Snapshot 37020
Normalized text
Scripts and page chrome removed; this is what change detection compares.
BEYOND VIRTUAL CLOUD DESKTOPS
Secure cloud platform for teams & AI agents
This data processing addendum (“DPA”) supplements the Agreement between V2Cloud Solutions, Inc. and the Customer and is entered into as of the date of entering into the Agreement. This DPA incorporates the Agreement and any capitalised terms used but not defined in this DPA shall have the meanings set forth in the Agreement. For the purposes of this DPA, the Customer is the Data Controller and V2Cloud Solutions, Inc. the Data Processor.
Built for businesses, MSPs & ISVs who want a partner, not just a provider.
Get a Risk-Free Trial Let's Talk
7-day risk-free trial · Cancel anytime
Effective Date: September 1, 2026
This Data Processing Addendum (“DPA”) is made and entered by and between Customer, whose name and address are set forth in the Agreement, and V2 Cloud Solutions, Inc., or its affiliate, as is set forth in the Agreement (“V2 Cloud Solutions”) (collectively, the “Parties”). The DPA governs the processing of Personal Data when Customer uses V2 Cloud Solutions products and services and when Data Protection Laws apply.
Definitions.
Defined terms used but not defined herein shall have the same meaning as the Agreement. Where the DPA uses other terms not defined in the DPA, those terms shall have the same meaning as in GDPR. The use of terms set forth in GDPR does not mean that a Party has agreed to comply with GDPR unless the GDPR is applicable to it.
The DPA shall be read and interpreted in the light of the provisions of the Data Protection Laws and shall not be interpreted in a way that runs counter to the rights and obligations provided for in the Data Protection Laws or in a way that prejudices the fundamental rights or freedoms of the data subjects, consumers, and analogous entities under Data Protection Laws (“Data Subjects”).
“Affiliate” of a party means any entity that is controlled by a party to this Agreement, so long as the control exists.
“Control” means direct or indirect control of more than 50% of the shares or other equity interests of the subject entity entitled to vote in the election of directors (or, in the case of an entity that is not a corporation, for the election or appointment of the corresponding managing authority). As to Customer, any reference to “Affiliate” herein is strictly limited to those Affiliates of Customer that qualify as a data controller with respect to the Personal Data and are permitted to use the Services pursuant to the Agreement but have not signed their own order form and are not a “Customer” as defined under the Agreement.
“Agreement” means the agreement for the provision of the Services.
“Controller” means the entity that determines the purposes and means of the processing of Personal Data, which for the purposes of this DPA is the Customer.
“Data Protection Laws” means the data protection laws applicable to the Personal Data in scope of this DPA including, but not limited to: Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) (“PIPEDA”), and any applicable provincial privacy legislation in Canada (“PIPEDA”), Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), the Federal Data Protection Act of 19 June 1992 (Switzerland) and the revised Swiss Federal Data Protection Act effective September 1, 2023 (“Swiss FADP”), the United Kingdom (UK) Data Protection Act 2018 and the UK GDPR from December 31 st 2020 ( “UK Privacy Laws”), the Australian Privacy Act 1988, New Zealand Privacy Act 2020, the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act, the Iowa Data Privacy Act, the Indiana Consumer Data Protection Act, the Montana Consumer Data Privacy Act, the Tennessee Information Protection Act, and the Texas Data Privacy and Security Act and any subsequent privacy laws enacted in the United States requiring data processing agreements (“US Privacy Laws”).
“Personal Data” means all data relating to individuals which is processed by V2 Cloud Solution on behalf of the Customer under this DPA.
“Processor” means an entity that Processes Personal Data on behalf of the Controller, which for the purposes of this DPA is the V2 Cloud Solution Affiliate identified in the Agreement.
