Data Processing Agreement

1. Parties

This Data Processing Agreement (“DPA”) is entered into between:

2. Scope and Purpose

Processing is carried out solely to provide the Services: authenticating access, enforcing rate limits, logging API usage for billing and abuse detection, sending transactional emails, maintaining billing-reference records, coordinating supported paid checkout processing through the RoxPay hosted payment-service-provider adapter, and providing optional AI-assisted interpretation features that summarize visible platform context (if enabled by the Controller).

The Processor provides order book analytics derived from publicly available market data across live cryptocurrency exchanges. This market data is not personal data. The legal basis for this DPA is Article 28 GDPR.

3. Types of Personal Data

The Processor processes the following categories of personal data:

The Processor does not process special categories of personal data as defined in Article 9 GDPR.

4. Categories of Data Subjects

• The Controller (individual or authorised representatives).
• The Controller's team members, if team API keys are issued.

5. Duration of Processing

Processing begins when the Controller creates an account and continues until the account is deleted. Upon deletion, data is removed per Section 13 and Annex 1.

6. Processor Obligations

The Processor agrees to the following obligations:

7. Controller Obligations

• Ensure a lawful basis exists for all processing instructed under this DPA (GDPR Article 6).
• Provide documented instructions that comply with applicable law.
• Respond promptly to breach notifications from the Processor.
• Not instruct processing that would violate the GDPR or other applicable law.

8. Sub-processors

The Controller provides general written authorisation to engage the sub-processors listed below. The Processor will provide 30 days notice before adding or replacing any sub-processor. The Controller may object in writing within the notice period.

9. International Data Transfers

Primary infrastructure is located in the EEA. Where processing requires non-EEA transfers, those transfers are covered by GDPR Chapter V safeguards, including adequacy mechanisms and/or Standard Contractual Clauses as applicable.

• UK-restricted transfers are supported with UK transfer addendum mechanisms where legally required.
• Swiss-restricted transfers are supported with Swiss transfer mechanisms where legally required.

10. Security Measures

Summary of key technical and organisational measures. Full details in Annex 2.

• Data in transit is protected with industry-standard transport encryption controls.
• Passwords are stored using strong one-way hashing controls.
• API keys stored as irreversible one-way hashes. Raw keys are not retained after issuance.
• Sensitive stored values protected with symmetric encryption.
• Services isolated into separate network zones by function.
• Tier-based rate limiting with automated anomaly detection.
• Append-only security event audit log with integrity controls.
• Automated data retention enforcement.

11. Data Breach Notification

The Processor will notify the Controller without undue delay, and within 72 hours of becoming aware of a confirmed personal data breach (GDPR Article 33(1)). Notification will include: nature of the breach, including categories and approximate number of data subjects and records affected; likely consequences of the breach; and measures taken or proposed to address the breach and mitigate its effects.

Where full information is not yet available, an initial notification will be sent and followed up as details become known.

12. Liability

Each party's liability under this DPA is subject to the limitations set out in the DepthSignal Terms of Service. Neither party limits liability for: confidentiality breaches, deliberate or grossly negligent DPA breaches, or obligations under Article 82 GDPR.

Where a party has paid compensation to a data subject for damage caused by both parties, the other party shall reimburse the portion corresponding to its share of responsibility under Article 82 GDPR.

13. Term and Termination

Upon account deletion, the Processor will delete live account, API, and usage data within 30 days, while billing records and Article 16(m) consent evidence can remain on their own legal-retention basis. Backup rotation completes within 30 days. Billing records and related financial-significance documentation tied to the customer identity are retained for 7 years under Estonian Accounting Act § 12. The Controller may export their data before deletion via GET /v1/customer/export.

14. Governing Law and Jurisdiction

This DPA is governed by the laws of Estonia. Disputes are subject to the exclusive jurisdiction of the Estonian courts, without prejudice to a data subject's right to bring proceedings under Article 79(2) GDPR in their member state of habitual residence or place of work.

15. Amendments

The Processor may amend this DPA by providing 30 days written notice. Continued use of the Services after the notice period constitutes acceptance. Material changes will be communicated by email to the Controller's registered address.

16. Severability

If any provision of this DPA is found to be invalid or unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force and effect.

Annex 1: Data Retention Schedule

Annex 2: Technical and Organisational Measures

Encryption

Access Control

Infrastructure

Annex 3: Sub-processor List

Current as of June 2026. Sub-processor additions or replacements follow the 30-day notice workflow described above.

Execution

Contact

Authoritative Legal References