Data processing
VerkApp is currently in development. Company terms and data-processing terms take effect through recorded acceptance by an authorized representative. Real-company pilot use starts only after the operational onboarding checks, including backups and recovery, have passed. Publication alone does not activate a pilot or a paid subscription.
Parties and scope
These terms form part of the accepted customer agreement between the customer company (controller) and Benjamín Ragnarsson, Iceland, operating VerkApp (processor). The company and authorised representative are identified in the acceptance record. They cover provision, support and security of the workforce/job service for the agreement’s duration and its limited return/deletion period. They do not transfer ownership of the platform.
Processing description
Data subjects are company users, invited employees, customer contacts and other people named in authorised job records. Data includes names, contact details, account and membership identifiers, roles, invitations, job/contact/address/schedule information and associated operation/change records. Operations include collection, storage, authorised retrieval and display, updating, transactional email delivery, support, export and deletion. Special-category and criminal-offence data are not intended inputs. The privacy notice sets the standard retention periods.
Instructions and confidentiality
The accepted agreement, authorised service actions and lawful written requests constitute documented instructions. The processor acts only on these instructions, including for international transfers, unless required by applicable law; it will inform the controller of that requirement unless legally prohibited. The processor will promptly flag an instruction it believes infringes applicable data-protection law. Authorised personnel must be bound by confidentiality and given only necessary access.
Security and assistance
The processor must maintain risk-appropriate organisational and technical measures, including tenant access separation, verified account/role checks, least privilege, protected secrets and device sessions, encrypted transport, change traceability and procedures for access review, incident handling and deletion. Before real-data activation, the operational security schedule must confirm backups/recovery, monitoring, maintenance and the actual deletion/export procedures; publication of these terms is not evidence those checks have passed.
The processor assists with rights requests, security obligations, impact assessments and supervisory consultations, taking account of the processing and available information. It notifies the controller of a personal-data breach without undue delay after becoming aware, supplies available details and follows up as information becomes available.
Subprocessors and transfers
Acceptance gives general written authorisation only for the verified processing providers listed in the final service schedule. Intended additions or replacements will be notified in advance with sufficient opportunity for a reasoned data-protection objection before the change. If a suitable alternative cannot be agreed, the affected processing must not proceed under this authorisation. Equivalent protection must be imposed on subprocessors; the operator remains responsible for their relevant obligations.
The proposed service schedule is Supabase (authentication/database; development database in London), Resend (transactional email), Cloudflare Pages (public information pages), and Vercel (authentication-link hosting and domain services). Their legal entities, processing locations, schedules and contracts must be verified before this document becomes effective. Google Places is an optional external address-search provider; its role and EEA terms must be assessed separately rather than assuming it is a subprocessor for every purpose.
Transfers outside the EEA require an applicable lawful mechanism, including an applicable adequacy decision or appropriate safeguards, and any necessary supplementary measures.
Return, deletion and compliance evidence
At the end of processing, the controller may choose return or deletion of personal data. The standard process offers an export for 30 days after company-account closure, then deletes live data and copies except legally required retention. An earlier lawful deletion instruction is honoured. Isolated backups expire under the verified schedule; deletion instructions must be reapplied after restoration. A legal-retention exception must be documented and restricted to its required purpose.
The processor makes information necessary to demonstrate compliance available and permits and contributes to proportionate audits, including inspections by the controller or its mandated auditor. Reasonable scheduling and confidentiality arrangements must not prevent statutory audit rights. These terms do not limit either party’s obligations or individuals’ rights under applicable law.