Scope and hierarchy. Each Party has agreed to the DPA in order to ensure that it is in compliance with the Data Protection Laws applicable to it. The DPA applies to the processing of Personal Data as specified in Annex II only. Annexes I to IV are an integral part of the DPA. The DPA is without prejudice to obligations to which Customer is subject by virtue of the Data Protection Laws. In the event of a contradiction between the DPA and the provisions of related agreements between the Parties existing at the time when the DPA is agreed or entered into thereafter, the DPA shall prevail.
Description of processing. The details of the processing operations, in particular the categories of Personal Data and the purposes of processing for which the Personal Data is processed on behalf of Customer, are specified in Annex II.
V2 Cloud Solutions Obligations
Instructions. V2 Cloud Solutions shall process Personal Data only on documented instructions from Customer and for the specific purpose(s) and duration of processing, as set out in Annex II, unless it is required to do so by Data Protection Laws. In this case, V2 Cloud Solutions shall inform Customer of such legal requirement before processing, unless prohibited by law. Subsequent instructions may also be given by Customer in writing throughout the duration of the processing of Personal Data. V2 Cloud Solutions shall inform Customer if, in V2 Cloud Solutions’s opinion, instructions given by Customer infringe the Data Protection Laws.
Security of processing. V2 Cloud Solutions shall implement technical and organizational measures to ensure the security and protection of the Personal Data, including protecting the Personal Data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to Personal Data (“Data Breach”). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context, and purposes of processing, and the risks involved for the Data Subjects. The measures implemented by V2 Cloud Solution at the time of entering into this DPA are specified in Annex III.
Confidentiality and access to Personal Data. V2 Cloud Solutions shall only grant access to the Personal Data to members of its personnel to the extent strictly necessary for the purpose specified in Annex II. V2 Cloud Solutions shall ensure that persons authorized to process the Personal Data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Documentation and compliance. The Parties shall be able to demonstrate compliance with the DPA. V2 Cloud Solution shall make available to Customer all information reasonably necessary to demonstrate compliance with the obligations of this DPA
Audit. At Customer’s request and subject to 30 days written notice, V2 Cloud Solutions shall also permit and contribute to audits of the processing activities covered by the DPA maximum once every calendar year, or more frequently if there has been a Data Breach involving the Personal Data. Customer may choose to conduct the audit by itself or mandate an independent auditor, who is subject to confidentiality obligations. Audits shall not include inspections at the premises or physical facilities of V2 Cloud Solutions. Customer acknowledges that V2 Cloud Solutions’ obligations may be satisfied in whole or part by the provision to Customer of appropriate information; records; and certifications and audit reports issued by reputable independent third parties provided that there have been no material changes to the controls used by V2 Cloud Solutions since the certification or audit report was issued. V2 Cloud Solutions reserves the right to conduct independent audits of its processing activities and systems. The Parties shall make the information referred to in this DPA, including the results of any audits, available to the competent regulators and supervisory authority/ies on request.
Use of sub-processors/service providers
V2 Cloud Solutions is authorized to engage (and to permit each sub-processor/service provider engaged in accordance with this DPA and set out in the list in the link in Appendix IV to engage) sub-processors/service providers (“Sub-processor”) in accordance with this DPA. If a new Sub-processor is engaged or an existing Sub-processor removed, the list in the link in Appendix IV shall be updated. In order to receive alerts regarding such list updates, an email should be sent to [email protected] with “Subscribe to sub-processor updates” as the subject.
If the Customer objects to the engagement or removal of a Sub-processor with reasonable grounds based on Data Protection Laws, the objection must be expressed within thirty (30) days of receipt of such an alert email in writing. Should V2 Cloud Solutions not be able to adjust its services and continue the provision of the services without the appointed Sub-processor, Customer may close its account. Termination is Customer’s sole and exclusive remedy if Customer objects to the appointment of any new or the removal of any existing Sub-processor, and any previously accrued rights and obligations will survive such termination. If objection is not made within such time-period, then the addition of the new or the removal of the existing Sub-processor shall be deemed accepted.
