Data Processing Agreement (Member Sites)

Venturee, operated by Binderr B.V.

Effective Date: August 31, 2026 · Version: 1.3

This Data Processing Agreement ("DPA") is between you, the Venturee member who publishes a site (the "Controller"), and Binderr B.V., Geertestraat 27 BS, 3511 XD Utrecht, The Netherlands, KvK 91797047 ("Binderr", the "Processor").

It forms part of the Terms of Service. It applies automatically from the moment you first publish a site through Venturee, and for as long as Binderr hosts it. It implements Article 28(3) of the GDPR for the processing described below.

Contents

1. Roles and scope
2. Processing details
3. Binderr's obligations as processor
4. Sub-processors
5. International transfers
6. Your obligations as controller
7. Deletion
8. Contact
9. General

Version history

1. Roles and scope

1.1 When you publish a site, you are the controller for the personal data of your site's visitors, customers, and users: you decide what your site collects and why, and you are responsible for its privacy notice, any cookie consent, and the handling of data-subject requests, as the Terms state.

1.2 Binderr is your processor for that data, strictly in its role as the host and operator of the infrastructure your site runs on.

1.3 This DPA covers only your site's data. For your own Venturee account — registration data, your profile, prompts, messages, and content you create on the platform — Binderr is the controller, and the Privacy Statement applies instead of this DPA.

2. Processing details (Article 28(3) GDPR)

Payments. If your site takes live payments, payment-card data is collected and processed by Stripe under your own agreement with Stripe, acting for you — not as Binderr's sub-processor. Binderr does not receive, hold, or transmit your customers' funds or full card data; only transaction metadata needed to run your site's features passes through the infrastructure.

3. Binderr's obligations as processor

Binderr will:

3.1 process your site's personal data only to host and operate the site as you have configured it, and on the documented instructions this DPA and your use of the platform's controls constitute — not for its own purposes. Section 3.5 of the Privacy Statement ("What we do not collect: visitors to your published sites") states this commitment publicly;

3.2 immediately inform you if, in Binderr's opinion, an instruction you give infringes the GDPR or other EU or Member State data protection law (Article 28(3)(h));

3.3 ensure persons authorised to process the data are bound by confidentiality;

3.4 implement the technical and organisational measures set out in section 10 of the Privacy Statement (Article 32 GDPR), including encryption in transit and at rest and least-privilege access controls;

3.5 assist you, insofar as reasonably possible and taking the nature of the processing into account, in responding to data-subject requests concerning your site and in meeting your obligations under Articles 32–36 GDPR. If Binderr receives a request directly from one of your site's data subjects, it will not respond on the merits and will forward it to you without undue delay;

3.6 notify you without undue delay after becoming aware of a personal data breach affecting your site's data, with the information Article 33(3) requires as it becomes available;

3.7 where Binderr receives a legally binding request from a public authority for your site's personal data, notify you before disclosing unless legally prohibited from doing so. Where prohibited, Binderr will use reasonable efforts to obtain a waiver, will challenge requests that are unlawful or overbroad, and will disclose only the minimum required;

3.8 at your choice, delete or return your site's personal data when hosting ends, and delete remaining copies, unless law requires retention (section 7);

3.9 make available the information reasonably necessary to demonstrate compliance with this DPA — Binderr's current providers, transfer mechanisms, and security measures are documented in the Privacy Statement — and allow for and contribute to audits, which for proportionality are ordinarily satisfied by that documentation and written answers to reasonable questions.

4. Sub-processors

4.1 You give Binderr general written authorisation to engage sub-processors for the processing described in section 2. Three providers process your site's data today:

Each provider's region and transfer safeguard is in section 8 of the Privacy Statement, which also lists providers Binderr uses for the platform itself — AI generation from your prompts, platform email, images. Those are not sub-processors of your site's data and receive none of it; only the three above are engaged for the processing this DPA covers.

4.2 Notice of changes. Before adding or replacing a sub-processor, Binderr will update that list and notify you by email at least 30 days in advance, except where a shorter period is unavoidable for security or continuity reasons, in which case Binderr will give as much notice as it reasonably can.

