Data Processing Amendment (DPA)


Introduction to this Amendment
Processing personal data in a secure, fair, and transparent way is extremely important to us at VRAZER. As part of this effort, we process personal data in accordance with the EU’s General Data Protection Regulation (“GDPR”), the laws of the US governing the handling of various types of personal data, and industry standards.

To better protect individuals’ personal data, we are providing these terms to govern VRAZER’s and your handling of personal data (the “Data Processing Amendment” or “DPA”). This DPA amends and supplements your Terms of Service (“Terms of Service”) and requires no further action on your part.

If you do not agree to this DPA, you may discontinue the use of the VRAZER Service and cancel your account.


“VRAZER,” “we,” “us,” or “our” refers to the provider of the VRAZER websites (including,,, and and services, (collectively referred to as the “VRAZER Service.”).

“You” or “Customer” refers to the company or organization that signs up to use the VRAZER Service to manage the relationships with your consumers or service users.

“Party” refers to VRAZER and/or the customer depending on the context.


“Data Subjects” refers to those individuals residing in the EU who are consumers or users of a VRAZER Customer’s goods or services (also “consumers”), as well as any personnel who reside in the EU.




“Processor” is the party that processes personal data on behalf of the controller – VRAZER is the processor of the personal data we process about your consumers.

“Sub-processor” is a Third-party, independent contractors, vendors and suppliers who provide specific services and products related to the VRAZER websites and our services, such as hosting, credit card processing and fraud screening, and mailing list hosting (“third-party” or “outside contractor” shall have similar meanings).


1. Undertakings regarding personal data

  2. Personal Data shall remain the property of the disclosing party. VRAZER acknowledges that customer is the controller and maintains control over data subject’s personal data.
    2. it will not modify, alter, delete, publish or disclose any customer personal data to any third party, nor allow any third party to process such personal data on VRAZER’s behalf unless the third party is bound to similar confidentiality and data handling provisions;
  4. Upon termination of your account VRAZER will delete, destroy, or anonymize the personal data in accordance with our standard backup and retention policy, normally, no later than 60 days, unless we are required to retain personal data due to Union, Member State or United States laws; in which case VRAZER reserves the right to retain personal data.
  5. VRAZER shall not transfer any customer personal data outside of the US or to other locations not deemed to be “adequate” under EU or U.S. law without providing reasonable notice under the Terms of Service to the customer.

2. Customer undertakings and VRAZER’s assistance

  1. Customer warrants that it has all necessary rights to provide to VRAZER the personal data for processing in connection with the provision of the VRAZER Services.
  3. Customer understands, as a controller, that it is responsible (as between customer and VRAZER) for:
  4. VRAZER shall assist the customer by implementing appropriate technical and organizational measures, insofar as this is reasonably and commercially possible (in VRAZER’s sole determination and discretion), in fulfilling customer’s obligations to respond to individuals’ requests to exercise rights under the GDPR.
  5. As stated in our Privacy Policy, the customer consents to VRAZER engaging sub-processors to process customer personal data for the permitted purpose of providing products and services for which we contracted provided that: (a) VRAZER will maintain an up-to-date list of its sub-processors, which it will update with the details of any change in sub-processors at least 10 days prior to any change; and (b) VRAZER will impose data protection terms on any sub-processor it engages with as required to protect customer’s personal data to the standard required by the GDPR. Customer may object to VRAZER’s appointment or replacement, provided such objection is based on reasonable grounds related to data protection. In such event, VRAZER will either not appoint or replace the sub-processor or if that is not possible, customer may suspend or terminate the VRAZER Service.
  6. VRAZER will allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller to demonstrate compliance with its obligations under this DPA. Upon written request, VRAZER shall make available to the customer information reasonably necessary to demonstrate compliance with its obligations under this DPA, including an executive summary of any such audits.

3. Incident Management


4. Liability and Indemnity


5. Duration and Termination
