logo

Log in

menu-hamburger

Data Processing Agreement

Last updated: 25 May 2026

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Controller") and FYNVORA LTD, company number 17193639 ("Processor"), operator of Validora at validora.co. It applies when you upload files containing personal data of third parties for validation or enrichment through our Services.

1. Subject matter and duration

The Processor will process personal data on behalf of the Controller for the duration of the Controller's use of the Validora platform and until all personal data has been deleted or returned in accordance with this DPA.

2. Nature and purpose of processing

Processing consists of validating, verifying, cleansing, and enriching data uploaded by the Controller (including email addresses, phone numbers, IP addresses, IBANs, and related business data) solely to deliver the Services requested by the Controller.

3. Types of data and data subjects

  • Types of personal data: contact details, financial identifiers, location data, and other business-related personal data contained in uploaded files.
  • Categories of data subjects: the Controller's customers, prospects, employees, or other individuals whose data the Controller uploads.

4. Processor obligations

FYNVORA LTD shall:

  • Process personal data only on documented instructions from the Controller;
  • Ensure persons authorised to process data are bound by confidentiality;
  • Implement appropriate technical and organisational security measures (UK GDPR Article 32);
  • Not engage sub-processors without the Controller's prior written authorisation, except for infrastructure providers necessary to deliver the Services;
  • Assist the Controller in responding to data subject rights requests (Articles 15–22);
  • Assist with breach notification (Articles 33–34) and data protection impact assessments where required;
  • Delete or return all personal data upon termination of Services, unless retention is required by law;
  • Make available information necessary to demonstrate compliance and allow audits on reasonable notice.

5. Controller obligations

The Controller warrants that it has a lawful basis to process and upload the personal data, that instructions to the Processor comply with applicable data protection law, and that it will not upload data it is not authorised to process.

6. Security measures

The Processor maintains encryption in transit, access controls, monitoring, and regular security reviews. Payment card data is processed by PCI DSS-compliant third-party providers; we do not store card details on our systems.

7. Data breaches

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data and will provide information reasonably required to meet the Controller's notification obligations.

8. International transfers

Where personal data is transferred outside the UK/EEA, the Processor will ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner's Office or European Commission.

9. Contact

For DPA-related enquiries, contact [email protected] or write to FYNVORA LTD (17193639), 1 Coldbath Square, London, England, EC1R 5HL.