DPA Changelog
This page records all versions of the Vantemo Data Processing Agreement, in accordance with DPA Article 5. When the DPA version is updated, merchants are notified by email and shown a re-acceptance prompt in their admin dashboard.
Version History
| Version | Effective date | Summary of changes |
|---|---|---|
| 1.1 (revised 12 October 2026) | Pending counsel review | Article 7.4: the Controller notifies the supervisory authority competent for it under Art. 55 GDPR (its lead authority under Art. 56 for cross-border processing; each affected Member State's authority for a Controller with no EEA establishment under Art. 3(2)). VDAI is now named in its own paragraph as Vantemo's own lead authority only, with its current address. Annex C.5: BYOD addendum acceptance records are kept while the shop exists and for 3 years after it is deleted; the IP address is deleted 12 months after acceptance. Annex B: the Cloudflare row now lists Email Routing (inbound forwarding, where enabled) and the data it handles. Corrected clause cross-references. Clause numbering is unchanged. |
| 1.1 | Pending counsel review | Accuracy revision to match shipped systems (2026-07 legal review). Corrected: AWS SES processing region to eu-north-1 (Stockholm, EEA — no international transfer); password hashing to Argon2id (storefront customers) + bcrypt cost 12 (merchant/admin); Annex B expanded to the full sub-processor set — Cloudflare R2 object storage, MakeCommerce, Twilio, and the AI/LLM providers Anthropic, OpenAI, Google, and DeepL — with a downstream-chain disclosure per EDPB Opinion 22/2024; Annex A expanded to disclose email open/click tracking, recovery attribution, SMS retention, platform-set storefront cookies, and the end-customer erasure-accountability record; sub-processor change notice corrected to email-only; audit-log retention and MFA disclosures corrected. Added Sentry (Functional Software, Inc.) to Annex B — EU-US DPF + SCCs. Corrected Google/Gemini's transfer mechanism to EU-US DPF + SCCs (was mislabeled SCCs-only); resolved the Anthropic (SCCs, not DPF-certified) and OpenAI (SCCs) transfer-basis markers. Contains items pending counsel sign-off; v1.0 remains in force until v1.1 is reviewed and merchants are notified. |
| 1.0 | 1 March 2026 | Initial version. Covers all Art. 28 GDPR requirements: processing instructions, confidentiality, security (Annex C), sub-processors (Annex B), DSAR assistance, breach notification (48h), deletion and return, audit rights, international transfers (Art. 14 — SCCs + DPF), liability, and term. |
How Version Changes Work
When we update the DPA, we will provide at least 30 days' advance notice by email before the new version takes effect. For material changes that increase your obligations or reduce our obligations, you may terminate the Terms of Service without penalty within 30 days of the amendment taking effect (DPA Art. 13.2).
When a new DPA version takes effect, your admin dashboard will show a prompt asking you to review and accept the updated version. Continued use of the platform after the effective date constitutes acceptance of non-material changes only.
Questions
Contact [email protected] with any questions about DPA changes.