This Data Processing Agreement ("Agreement" or "DPA") forms part of the Terms of Service between the Customer ("Data Controller") and Valiyou ("Data Processor"). It governs the processing of personal data in compliance with GDPR, the Danish Data Protection Act, and applicable PDPA regulations.
All references and documentation related to this DPA are available at: https://valiyou.io/trust-center
1. Parties to the Agreement
1.1 Data Controller (Customer)
- Company Name: [Customer Name]
- Registration Number: [Business ID]
- Address: [Address]
- Contact Person: [Name]
- Email: [Email]
- Phone: [Phone]
1.2 Data Processor (Valiyou)
- Company: Valiyou Aps
- Address: Sankt Peders Stræde 19A, 1453 København K, Danmark
- VAT: DK 44596180
- Email: trust-center@valiyou.com
- Phone: +45 28 87 22 00
- DPO Phone: +45 31 10 79 13
- Website: https://valiyou.com
- Valiyou App: https://valiyou.io
- Documentation: https://docs.valiyou.com
- Status: https://status.valiyou.com
- Trust Center: https://valiyou.io/trust-center
2. Subject Matter & Duration
2.1 Subject Matter
Valiyou processes personal data on behalf of the Customer to deliver the Valiyou SaaS platform including valuation tools, analytics, reporting, and optional AI insights.
2.2 Duration
- Effective on customer signup
- Ends upon contract termination + 30 days retention
- Certain obligations survive termination as required by law
3. Categories of Data Subjects
Valiyou processes personal data related to:
- Organization members (employees, contractors)
- Sponsor contacts
- Players (in valuation or sales modules)
- Proposal recipients
- Newsletter subscribers
4. Categories of Personal Data
Personal data processed includes:
- Identification data (name, email, phone, title)
- Account data (hashed password, preferences, login events)
- Organization data (roles, permissions, invitations)
- Business data (valuations, sponsor info, player data, reports)
- Communication data (system emails)
- Technical data (IP, device, browser, logs)
- Payment data (processed by Stripe only)
Sensitive data: Not processed unless unintentionally entered by Customer.
5. Special Categories of Personal Data
Valiyou does not intentionally process special category data under GDPR Article 9. Any sensitive data added by Customer is Customer's responsibility.
6. Processing Operations
Valiyou performs:
- Collection, storage, organization
- Retrieval, display
- Use for analytics and reporting
- Transmission to sub-processors
- Erasure upon request
- Optional AI analysis (if Customer enables AI Insights plugin)
7. Data Location & Transfers
7.1 Primary Location
Data is hosted in the EU:
- Supabase PostgreSQL database (AWS eu-west-1, Dublin, Ireland)
7.2 Cross-Border Transfers
Some sub-processors operate in the USA. Safeguards used:
- Standard Contractual Clauses (SCCs)
- Data Privacy Framework (where applicable)
Details and updates: https://valiyou.io/trust-center
8. Sub-Processors
Valiyou uses vetted sub-processors including:
- Supabase – EU data hosting
- Vercel – infrastructure
- Stripe – billing & payments
- Resend – transactional email
- AI assistant: Anthropic
- AI Insights providers (optional): Groq, Google Gemini, OpenAI, Anthropic
- Google reCAPTCHA – security
The full maintained list is available at: https://valiyou.io/trust-center/sub-processors
Customer is notified 30 days before any sub-processor is added or changed.
9. Security Measures
Valiyou implements industry-standard technical and organizational measures, including:
- TLS 1.2+ encryption in transit
- AES-256 encryption at rest
- Bcrypt hashing of passwords & API keys
- Role-based access control
- PostgreSQL Row-Level Security
- Automated backups (30-day retention)
- Audit logging of user actions
- DDoS protection & rate limiting
- Bot protection (reCAPTCHA)
Full security overview: https://valiyou.io/trust-center/security
10. Assistance With Data Subject Rights
Valiyou assists Customer with fulfilling requests related to:
- Access
- Rectification
- Erasure
- Portability
- Restriction
- Objection
Response time: Within 7 business days of Customer request.
11. Data Breach Notification
Valiyou will notify Customer:
- Within 24 hours of becoming aware of a breach
- Detailed report within 72 hours
Customer is responsible for regulatory notifications.
12. Data Return & Deletion
Upon contract termination:
- Customer may export data via platform
- Valiyou provides data return upon request
- Data is permanently deleted after 30 days
- Backups deleted after next rotation cycle
Deletion certificate available on request.
13. Audits & Inspections
Customer may:
- Request compliance documentation
- Conduct audits with 30 days notice
- Use independent auditor bound by NDA
Alternative proofs (if available):
- Penetration test summaries
- Sub-processor certifications
14. Liability & Indemnification
14.1 Liability
Valiyou is liable only for:
- Breaches of processor obligations; or
- Processing outside Customer instructions
14.2 Limitation of Liability
Maximum liability is limited to: 12 months of Customer's paid fees, unless otherwise agreed.
14.3 Indemnification
Each party indemnifies the other for damages caused by its own violations.
15. Customer Instructions
Valiyou will only process data according to:
- This Agreement
- Customer's documented instructions
- Legal obligations
Instructions must be sent to: trust-center@valiyou.com
16. Compliance With Laws
Valiyou complies with:
- GDPR (EU)
- Danish Data Protection Act
- PDPA Singapore & Thailand (where applicable)
17. Contact Details
- Privacy Contact: trust-center@valiyou.com
- Security Contact: trust-center@valiyou.com
- Emergency Response: +45 31 10 79 13
18. Term & Termination
This DPA remains in effect while Valiyou processes Customer data. Certain obligations survive termination (security, confidentiality, deletion).
19. Amendments
Valiyou may update this DPA to reflect:
- New legal requirements
- New sub-processors
- Updated security measures
Changes announced 30 days in advance.
20. Governing Law & Dispute Resolution
- Governed by Danish law
- Disputes resolved before Copenhagen courts
21. Definitions
Key terms follow GDPR Article 4. A glossary and explanations are available at: https://valiyou.io/trust-center
What is a DPA?
A Data Processing Agreement (DPA) is a legally binding contract required by GDPR between data controllers (you) and data processors (Valiyou). It ensures we handle your data according to strict privacy and security standards.
Need a custom DPA?
Enterprise customers may request custom DPA terms. Contact our Trust Center team to discuss your specific requirements.
Contact Trust Center