Where V2 Cloud Solution engages a Sub-processor it shall impose on the Sub-processor, in substance, the same data protection obligations as the ones imposed on V2 Cloud Solutions in this DPA.
V2 Cloud Solutions shall remain fully responsible to Customer for the performance of the Sub-processor’s obligations in accordance with the Agreement.
International transfers.
During the provision of the Services under the Agreement, V2 Cloud Solutions may transfer Personal Data to a third country or an international organization. V2 Cloud Solutions shall comply with Data Protection Laws and the transfer mechanisms allowed by the Data Protection Laws in all such transfers.
To the extent Personal Data includes Personal Data from the EU and EEA by entering into the Agreement and this DPA, the Parties are deemed to have signed the EU Standard Contractual Clauses from June 4, 2021 (“SCCs”), including their annexes, attached hereto. To the extent the SCCs are entered into, the following options for Module 2 of the SCCs shall be used:
Clause 7. The optional docking does not apply.
Clause 9. Use of sub-processors Option 2: General written authorization is selected and the minimum time period for prior notice of sub-processor changes and the notification method have been agreed in section 6.5 of the DPA
Clause 11. The optional language does not apply.
Clause 17. Option 2 is selected and the Parties agree that this shall be the governing law of the Agreement.
Clause 18 (b). The Parties agree that any dispute arising from these Clauses shall be resolved by the courts of Ireland.
Clause 13. All square brackets in are hereby removed;
Annex I to this DPA contains the information required in Annex I of the SCCs;
Annex II to this DPA contains the information required in Annex II of the SCCs; and
Annex III to this DPA contains the information required in Annex III of the SCCs.
To the extent Personal Data includes personal data from the UK for the purposes of localizing the SCCs to United Kingdom law, the parties agree that the SCCs are deemed amended to the extent necessary that they operate for transfers from the United Kingdom to a third country and provide appropriate safeguards for transfers according to Article 46 of the UK GDPR. Such amendments include changing references to the GDPR to the UK GDPR and changing references to EU Member States to the United Kingdom. The parties agree that the UK Addendum will apply to transfers of UK Personal Data protected by the UK GDPR and will be completed as follows:
Table 1 will be completed with the relevant information in Annex I of this DPA;
Table 2 will be completed with the selected modules and clauses of the EU SCCs as identified in Section 6.2 of this DPA;
Table 3 will be completed with the relevant information from Annexes I, II and III of this DPA;
In Table 4, both the data exporter and data importer may end the UK Addendum in accordance with the terms of the UK Addendum.
To the extent Personal Data includes personal data from Switzerland for the purposes of localizing the SCCs to Swiss law the following applies:
The parties adopt the GDPR standard for all data transfers, or the standard under Swiss law where higher.
The parties agree that the references to provisions of the GDPR in the SCCs are to be understood as references to the corresponding provisions of the Swiss Federal Data Protection Act in the version applicable at the moment of initiation of any dispute.
The term Member State where used in the SCCs also applies to Switzerland. In particular, this shall ensure that data subjects are not excluded from the possibility to sue for their rights in their place of habitual residence.
Clause 13 and Annex I(C): The competent authorities under Clause 13, and in Annex I(C), are the Federal Data Protection and Information Commissioner and, concurrently, the EEA member state authority identified above.
Clause 17: The Parties agree that the governing jurisdiction is the Member State in which the data exporter is established for claims under the GDPR and the substantive laws of Switzerland for claims under the Swiss Federal Data Protection Act.
Clause 18: Any dispute arising from these Clauses shall be resolved by the courts of Zurich, Switzerland. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence. The Parties agree to submit themselves to the jurisdiction of such courts.
US Privacy Laws. To the extent V2 Cloud Solution’s processing of Personal Data under the Agreement is subject to US Privacy Laws:
The Parties acknowledge that V2 Cloud Solution’s retention, use and disclosure of Personal Data authorized by the Customer’s instructions stated in this Agreement are integral to the Services and the business relationship between the Parties.
