Article 82 UK GDPR. Where we pay compensation for damage that you were responsible for, we may claim back that share from you. The DPA is governed by the laws of England and Wales, with jurisdiction in the courts of England.
11. How to execute this DPA
For customers on Starter, Pro, or Portfolio plans this DPA is self-serving: clicking through at checkout accepts this DPA and the referenced sub-processor list. Enterprise customers requiring a counter-signed copy may request one at [email protected].