1. Subject matter and duration
We process personal data on behalf of the Customer for the purpose of providing the ComplianceSuite Platform and related services, for the duration of the Order, plus a transition period where required.
2. Nature, purpose and types of personal data
- Categories of data subjects: Customer's end-customers, beneficial owners, directors, agents, employees and any other natural persons whose data the Customer chooses to process via the Platform.
- Categories of personal data: identification data, contact data, government identifiers, transactional data, screening results, risk scores, audit-trail metadata, device and IP data.
- Special-category data: only where the Customer chooses to upload it (e.g. biometric data via the KYC module). The Customer is solely responsible for the lawful basis.
3. Controller instructions
We process personal data only on documented instructions from the Customer, including the configuration of the Platform, unless required to do otherwise by applicable law (in which case we will inform the Customer in advance unless prohibited by that law).
4. Confidentiality
All personnel authorised to process personal data are bound by written confidentiality undertakings and receive annual data-protection training.
5. Security measures (Annex II)
- ISO/IEC 27001 certified information-security management system.
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Role-based access control with least privilege and quarterly access reviews.
- Multi-factor authentication for all administrative access.
- Centralised logging, SIEM monitoring and 24x7 incident response.
- Vulnerability management with monthly scans and annual third-party penetration testing.
- Secure SDLC including peer review, SAST, dependency scanning and segregated environments.
- Backup and disaster-recovery aligned with ISO 22301; documented RTO/RPO.
- Physical security inherited from EU-located, ISO 27001 / SOC 2 certified data-centre providers.
6. Sub-processors (Annex III)
We engage vetted sub-processors to help deliver the Platform and maintain contractual data-protection terms with each, providing protections no less protective than this DPA. An up-to-date list of authorised sub-processors is available to Customers on request from the Data Protection Officer (see section 14). We will give the Customer at least 30 days' prior notice of any new or replacement sub-processor and provide a reasonable mechanism to object.
7. International transfers
Where personal data is transferred across borders to a country without an adequacy decision (or equivalent recognition) by the originating jurisdiction, the parties rely on an appropriate transfer mechanism — including, as applicable, the EU Standard Contractual Clauses (Module 2 or 3), the UK International Data Transfer Addendum, the Swiss FADP addendum, Canadian comparable-protection contracts under PIPEDA, US state contractual safeguards, and the standard contracts issued under the UAE and Saudi PDPLs — supplemented by the technical and organisational measures set out in Annex II.
8. Data subject rights
Taking into account the nature of the processing, we will assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligations to respond to data subject (or "consumer") requests under applicable data protection laws, including access, rectification, deletion, portability, and opt-out rights.
9. Personal data breach notification
We will notify the Customer without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Data, providing the information reasonably required to meet the Customer's notification obligations under applicable law (e.g. Article 33(3) GDPR, PIPEDA breach reporting, US state breach-notification statutes, and equivalent regimes).
10. DPIA & prior consultation
We will provide reasonable assistance to the Customer with any data-protection impact assessments and prior consultations with supervisory authorities, taking into account the information available to us.
11. Audits
The Customer may, on reasonable notice and not more than once per year, audit our compliance with this DPA. Audits will normally be satisfied by the provision of our most recent ISO 27001 certificate, SOC 2 report (where applicable) and penetration-test summary.
12. Return or deletion of data
Within 30 days of termination of the Order, we will, at the Customer's election, return or securely delete all Customer Data, save where retention is required by applicable law.
13. Liability & precedence
Liability arising out of this DPA is subject to the limitations set out in the underlying agreement. In the event of a conflict, this DPA prevails with respect to the processing of personal data.
14. Contact — Data Protection Officer
Infocredit Group Ltd · Data Protection Officer
- Address: Philippou Hadjigeorgiou 5A, Acropolis, Nicosia 2006, Cyprus
- Telephone: +357 22 398 000
- Email: dpo@infocreditgroup.com
Working hours: Monday – Thursday 08:30–17:30 · Friday 08:30–14:30 (EET).