V2 Cloud Solution shall:
Use, retain, and disclose Personal Data only as necessary to perform the business purposes specified in this Agreement or as otherwise permitted by US Privacy Laws;
Comply with applicable obligations under US Privacy Laws and shall provide the same level of privacy protection as is required of a "service provider" or "contractor" under each applicable US Privacy Law;
Implement reasonable and appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing, access, use, or disclosure;
Notify the Customer without undue delay if V2 Cloud Solution determines it cannot meet its obligations under US Privacy Laws;
Cooperate with the Customer to stop and remediate any unauthorized use of Personal Data.
V2 Cloud Solution shall not:
Sell or share any Personal Data
Retain, use or disclose any Personal Data for any purpose other than for the business purposes specified in the Agreement, including retaining, using, or disclosing the Personal Data for a commercial purpose other than the business purposes specified in the Agreement or as otherwise permitted by US Privacy Laws
Combine the Personal Data received from the Customer with Personal Data received from or on behalf another person, or Personal Data V2 Cloud Solution collects from its own interaction with the consumer, except as otherwise permitted by US Privacy Laws
De-identify or aggregate Personal Data unless the de-identification meets US Privacy Laws, and the output cannot be re-identified.
Customer Representations and Warranties. Customer hereby represents and warrants that it: (a) will comply with all Data Protection Laws; (b) will ensure that its instructions to V2 Cloud Solution for processing Personal Data comply with Data Protection Laws; (c) will maintain appropriate disclosures and privacy policies, notice and consent mechanisms, and methods for handling Data Subject requests pursuant to Data Protection Laws, ; (d) has all consents, authorizations, and rights required to transfer or disclose, and permit V2 Cloud Solution to process, any and all Personal Data in connection with the Agreement; and (e) has and will have sole responsibility for the accuracy, quality, and legality of any and all Personal Data processed by V2 Cloud Solution. For the avoidance of doubt, to the extent Customer requests that V2 Cloud Solution transfer Personal Data to any third parties on Customer’s behalf, Customer is solely responsible for ensuring that Customer has all necessary consents and rights to transfers such Personal Data. Customer will promptly notify V2 Cloud Solution if it is unable to comply with any of its obligations under this DPA or any Data Protection Laws.
Assistance to the Customer
V2 Cloud Solution shall promptly, and at latest within ten (10) business days, notify Customer of any request it has received from a Data Subject. It shall not respond to the request itself, unless authorized to do so by Customer.
V2 Cloud Solution shall reasonably assist Customer in fulfilling its obligations to respond to Data Subjects’ requests to exercise their rights, taking into account the nature of the processing.
V2 Cloud Solution shall furthermore, taking into account the nature of the data processing and the information available to V2 Cloud Solution, assist Customer in ensuring compliance with the Customer’s legal obligations, including without limitation, to carry out data protection impact assessments where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons and consulting the competent supervisory authority/ies.
Notification of Data Breach.
In the event of a Data Breach, V2 Cloud Solution shall notify Customer without undue delay after V2 Cloud Solution has become aware of the Data Breach. Such notification shall contain, at least a) a description of the nature of the breach (including, where possible, the categories and approximate number of Data Subjects and data records concerned); b) the details of a contact point where more information concerning the Data Breach can be obtained and; c) the likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.
Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
Non-compliance, termination and expiration.
Customer has the right to stop and remediate the unauthorized use of the Personal Data by V2 Cloud Solution.
Without prejudice to any provisions of the Data Protection Laws applicable to the V2 Cloud Solution, in the event that V2 Cloud Solution is in breach of its obligations under the DPA, Customer may instruct V2 Cloud Solution to suspend the processing of Personal Data until the latter complies with the DPA or the DPA is terminated. V2 Cloud Solution shall promptly inform Customer in case it is unable to comply with the DPA, for whatever reason.
