Knowledge Vault VIP
    VIP

    🧩 Data Processing Agreement (DPA)

    Last Updated: October 2025

    Effective for: https://knowledgevault.vip

    Operated by: Exponential Ventures EOOD, Varna, Bulgaria

    1. Parties to the Agreement

    This Data Processing Agreement (“Agreement”) is entered into between:

    (1) Data Controller:

    Exponential Ventures EOOD

    Hristo Smirneski 76, Block A ET 4 APP 29, 9000 Varna, Bulgaria

    Email: success@theexponentialcoach.com

    Company Registration No: 207440584

    and

    (2) Data Processors:

    Third-party service providers engaged by the Controller to process personal data on its behalf, including but not limited to:

    • OrangeHost (web hosting and email services)
    • Stripe Payments Europe Ltd. (payment processing)
    • PayPal (Europe) S.à r.l. et Cie, S.C.A. (payment processing)
    • Any other sub-processors explicitly authorized by the Controller.

    Each individually referred to as a “Party” and collectively as the “Parties.”

    2. Subject and Duration

    2.1 This Agreement governs the processing of personal data by the Processor on behalf of the Controller in connection with the operation of the website KnowledgeVault.vip.

    2.2 The processing shall commence upon use of the relevant service and remain in effect for as long as the Processor provides services to the Controller.

    2.3 Upon termination of this Agreement, the Processor shall delete or return all personal data as directed by the Controller, except where retention is required by law.

    3. Nature and Purpose of Processing

    The Processor shall process personal data solely for the following purposes:

    • Hosting, operation, and maintenance of the KnowledgeVault.vip website;
    • Processing online payments and transaction data;
    • Managing customer accounts, orders, and digital product access;
    • Providing analytics or technical support services where applicable.

    Processing shall be limited to the minimum extent necessary to fulfil these purposes.

    4. Type of Personal Data and Categories of Data Subjects

    4.1 Categories of Data Subjects:

    • Website visitors
    • Registered users or customers
    • Prospective clients submitting inquiries

    4.2 Types of Personal Data:

    • Contact details (name, email, address)
    • Payment information (via Stripe/PayPal)
    • Technical data (IP addresses, browser information, cookies)
    • Purchase and usage data for digital content

    No sensitive (“special category”) data under Article 9 GDPR is processed.

    5. Obligations of the Controller

    The Controller shall:

    • Ensure that all personal data provided to the Processor has been collected lawfully and in compliance with GDPR;
    • Define clear, documented instructions for data processing;
    • Respond to data subject requests and exercise of rights;
    • Maintain a record of processing activities under Article 30(1) GDPR.

    6. Obligations of the Processor

    The Processor agrees to:

    6.1 Process personal data only on documented instructions from the Controller;

    6.2 Ensure that employees and sub-contractors are bound by confidentiality obligations;

    6.3 Implement appropriate technical and organizational security measures (Article 32 GDPR);

    6.4 Assist the Controller in responding to requests for exercising data subject rights;

    6.5 Notify the Controller without undue delay after becoming aware of a personal data breach;

    6.6 Maintain a record of processing activities under Article 30(2) GDPR;

    6.7 Cooperate with supervisory authorities when required.

    7. Security of Processing

    The Processor shall adopt all measures required under Article 32 GDPR, including:

    • Encryption and pseudonymization where applicable;
    • Regular system monitoring and backups;
    • Restricted access control;
    • Secure data transmission (SSL/TLS);
    • Periodic testing of data protection procedures.

    8. Sub-Processing

    8.1 The Processor may engage sub-processors only with prior authorization from the Controller.

    8.2 The Processor shall ensure that sub-processors are bound by the same data protection obligations as set forth in this Agreement.

    8.3 A list of approved sub-processors includes:

    • OrangeHost (Hosting Provider)
    • Stripe (Payment Gateway)
    • PayPal (Payment Gateway)

    The Processor remains fully liable for the actions of its sub-processors.

    9. Data Breach Notification

    In the event of a personal data breach, the Processor shall:

    • Notify the Controller immediately and no later than 48 hours after discovery;
    • Provide all information necessary for the Controller to meet its notification obligations under Articles 33 and 34 GDPR;
    • Take reasonable steps to mitigate any adverse effects of the breach.

    10. Data Subject Requests

    If a data subject contacts the Processor directly to exercise rights (access, rectification, deletion, etc.), the Processor shall:

    • Promptly forward the request to the Controller;
    • Refrain from responding directly without the Controller’s consent.

    The Controller remains responsible for fulfilling such requests.

    11. Audit and Inspection Rights

    11.1 The Controller reserves the right to conduct audits or inspections to verify the Processor’s compliance with this Agreement.

    11.2 The Processor shall provide reasonable assistance and access to relevant documentation, provided that such inspections respect confidentiality and data security.

    12. Confidentiality

    The Processor shall treat all personal data and related information as strictly confidential and ensure that all persons authorized to process such data are subject to confidentiality obligations.

    13. Termination

    Upon termination of services, the Processor shall:

    • Delete all personal data unless retention is legally required;
    • Provide written confirmation of data deletion or return;
    • Maintain confidentiality obligations beyond the termination date.

    14. Liability

    Both Parties shall be liable for damages arising from breaches of this Agreement or applicable data protection laws, in accordance with Articles 82–84 GDPR.

    15. Governing Law and Jurisdiction

    This Agreement shall be governed by the laws of the Republic of Bulgaria.

    Any disputes shall be resolved by the competent courts of Varna, Bulgaria.

    16. Entire Agreement

    This DPA constitutes the entire agreement between the Parties concerning data processing and supersedes any previous agreements or arrangements relating to the same subject matter.

    An Exponential Coach creation.

    Two decades, 1,500 leaders, one shared mission: growth.

    ← All legal pages