Data Processing Agreement

1. Roles and scope

For personal data contained in Customer account records, user profiles, and usage history (“Customer Personal Data”), Customer is the controller and Credyx acts as processor under Article 28 GDPR. For personal data appearing in public registry records that Credyx retrieves and caches (such as director and officer names), Credyx acts as an independent controller, as described in the privacy policy; that processing is outside the processor scope of this DPA.

2. Details of processing

• Subject matter and duration: provision of the Credyx credit intelligence service for the term of the agreement.
• Nature and purpose: hosting, authentication, quota accounting, and support for Customer’s use of the platform.
• Categories of data subjects: Customer’s authorised users.
• Categories of personal data: name, work email, hashed credentials, role, activity and billing metadata. No special categories of data are processed.

3. Processor obligations

Credyx shall:

• process Customer Personal Data only on documented instructions from Customer, including with regard to international transfers, unless required otherwise by law (in which case Credyx will inform Customer unless legally prohibited);
• ensure persons authorised to process the data are bound by confidentiality obligations;
• implement the technical and organisational measures described in Section 5;
• assist Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting its obligations under Articles 32–36 GDPR;
• make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and allow for audits as set out in Section 7.

4. Subprocessors

Customer grants general authorisation for Credyx to engage the following categories of subprocessors: cloud infrastructure and database hosting; content delivery and TLS termination (Cloudflare); transactional email delivery; payment processing; and LLM inference for assessment narratives (which receives company financial context, not Customer Personal Data). Credyx will give at least 30 days’ notice of any addition or replacement, during which Customer may object on reasonable data protection grounds. A current list is available on request from [email protected]. Credyx remains fully liable for its subprocessors’ performance.

5. Security measures

• TLS encryption for all data in transit; encryption at rest for databases and backups.
• Salted password hashing; revocable, short-lived access tokens.
• Role-based access control separating administrative from standard accounts.
• Server-side rate limiting and per-account quotas on all endpoints.
• Logging of administrative and security-relevant events.

Further detail is published on the security page.

6. Personal data breaches

Credyx will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, providing the information reasonably available to allow Customer to meet its own notification obligations.

7. Audits

No more than once per year, and subject to reasonable notice and confidentiality obligations, Customer may audit Credyx’s compliance with this DPA either through written questionnaires and documentation review or, where required by a supervisory authority, an on-site inspection conducted during business hours without disrupting operations.

8. International transfers

Where processing involves a transfer of Customer Personal Data outside the EEA, the UK, or Switzerland to a country without an adequacy decision, the parties rely on the European Commission’s Standard Contractual Clauses (Module 2: controller-to-processor), which are incorporated into this DPA by reference, supplemented by the UK Addendum where UK GDPR applies.

9. Return and deletion

Upon termination of the agreement, Credyx will delete Customer Personal Data within 30 days, except where retention is required by law. Risk assessments generated for Customer remain exportable during that 30-day window. Deletion from backups occurs on the backup rotation cycle, not exceeding 90 days.

10. Precedence

In case of conflict between this DPA and the Terms of Service, this DPA prevails with respect to the processing of personal data. Questions: [email protected].