Data Processing Addendum

01Roles

The Customer is the controller. TRUDO TECHNOLOGIES LTD is the processor. Where the Customer is itself a processor for another controller, TRUDO TECHNOLOGIES LTD is a sub-processor and this Addendum applies as if references to controller were to that other controller.

02Subject matter, duration, nature and purpose

Subject matter: provision of the BrokerOS platform. Duration: the term of the subscription, plus the deletion period in the final section.

Nature and purpose: reading the Customer's trading platform, payment providers, ticketing and ledger; joining those records into a graph; identifying findings; preparing and, within limits the Customer sets, carrying out actions in the Customer's systems.

03Categories of data subject and personal data

Data subjects: the Customer's clients and prospective clients, the Customer's introducing partners, and the Customer's own staff who use the Platform.

Personal data: identity and contact details; identity verification documents and their expiry; account, trading and position records; deposits, withdrawals and payment metadata; support tickets and correspondence; partner and rebate records; and audit records of actions taken.

Special category data is not required by the Platform. The Customer should not instruct processing of special category data, and if identity documents disclose such data incidentally, it is processed only as part of the document record and for no separate purpose.

04Instructions

We process personal data only on the Customer's documented instructions, which comprise this Addendum, the agreement, the configuration the Customer sets in the Platform, and any further written instruction.

We tell the Customer if, in our opinion, an instruction infringes applicable data protection law. We are not obliged to carry out such an instruction.

Where we are required by law to process beyond the Customer's instructions, we inform the Customer of that requirement before processing, unless the law prohibits informing them.

05Confidentiality and personnel

Personnel authorised to process personal data are bound by confidentiality obligations, receive data protection training appropriate to their role, and are granted access on a least privilege basis for only as long as they need it.

06Security

We implement appropriate technical and organisational measures, taking account of the state of the art, the cost of implementation, and the risk to data subjects. These include encryption in transit and at rest, least privilege and scoped access, separation of Customer environments, separation of the Customer's own entities from one another, logging of every read and every action with the data relied on at the time, and tested restoration procedures.

Access to Customer systems is read only except for actions the Customer has configured. Movement of money to a counterparty always requires a named approver and cannot be configured to happen autonomously.

07Sub-processors

The Customer gives general authorisation for the engagement of sub-processors. The current list and its categories are published on the Sub-processors page.

We give at least thirty days notice before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period, in which case the parties will work in good faith to find an alternative, and if none is available the Customer may terminate the affected part of the service without penalty for the remainder of the term.

We impose data protection obligations on every sub-processor that are no less protective than those in this Addendum, and we remain fully liable to the Customer for their performance.

08Artificial intelligence and model providers

Where the Platform uses a third party model provider, that provider is engaged as a sub-processor and appears on the Sub-processors page.

We do not permit Customer personal data to be used to train a model provider's foundation models, and we contract for zero retention or the shortest retention the provider offers. Learning inside the Platform operates on the Customer's own data, within the Customer's environment, for that Customer only.

09International transfers

Where personal data protected by the UK or EU GDPR is transferred to TRUDO TECHNOLOGIES LTD in the Republic of Seychelles, or onward to a sub-processor in a country without an adequacy decision, the transfer is made under Standard Contractual Clauses, incorporated into this Addendum by reference, with the UK Addendum applied where UK data is transferred.

A transfer risk assessment is maintained and supplementary measures are applied where the assessment requires them. Data residency can be pinned per entity, and where it is, it is recorded in the order form.

10Assistance to the Customer

We assist the Customer, by appropriate technical and organisational measures and insofar as possible, in responding to requests from data subjects exercising their rights. Where a request reaches us directly, we do not answer it ourselves; we refer it to the Customer promptly.

We assist the Customer with data protection impact assessments and prior consultation with a supervisory authority, taking into account the nature of processing and the information available to us.

11Personal data breach

We notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data, and in any event in time to allow the Customer to meet its own notification deadlines.

The notification describes the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, and the measures taken or proposed. We provide further information as the investigation progresses, and we do not notify a supervisory authority or data subjects on the Customer's behalf unless the Customer instructs us to.

12Audit

We make available the information necessary to demonstrate compliance with this Addendum, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.

Audits are on reasonable notice, during business hours, no more than once in any twelve month period except where required by a supervisory authority or following a breach, and subject to confidentiality. Where available, an independent audit report or certification may be provided in satisfaction of an audit request.

13Return and deletion

On termination, and at the Customer's election, we return the Customer's personal data in a structured, commonly used format, or delete it.

Deletion is completed within thirty days of the end of the term or of the Customer's instruction, whichever is later, except where retention is required by law, in which case the data is retained only for that purpose and for that period and remains protected by this Addendum.

14Precedence

In the event of conflict between this Addendum and the agreement, this Addendum prevails in respect of the processing of personal data.