ModuVend Data Processing Agreement (DPA)

Effective Date: 8th July 2025

This Data Processing Agreement (“Agreement”) is entered into between ModuVend Ltd, a company registered in the United Kingdom (“Processor”), and the client (“Controller”) using ModuVend’s services, including its website, vending platform, and associated systems.

This Agreement forms part of any existing service contract or commercial agreement between ModuVend and the Controller (the “Main Agreement”).

⸻

1. Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person processed by ModuVend on behalf of the Controller.
  • Processing: Any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.
  • Applicable Law: The UK GDPR, EU GDPR (where applicable), Data Protection Act 2018, and any other laws governing privacy and data protection.
  • Sub-Processor: Any third party appointed by ModuVend to process data on its behalf.

⸻

2. Subject Matter and Duration

This Agreement governs the Processing of Personal Data by ModuVend on behalf of the Controller for the duration of the Main Agreement or until all Personal Data is deleted or returned.

⸻

3. Scope and Purpose

ModuVend shall process Personal Data only:

  • For the purpose of fulfilling services under the Main Agreement (e.g. campaign performance, shopper engagement metrics, CRM data)
  • In accordance with the Controller’s documented instructions
  • In compliance with Applicable Law⠀

⸻

4. Responsibilities of the Controller

The Controller represents and warrants that:

  • It has the legal right to share Personal Data with ModuVend
  • All required data subject consents have been obtained (where applicable)
  • Instructions provided to ModuVend are lawful and compliant

⸻

5. Obligations of ModuVend (Processor)

ModuVend agrees to:

  • Process Personal Data only on documented instructions from the Controller
  • Ensure staff with access to Personal Data are bound by confidentiality
  • Implement appropriate technical and organisational security measures (aligned with ISO 27001 and HubSpot infrastructure standards)
  • Assist the Controller in responding to Data Subject Access Requests (DSARs), data breach notifications, and DPIAs
  • Notify the Controller without undue delay in the event of a personal data breach
  • Provide necessary documentation to demonstrate compliance upon request⠀

⸻

6. Sub-Processing

ModuVend uses trusted Sub-Processors for infrastructure and service delivery, including:

  • HubSpot (CRM and web forms)
  • Amazon Web Services (AWS) (hosting)
  • Google Cloud / Typeform / analytics tools (survey and reporting integrations)

A full list of Sub-Processors is available [here] or upon written request. ModuVend ensures all Sub-Processors provide equivalent data protection obligations.

⸻

7. Data Transfers

Where Personal Data is transferred outside the UK or EEA, ModuVend ensures such transfers are lawful through:

  • Standard Contractual Clauses (SCCs)
  • UK International Data Transfer Addendum
  • Adequacy decisions, where applicable

⸻

8. Return or Deletion of Data

Upon termination of the Main Agreement or upon request, ModuVend shall:

  • Return all Personal Data to the Controller, or
  • Permanently delete such data from all systems, unless otherwise required by law

⸻

9. Audits and Inspections

ModuVend shall make available relevant documentation to demonstrate compliance and allow for reasonable audits or inspections by the Controller or an appointed auditor, subject to confidentiality and scheduling terms.

⸻

10. Liability

Liability under this DPA shall be governed by the Main Agreement. Nothing in this Agreement limits the rights of data subjects under applicable law.

⸻

11. Governing Law

This Agreement shall be governed by the laws of England and Wales, and any disputes shall be subject to the exclusive jurisdiction of the courts located therein.

⸻

12. Contact

Questions regarding this DPA should be directed to:

 

ModuVend Limited

71-75 Shelton Street
Covent Garden
London
WC2H 9JQ

Email: info@moduvend.com

⸻

Signature

This Agreement is effective upon acceptance of the Main Agreement or upon first use of the ModuVend platform.

⸻