Data processing agreement
Last updated: 30 October 2026
How we process personal data for you. Download the text (.txt)
Parties
Controller: the business that holds the Ventunity workspace (you). Processor: Farstripes, eenmanszaak (sole proprietorship) under Dutch law, KvK 75488086, VAT NL001849378B95, Van der Duinstraat 128, 5161 BS Sprang-Capelle, the Netherlands. E-mail: info@farstripes.com.
This agreement is part of the Ventunity terms and applies for as long as Ventunity processes personal data for you.
Subject and purpose
The processor processes personal data only to run Ventunity for the controller: pulling feeds, pricing, pushing offers to the controller's marketplace accounts, stock and order bookkeeping, and support.
Data subjects: the controller's own users, and the controller's marketplace buyers only as far as an order line identifies an order (order ID — no names, addresses or contact details).
Instructions and confidentiality
The processor acts only on the controller's documented instructions — the settings the controller makes in Ventunity — unless the law requires otherwise. Everyone with access is bound to confidentiality.
Security
Encrypted connections (TLS); marketplace and supplier credentials encrypted at rest with AES-256-GCM; row-level security on every table and every request scoped to the signed-in workspace; production access limited to the operator; hosting in the EU (Frankfurt); daily backups.
Sub-processors
The controller authorises the sub-processors listed in the privacy notice. The processor announces a new sub-processor in the privacy notice before it starts, and the controller may object and end the service.
| Provider | What it does for Ventunity | Where |
|---|---|---|
| Vercel Inc. | Hosts the web app and its API | Frankfurt, Germany (fra1) |
| Supabase Inc. | Database and sign-in (accounts, workspace data) | Frankfurt, Germany (eu-central-1) |
| Amazon Web Services (Lightsail) | Runs the worker that pulls feeds and pushes offers | Frankfurt, Germany (eu-central-1) |
| Amazon Web Services (WorkMail) | Sends sign-up confirmation and password-reset e-mails for Supabase Auth | Ireland (eu-west-1) |
| Cloudflare Inc. | Carries the encrypted connection between the app and the worker | Global network |
| Functional Software Inc. (Sentry) | Error reports and masked session replays (all text masked, media blocked) | Germany (de.sentry.io) |
| GitHub Inc. | Stores Ventunity's source code and runs its tests — no customer data | Provider's own infrastructure |
| Telegram | Operational alerts to the operator (account and channel names, counts — no buyer data) | Provider's own infrastructure |
| Anthropic PBC (Claude) | AI tooling the operator uses for support and maintenance; it can read production data while doing so | United States |
| OpenAI (Codex) | AI tooling the operator uses for code review and maintenance; it can read production data while doing so | United States |
Assistance and breaches
The processor helps the controller answer data subject requests and meet its security and impact-assessment duties, and reports a personal data breach to the controller without undue delay once it becomes aware of it.
End of the service
When the service ends, the processor deletes the controller's personal data 30 days after the workspace is deleted, and backups age out 8 days after that. The controller can take an export first.
The processor makes the information needed to show compliance with this agreement available on request.