Data Processing Addendum

Data Processing Addendum

Last Updated March 17, 2026

Effective Date March 31, 2026

On this page

• Data Processing AddendumIntroduction
• Definitions
• General; Termination
• Relationship of the Parties
• Compliance with Law
• Role and Scope of the Processing
• Subprocessing
• Security
• Audits and Reviews of Compliance
• Impact Assessments and Consultations
• Data Subject Requests
• Return or Deletion of Customer Data
• International Provisions
• Schedule 1Purpose
• Activities
• Duration
• Data Subjects
• Personal Data
• Sensitive Data
• Schedule 2Pseudonymization
• Confidentiality
• Restoration
• Testing
• Identification
• Transmission
• Storage
• Physical Security
• Event Logging
• System Configuration
• Governance
• Certifications
• Minimization
• Data Quality
• Data Retention
• Accountability
• Portability
• Subprocessors
• Schedule 3Definitions
• UK IDTA
• SCCs
• Modules
• Conflicts
• Schedule 4California
• EEA
• Switzerland
• UK
• Australia
• Canada
• Schedule 5Table 1
• Table 2
• Table 3
• Table 4
• Mandatory Clauses

1. Introduction

This Data Processing Addendum ("Addendum") forms part of Vercel Enterprise Terms and Conditions or other agreement executed between Vercel and Customer for Vercel's provision of Services on an Enterprise plan (the "Agreement") as of the effective date of such Agreement ("Effective Date") and is by and between Vercel Inc., a Delaware corporation ("Vercel"), and the Customer that executed the Agreement. This Addendum applies to Vercel's Processing of Personal Data as a Processor under the Agreement for Customers who are on Enterprise and Pro plans.

Customer enters into this Addendum on behalf of itself and, to the extent required under applicable Data Protection Laws and Regulations, in the name and on behalf of its Affiliates to the extent such Affiliates are included and covered under the Agreement with Vercel. For the purposes of this Addendum only, and except where indicated otherwise, the term "Customer" shall include Customer and Affiliates.

This Addendum shall become legally binding upon Customer entering into the Agreement or upon execution of this Addendum.

2. Definitions

Any terms used in this Addendum and not defined will have the meanings given to them in the applicable Agreement.

• "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control" for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interest of the subject entity.

• "Applicable Data Protection Laws" means all applicable privacy and data protection laws and regulations and in each case, as amended, superseded, or replaced from time to time, including, without limitation, the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"); the United Kingdom Data Protection Act 2018; the California Consumer Privacy Act of 2018 ("CCPA"); the Canadian Personal Information Protection and Electronic Documents Act ("PIPEDA"); and the Australian Privacy Principles and the Australian Privacy Act (1988).

• "Contact Data" means the Personal Data that Vercel Processes as a controller, such as account information, payment information, and event attendee information.

• "Controller" will have the following meaning (as applicable): (a) the meaning given to "controller" under Applicable Data Protection Laws; or (b) the meaning given to "business" under Applicable Data Protection Laws.