Amana
Sign inStart free

Data processing agreement

This agreement is part of the Terms of service between Vereon Ltd ("Vereon", "we", "us") and the company that uses Amana ("you"). It applies whenever you put personal data into Amana, or Amana collects it for you, and it sets out the terms Article 28 of the UK GDPR requires. If it conflicts with the Terms on data protection, this agreement wins. Last updated 13 October 2026.

Words such as "controller", "processor", "personal data", "processing" and "personal data breach" mean what they mean in the UK GDPR and the Data Protection Act 2018.

1. Who's who

  • You are the controller of the personal data in your company's Amana account ("your data").
  • We are your processor. Vereon Ltd is a UK company, number 17096763, with its registered office at Flat 2408 Swan Street House, 70 Swan Street, Manchester, M4 5GQ, England.
  • If you use Amana for data you process for someone else, we're your sub-processor and this agreement applies in the same way. You're responsible for passing on what your own controller needs to know.

What we process, why, for how long, and about whom is set out in Annex 1. In short: we process your data to provide the Amana CRM, for as long as your subscription lasts (including any free trial) and for the 30 days after it ends until the data is deleted.

2. Your instructions

  • We process your data only on your documented instructions, including about sending it outside the UK. Your use of Amana and the settings you choose are those instructions, as are any you give us in writing.
  • If the law requires us to process your data in some other way, we'll tell you before we do, unless the law forbids telling you.
  • We'll tell you straight away if we think an instruction breaks data protection law.
  • We don't use your data for our own purposes, sell it, or use it for advertising.

3. Confidentiality

Everyone at Vereon who can reach your data is bound to keep it confidential, and only reaches it when that's needed to run, support or secure Amana.

4. Security

We take the measures Article 32 of the UK GDPR requires, as listed in Annex 2. We may change them as technology moves on, but never in a way that lowers the overall level of protection.

5. Sub-processors

  • You give us general written authorisation to use sub-processors. The current ones are listed on our sub-processors page.
  • We give account owners at least 30 days' notice by email before we add or replace a sub-processor. You can object on reasonable data protection grounds within that time. We'll try to resolve it with you; if we can't, you may end your subscription before the change takes effect.
  • Each sub-processor is bound by a written contract with the same data protection obligations as this agreement. We remain responsible to you for what they do.

6. Helping with people's requests

Amana lets you answer requests from the people in your records yourself: you can export what's held about a person, erase a person (everything about them, straight away), mark them as not to be emailed or texted, and keep them on a suppression list so they aren't contacted again after being erased or re-imported. Replies of STOP to a text are honoured automatically.

If someone asks us directly about data you hold, we'll pass the request to you without undue delay and won't answer it ourselves unless you ask us to. Where the product isn't enough, we'll help you answer, as far as we reasonably can.

7. Helping with your other obligations

Taking into account how Amana works and the information we have, we'll help you meet your obligations under Articles 32 to 36 of the UK GDPR: security, telling the ICO and people about a breach, data protection impact assessments, and consulting the ICO before high-risk processing.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we'll tell your account owners without undue delay, and in any case within 48 hours. We'll tell you, as far as we know it:

  • what happened, including the kinds of data and the approximate number of people and records affected;
  • who to contact at Vereon for more information;
  • the likely consequences;
  • what we've done or plan to do about it, including to reduce any harm.

If we don't know everything at once, we'll tell you what we know and follow up as we learn more. You decide whether to tell the ICO and the people affected; we won't do it for you unless you ask. Telling you about a breach isn't an admission of fault.

9. When your account closes

  • While your account is open, you can export your data at any time from Settings.
  • An account closes when its free trial ends unpaid or its subscription is cancelled. Owners can still export for the 30 days after that, and get a warning email a week before the end.
  • Within 30 days of closure we delete all your data, unless the law requires us to keep it. Database backups are overwritten within 8 days (MongoDB Atlas keeps one a day for the last 8 days); until then they stay encrypted and are used only to recover from a failure.