4.3 Objection. If you object on reasonable data-protection grounds within that period, Binderr will work with you to find a resolution. If none is found, you may end the processing by deleting the venture under section 7 — export or request the return of anything you need first. Ending the processing does not by itself end your Venturee subscription. If you also choose to cancel that, section 9.3 of the Terms applies — your plan runs to the end of the billing period you have already paid for and you are not charged again — and any unused Top-up Credits are refunded under section 10.7. Where the sub-processor change is also a modification of the Service that affects you in more than a minor way, section 11.2 of the Terms gives you the statutory right to keep the Service unmodified or to terminate and be reimbursed for the period you have paid for in advance and will not now receive.

4.4 Binderr imposes data-protection obligations on each sub-processor equivalent to this DPA and remains responsible to you for their performance.

5. International transfers

Where processing involves transfers outside the EEA, the safeguards set out in section 12 of the Privacy Statement apply: the EU–US Data Privacy Framework for certified providers, and the European Commission's Standard Contractual Clauses (2021) otherwise, with supplementary measures where needed.

6. Your obligations as controller

6.1 You are responsible for the lawfulness of your site's processing: an adequate privacy notice for your site, any required consent (including cookies and marketing), honouring visitor rights requests, and compliance with the consumer, e-commerce, and sector rules that apply to what your site does.

6.2 You will not instruct processing that violates applicable law, and you will not configure your site to collect special-category data.

7. Deletion

7.1 What ends the processing. Deleting the venture, closing your Venturee account, the end of the 60-day wind-down after your Venturee subscription ends (7.2), or this DPA otherwise ending.

7.2 When deletion happens. There are two triggers, and both delete immediately when they fire — there is no copy held back in case you change your mind:

• You delete the venture or close your account. Binderr tears down its hosting, its repository, and its database records straight away. There is no waiting period.
• Your Venturee subscription ends (section 12.5 of the Terms). Your site is paused at the end of the paid period but stays hosted: the processing has not ended, this DPA remains in force, and for 60 days from Binderr's end-of-plan notice you can export your site's data (7.3), request its return (7.4), or resubscribe — which resumes the site with nothing lost. At the end of those 60 days the venture is deleted automatically and immediately, exactly as if you had deleted it yourself. Binderr reminds you 15 days and 5 days before that date.

Residual copies in routine infrastructure backups age out and are purged within 35 days of deletion. The only exception is the limited records Binderr must keep by law, described in section 9 of the Privacy Statement.

⚠️ Export anything you need BEFORE deletion — yours or the scheduled one. Deletion cannot be undone, and nothing is retained for you afterwards.

7.3 What you can export yourself. You can download your venture's code and documents from Venturee at any time while the venture exists. Your site's collected records — the accounts (with their contact addresses), orders, bookings, form submissions and other records your site gathered from its visitors — are available as a self-service export: Export site data in the venture's Users Monitor tab produces one file containing every record your site holds, in structured, commonly used, machine-readable formats. It works at any time the venture exists, including while the site is paused during the 60-day wind-down — that window exists precisely so you can take your data out first.

7.4 Return instead of deletion (Article 28(3)(g)). If you cannot use the export, or need something it does not cover, return is available as a manual procedure: email privacy@venturee.work from your account's email address, naming the venture, before it is deleted — by you or by the 7.2 schedule. Binderr will provide your site's hosted personal data in a structured, commonly used, machine-readable format within 30 days of verifying the request, and will delete it afterwards on your instruction. A verified request made before a scheduled 7.2 deletion suspends that deletion until the request is fulfilled — the schedule never defeats the return. A request that arrives after the venture is deleted cannot be met — the data is gone by then.

8. Contact

For any matter under this DPA — instructions, data-subject requests, breach notifications, sub-processor objections, or audit questions — contact privacy@venturee.work.

9. General

9.1 This DPA is governed by the same law and forum as the Terms of Service.

9.2 If this DPA conflicts with those Terms on the processing of your site's personal data, this DPA controls.

9.3 Nothing in this DPA limits data subjects' rights or either party's obligations under the GDPR.

Version history

Version 1.3 — current

• Guest buyers are now a named category of the personal data processed (Annex, Categories of personal data). Member sites can sell one-off purchases to visitors who never create an account; a guest order's contact and order details are the controller's site data like any other record — already within "whatever personal data your site is configured to collect", now stated in terms so the description of the processing is complete. Nothing about the processing itself changed hands: the member remains controller, Binderr processor.

