This agreement governs personal data processing carried out by Verdera agency on a customer’s behalf. It sets out instructions, confidentiality and security obligations, the use of subprocessors, and the return or deletion of data when the service ends.
Parties and subject matter
The customer acts as controller and VERDERA, marketinške in digitalne storitve, Patricia Jarmek s.p. as processor when processing on the customer's behalf for agreed services or Verdera Marketing Suite. Verdera agency's own controller processing is outside this agreement.
Instructions and confidentiality
Processing follows documented instructions, including transfers, unless legally required otherwise. Authorised personnel are bound by confidentiality. The processor informs the controller of instructions it considers contrary to data protection law.
Security and assistance
The processor implements appropriate Article 32 GDPR measures and assists, according to the processing's nature, with rights, security, breaches, impact assessments and prior consultation. Breaches are notified without undue delay.
The security incident contact is suite@verdera.agency for VMS and info@verdera.agency for other services.
Subprocessors and transfers
Subprocessors require prior specific or general written authorisation and equivalent obligations. General authorisation requires notice of changes and an opportunity to object.
We notify the controller at least 30 calendar days before adding or replacing a subprocessor. During that period, the controller may submit a reasoned data protection objection to the stated service contact. We seek to resolve the objection before the affected processing starts. If this is not possible, the controller may end the affected part of the service.
End of processing and accountability
At the end, data and copies are returned or deleted at the controller's choice unless retention is legally required. The processor provides compliance information and permits audits under Article 28 GDPR.
Annex — processing description and organisation
The customer is identified by the order or separate contract. Processing covers the agreed marketing services and VMS functions: storage, organisation, review, analysis, export and deletion under customer instructions. It lasts during the service and the period needed for agreed return or deletion.
Categories include identification and business contacts, user accounts, permissions, project inputs and integration data within the customer’s authorisations.
Data subjects may include authorised users, employees, contractors and customer contacts, and visitors to connected digital channels to the extent their data is transferred.
Special-category data is not intended for input. Security measures comprise role-based access restrictions and periodic reviews, credential protection, secure transmission, project and permission separation, confidentiality, backups and incident and deletion procedures. Details applicable to the contracted processing are available to the controller on request. A provider’s certification is not itself Verdera agency’s certification.
For VMS the subprocessor is Lovable Cloud with infrastructure and AI providers listed at https://trust.lovable.dev/subprocessors. Domenca (Webtasy, d.o.o.) provides website and email services. Other providers are engaged only for the processing actually agreed and with appropriate authorisation. Stripe and Wise are not automatically project-data subprocessors when acting for their own payment and statutory purposes.
After access ends, project data is returned or deleted as instructed within 30 days, except statutory retention or a separate documented agreement.
Backups are isolated from ordinary use and removed under the applicable cycle. Deletion instructions are reapplied after restoration. On request, we confirm return or deletion and identify remaining legal exceptions.
Ljubljana, 1 October 2026.