Customer shall be entitled to terminate the DPA insofar as it concerns processing of Personal Data in accordance with the Agreement if:
the processing of Personal Data by V2 Cloud Solution has been suspended by Customer pursuant to point 11.2 and if compliance with the Agreement is not restored within a reasonable time and in any event within one month following suspension; or
V2 Cloud Solution fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to the Agreement or to the Data Protection Laws applicable to it.
V2 Cloud Solution shall be entitled to terminate the Agreement insofar as it concerns processing of Personal Data under the Agreement where, after having informed Customer that its instructions infringe applicable legal requirements, Customer insists on compliance with the instructions
Following termination or expiration of the DPA, V2 Cloud Solution shall, at the choice of Customer, delete all Personal Data processed on behalf of Customer or, return all the Personal Data to Customer and delete existing copies unless Data Protection Laws applicable to it require storage of the Personal Data. Until the data is deleted or returned, V2 Cloud Solution shall continue to ensure compliance with the DPA. In absence of the Customer’s instructions the Personal Data will be deleted according to Annex II.
Government and Regulatory Requests. In the event that V2 Cloud Solution receives a legally binding request from any government, regulatory, or law enforcement authority for the disclosure of Personal Data processed under this DPA ("Government Request"), V2 Cloud Solution shall: (a) to the extent permitted by applicable law, promptly notify Customer in writing of the Government Request prior to disclosing any Personal Data, and in any event as soon as reasonably practicable; (b) disclose only the minimum amount of Personal Data strictly required to comply with the Government Request; and (d) maintain a record of all Government Requests received. Where V2 Cloud Solution is prohibited by applicable law from notifying Customer of a Government Request, V2 Cloud Solution shall: (i) use commercially reasonable efforts to have such prohibition lifted or to obtain the right to notify Customer; and (ii) notify Customer as soon as it is legally permitted to do so. Nothing in this section 12 shall require V2 Cloud Solution to act in contravention of applicable law or to incur any costs or liability in challenging a Government Request unless Customer has agreed in writing to reimburse such costs in advance.
Changes to the DPA. V2 Cloud Solution may update or modify this DPA from time to time by posting a revised version on its website, and the revised version shall become effective as of the "Last Updated" date set forth above. V2 Cloud Solution reserves the right to update the DPA if required by Data Protection Laws or in order to comply with its obligations related to transfers of Personal Data to third countries such as the EU Standard Contractual Clauses.
Limitation of Liability. Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the limitations and exclusions of liability in the Agreement, and any reference in provisions to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and the DPA together. For the avoidance of doubt, V2 Cloud Solution, its Affiliates, and its Sub-processor’s total liability for all claims from Customer and all of its Controller Affiliates arising out of or related to the Agreement and the DPA shall apply in the aggregate for all claims under both the Agreement and the DPA.
Governing Law, Choice of Forum, and Jurisdiction. The Agreement shall be governed by and construed in accordance with the laws of the Agreement.
ANNEX I: List of parties
Controller(s): Customer
Processor(s): V2 Cloud Solutions, Inc.
ANNEX II: Description of the processing
Categories of Data Subjects whose personal data is processed
Consumers who visit the websites of V2 Cloud Solutions
Consumers who submit inquiries to V2 Cloud Solutions
Customer’s employees authorized to use the Cloud Services.
Categories of personal data processed
IP address, unique identifier, browsing history
For users of V2 Cloud Solutions’ products: name, email address, phone number, any personal data that a user may disclose via web form, web chat or email .
For prospective customers of V2 Cloud Solutions: business contact details
Sensitive data processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
None
Nature of the processing
Collection, transfer, entry, deletion, correction, adjustment, storage, analysis, matching, sharing, retrieval, combination
Purpose(s) for which the personal data is processed on behalf of the controller/business
Provision of cloud desktop access services.
Duration of the processing
Duration of the Agreement and at the latest, for six (6) months after expiry or termination.
For processing by (sub-)processors/service providers, also specify subject matter, nature and duration of the processing
The same as described above in this Annex II.
