This DPA governs how FinVerified processes customer data. It supplements our Terms of Service and Privacy Policy.
"Controller" means the customer who determines the purposes and means of processing Personal Data. "Processor" means FinVerified, which processes Personal Data on behalf of Controller. "Personal Data" means any information relating to an identified or identifiable natural person as defined under applicable Data Protection Laws. "Data Protection Laws" means GDPR, CCPA/CPRA, and other applicable privacy laws.
FinVerified acts as Processor when processing Customer Data submitted to the platform. Controller determines what data is submitted and for what purposes. This DPA applies to Personal Data processed by FinVerified on behalf of Controller.
FinVerified processes Personal Data only: (a) as necessary to provide the Service under the Terms; (b) as documented in Controller's use of the platform; (c) as instructed by Controller through platform features; and (d) as required by law.
FinVerified implements technical and organizational measures including: encryption in transit (TLS 1.2+) and at rest (AES-256); role-based access controls; multi-factor authentication; regular security audits; and incident response procedures. See our Privacy Policy for details.
Controller authorizes FinVerified to engage subprocessors listed at /legal/subprocessors. FinVerified will provide 30 days' notice before adding new subprocessors. Controller may object within 30 days.
FinVerified will assist Controller in responding to data subject requests (access, deletion, correction, portability) by providing export tools and API access to Customer Data. Controller is responsible for verifying data subject identity and determining appropriate responses.
FinVerified will notify Controller without undue delay (target: within 72 hours) upon becoming aware of a Personal Data breach affecting Controller's data. Notification will include available details about the nature of the breach, affected data, and mitigation steps taken.
FinVerified retains Customer Data for the duration of the Service term plus 30 days. Controller may export data at any time. Upon termination or request, FinVerified will delete or return Customer Data within 30 days, except where retention is required by law.
FinVerified will make available to Controller information necessary to demonstrate compliance with this DPA, including SOC 2 reports (when available). Controller may request an audit once per year with 30 days' notice, at Controller's expense.
FinVerified processes data in the United States. For EU/UK customers, FinVerified relies on Standard Contractual Clauses and appropriate supplementary measures. Contact privacy@finverified.ai for SCCs.
FinVerified, Inc.
Data Protection: privacy@finverified.ai
Registered Agent: Northwest Registered Agent Service, Inc., 8 The Green Ste B, Dover, DE 19901