10. Audits and information

  • We'll give you the information you reasonably need to show that we meet this agreement, and answer reasonable security and data protection questionnaires.
  • If that isn't enough, you or an auditor you appoint may audit us on reasonable notice, at your cost, and no more than once a year, unless a regulator requires it or after a personal data breach affecting your data.
  • Auditors must keep what they learn confidential, and audits are arranged so they don't disrupt the service or expose other customers' data. For our sub-processors, we rely on their own independent audit reports.

11. International transfers

Your data is stored in the UK and Ireland. Some sub-processors are outside the UK, or may handle data outside it; the sub-processors page says which. We transfer personal data outside the UK only with one of these safeguards, and you authorise those transfers:

  • UK adequacy regulations, which cover the EU and EEA;
  • the UK–US data bridge, for US companies certified under it;
  • otherwise, the ICO's International Data Transfer Agreement, or its Addendum to the EU standard contractual clauses.

12. Your responsibilities

You're responsible for having a lawful basis for the personal data you put into Amana and for telling people how you use it, for getting consent where the law needs it (for example for marketing emails and texts, call recording or email tracking), and for making sure your instructions are lawful.

13. Liability, law and term

Each side's liability under this agreement is subject to the limits and exclusions in the Terms. This agreement lasts as long as we process your data. It's governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Questions about it: engineering@vereon.tech.

Annex 1: details of the processing

  • Subject matter: providing Amana, a customer relationship manager, to you.
  • Duration: the term of your subscription, including any free trial, plus up to 30 days after your account closes, until your data is deleted.
  • Nature and purpose: storing, organising, searching, showing and reporting on your records; syncing email and calendars; sending and receiving email, texts and WhatsApp messages; making and receiving calls, and recording them when you turn recording on; collecting web form submissions and ad leads; sending quotes; running your automations; importing, exporting and deleting data. All as you direct, to provide the service to you.
  • Types of personal data: contact details (names, job titles, organisations, email addresses, phone numbers, postal addresses); the content of emails, calendar events, texts, WhatsApp messages and calls; call recordings, when enabled; notes, tasks, deals, quotes and files; web form submissions, with the IP address they came from; ad lead answers; and email open and click events, when tracking is enabled. For your own users: names, work email addresses, job titles, roles and activity.
  • Special category data: Amana isn't designed for it. If you put any in (in a note, say), you're responsible for having a lawful condition for it.
  • Data subjects: your prospects, customers and other contacts, and the people who work for them; and your own users.
  • Frequency: continuous, while you use Amana.
  • Retention: as you choose while your account is open, then as described in section 9. The fixed periods for logs and history are in our privacy notice.
  • Sub-processors: as listed on our sub-processors page.

Annex 2: technical and organisational measures

  • Certification: Vereon is certified under Cyber Essentials, the UK government-backed scheme for protecting against common cyber attacks.
  • Encryption: all data is encrypted in transit (TLS 1.2 or later) and at rest, on AWS and on MongoDB Atlas. Mailbox passwords and access tokens for connected services are encrypted again, with AES-256-GCM, before they're stored.
  • Where data lives: AWS in London (eu-west-2) for the application, files and email; MongoDB Atlas on AWS in Ireland (eu-west-1) for the database. File storage is private, blocks public access, and refuses unencrypted connections; files open only through short-lived signed links.
  • Access: two-factor sign-in is available to every user, and a company can require it. Each person sees and does only what their role allows; View only users see conversations as headlines, without what was said. API keys are stored only as fingerprints.
  • Our staff: only the people at Vereon who need it to run and support Amana can reach production systems, each with their own sign-in and two-factor authentication, and each bound by confidentiality.
  • Connections: webhooks Amana receives are checked by signature, webhooks it sends are signed, and addresses it calls out to are checked so they can't reach internal systems.
  • Logging: an audit log of sensitive actions (exports, deletions, people, roles, keys and security settings), kept 12 months; server logs, kept 14 days.
  • Erasure: deleting a person removes everything about them, in the database and in file storage, straight away; a suppression list keeps only a one-way fingerprint of the address or number of people who opted out or asked to be forgotten.
  • Resilience: the application runs on managed AWS services spread across several data centres in London, and the database is backed up by MongoDB Atlas.
  • Changes: changes to Amana pass automated tests before they're deployed.
  • Incidents and review: we follow a written breach procedure, and review these measures at least once a year.