ANNEX III: Technical and organizational measures including technical and organizational measures to ensure the security of the data
Description of the technical and organizational security measures implemented by the processor(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context, and purpose of the processing, as well as the risks for the rights and freedoms of natural persons.
Personnel Access and Confidentiality
Limited Access to Data: V2 Cloud, acting as a Data Processor, ensures that its personnel are authorized to access Customer Personal Data only when necessary for the provision of services and support.
Prohibition on Local Storage: V2 Cloud Solutions personnel are prohibited from storing, downloading, or retaining any Customer Personal Data or Confidential Customer Data on local or personal devices at any time, including during support sessions. All access to Customer data must occur exclusively through authorized, centrally managed systems.
II. Confidentiality: Entry controls
The Data Processor shall prevent the use of computer systems by unauthorised persons. This shall transpire through:
Limited access lists
Secured doors
Process by which granting access to a user requires peer review
d. Multi-Factor Authentication ("MFA") required for all administrative and privileged access to Customer environments.
III. Confidentiality: Access controls
The Data Processor warrants that those authorised to use a data processing system shall only be able to access the data that are subject to their access authorisation and that personal data shall not be able to be read, copied, altered or removed during processing or use or after storage without authorisation. This shall transpire through:
Process by which granting access to a user requires peer review
Reviewing access logs
c. All V2 Cloud Solutions personnel access to Customer virtual machines and environments during support sessions must be documented and tracked via a centralized ticketing system (e.g., Jira) prior to such access being granted.
IV. Confidentiality: Separation controls
The Data Processor warrants that data collected for different purposes can be processed separately. There is no need for physical separation; a logical separation of the data is sufficient. This shall transpire through:
Logical separation for all clients
V. Integrity: Disclosure checks
The Data Processor warrants that personal data cannot be read, copied, altered or removed without authorisation during the electronic transmission or transport or storage on data carriers, and that it shall be possible to verify and determine at which points personal data are to be transmitted by means of data transmission equipment. This shall transpire through:
Encryption of data when in transit.
VI. Integrity: Input controls
The Data Processor warrants that it shall be possible to subsequently verify and determine whether and by whom personal data has been entered, altered or removed in data processing systems. This shall transpire through:
Logging
VII. Availability and resilience: Availability checks
The Data Processor warrants that personal data shall be protected against accidental or intentional destruction or loss. This shall transpire through:
Logging
Least Privilege Access
Backups
VIII. Availability and resilience: recoverability
The Data Processor warrants the ability to rapidly restore the availability of the personal data and the access to the data in the event of a physical or technical incident through the following measures:
Disaster recovery and business continuity plans
IX. Evaluation: Data protection management
The Data Processor has implemented a process to regularly review and assess the effectiveness of the technical and organisational protection measures to warrant the security of the processing. This includes:
Random checks of measures
For transfers to (sub-)processors/service providers, also describe the specific technical and organizational measures to be taken by the (sub-)processor to be able to provide assistance to the controller
V2 Cloud Solutions maintains a vendor management policy with criteria for identifying key vendors, including those who process personal data.
V2 Cloud Solutions maintains a list of key vendors and performs vendor risk management.
Sub-processors must adhere to SCCs, DPAs or similar agreements that require technical and organizational measures at least as effective as V2 Cloud Solutions’ own.
Description of the specific technical and organizational measures to be taken by the processor/service provider to be able to provide assistance to the controller/business.
Policies and procedures are in place which require V2 Cloud Solutions to provide assistance to Customer as required by the Agreement and the Data Protection Laws.
ANNEX IV: List of sub-processors
The name, address, contact person’s name, position and contact details, and description of the processing (including a clear delimitation of responsibilities) for each sub-processor can be found at Privacy Policy
Manage consent
Back to top
Still have questions?
Let us help you find the solution that fits your business.
Schedule a call
On a call now34s avg. pickup
SL FC AR MK +6
Your V2 CloudCare team — real people, on the line.