Version 1.2

• The end of a Venturee subscription is now a described processing event (sections 2 and 7, rewritten). When the member's subscription ends, the site is paused but stays hosted for a 60-day wind-down during which this DPA remains in force; at its end the venture is deleted automatically and immediately — the same immediate deletion 1.1 described, on a scheduled trigger. This does not reintroduce the hold-back window 1.1 removed: nothing is retained after deletion; the 60 days run before it, while the processing genuinely continues, so the controller can export, request return, or resubscribe.
• The site's collected records now have a self-service export (section 7.3): Export site data in the venture's Users Monitor tab — every record the site holds, machine-readable, available any time including while the site is paused. Version 1.1's statement that no self-service export existed is superseded; the manual Article 28(3)(g) return (7.4) remains as the fallback, and a verified return request made before a scheduled deletion suspends that deletion until fulfilled.
• The member's new user-management tools (list users, send password reset, delete a user — section 5.6 of the Terms) are the documented-instruction channel of section 3: Binderr executes them only on the controller's action.

Version 1.1

• Said that uploaded pictures are resized before storage (section 2, Nature and purpose). Where a picture your site stores contains personal data, resizing it is processing, and Article 28(3) requires this table to describe the processing accurately. It did not mention it. Files your site sells for download are stated to be stored unchanged. Section 5.10 of the Terms sets out exactly what the resizing does.
• Corrected three references to Privacy Statement sections that did not exist under the names given — "How We Protect Data" for what is section 10 (Security), "International Transfers" for section 12, and "What we do not collect" for section 3.5. Section 3.4 is Binderr's Article 32 commitment to you, and it pointed at a section you could not find. References are now by section number.
• Rewrote section 7 to describe what deletion actually does. The previous version was circular (section 2 pointed at a window in section 7; section 7 pointed at retention periods in the Privacy Statement covering different data), and the draft that replaced it contradicted itself: delete within 30 days, and do not delete before 30 days have run. It also named a trigger that does not exist — "when you unpublish a site" — and promised that Binderr would hold your data for 30 days before deleting it. Deleting a venture removes it immediately. Nothing is held back, so section 7 now says so in terms, warns you to export first, and states plainly that your site's collected records have no self-service export and that return under Article 28(3)(g) is a manual request you must make before deleting.
• Named the sub-processors of your site's data (section 4.1). The previous version imported the whole provider table from section 8 of the Privacy Statement, which lists the providers Binderr uses to run the platform — AI generation, platform email, images. Those receive none of your site's data, and authorising them as your sub-processors described a relationship that does not exist. Three providers process your site's data: Supabase, Render, and Stripe where your site takes payments.
• Removed Binderr's stated ability to pause processing on an infringing instruction (section 3.2). Article 28(3)(h) requires Binderr to tell you; it does not give Binderr that remedy, and no such control exists in the product. The duty to inform is unchanged.
• Gave the section 2 table real column headers. It previously rendered as a grey empty band.
• Added section 3.2, Binderr's duty to immediately inform you if an instruction you give would infringe the GDPR (Article 28(3)(h)). This was absent.
• Added section 3.7, a commitment to notify you before disclosing your site's data to a public authority, to challenge unlawful or overbroad requests, and to disclose only the minimum required.
• Added section 3.5, second sentence: Binderr forwards data-subject requests it receives directly rather than answering them.
• Added section 4.2, 30 days' email notice before a sub-processor changes, with an objection window and, where no resolution is found, the right to stop publishing and end the processing. The previous version relied on you noticing an updated table on a web page.
• Added section 8, a contact point for DPA matters.
• Removed the reference to "the Beta Terms". The v1.0 note said that document did not exist; it did — it was the closed beta's clickwrap, and its section 8 incorporated this DPA, which made it the only contract members had actually accepted this DPA under. Removing the reference on that stated ground was wrong. The reference goes for a different and correct reason: the Beta Terms are retired, and everything they promised now lives in the Terms of Service (section 9.7). This DPA forms part of those Terms, so there is one agreement and no gap.
• Sections are numbered.

Version 1.0 — Initial version.

Previous versions are available on request.