Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") forms part of the subscription agreement between the customer named on the acceptance record ("Customer", the controller) and AgentTrading, reachable at [email protected] ("AgentTrading", the processor).

It applies to personal data that AgentTrading processes on behalf of Customer while providing the AgentTrading service: the email addresses of the people who hold seats on Customer's account, the identity attributes passed by Customer's single sign-on provider, the theses and analyses those people create, the account activity trail, and billing contact details.

2. Instructions

AgentTrading processes Customer personal data only to provide, secure and support the service, and on Customer's documented instructions, which are the subscription agreement, this DPA and the settings Customer makes in the service. AgentTrading tells Customer if it believes an instruction breaks applicable data protection law.

3. Confidentiality

Everyone at AgentTrading who can access Customer personal data is bound by a duty of confidentiality and has access only as far as their work requires.

4. Security

AgentTrading keeps the technical and organisational measures described on agenttrading.ai/security, including encryption in transit, private access links stored only as one way hashes, single sign-on secrets encrypted at rest, server side role checks on every request, and an append only activity trail. AgentTrading may improve these measures but will not reduce the overall level of protection during the term.

5. Sub-processors

Customer authorises AgentTrading to engage sub-processors in these categories: cloud hosting, payment processing, transactional email delivery, and market data supply (which receives ticker symbols only, never personal data).

AgentTrading binds every sub-processor to data protection terms no less protective than this DPA and remains responsible for them. The current list of sub-processors is provided on request to [email protected], and AgentTrading gives at least 30 days notice by email before adding or replacing one, during which Customer may object and, if the objection cannot be resolved, cancel the affected subscription.

6. Data subject requests

Taking into account the nature of the processing, AgentTrading helps Customer answer requests from individuals to access, correct, export or erase their personal data. Team admins can export the full trail of the account to CSV at any time and switch any seat off from the team page.

7. Personal data breaches

AgentTrading notifies Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer personal data, with the information Customer needs to meet its own obligations.

8. Assistance and audits

AgentTrading provides the information reasonably needed to demonstrate compliance with this DPA, including written answers to Customer's security questionnaire, and assists with data protection impact assessments where the processing requires one.

9. International transfers

The service is hosted in the United States. Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (module two, controller to processor) and the UK addendum, which are incorporated into this DPA by reference.

10. Return and deletion

When the subscription ends, Customer may export its trail. When Customer asks in writing to [email protected] after the subscription ends, AgentTrading deletes or anonymises Customer personal data and confirms it in writing, except where the law requires AgentTrading to keep it (for example invoices and payment records).

11. Order of precedence

If this DPA conflicts with the subscription agreement on the processing of personal data, this DPA prevails.