This Data Processing Agreement ("DPA") is between the Customer (the controller) and Topify Consulting Ltd (the processor). It forms part of the Terms of Service and meets the requirements of Article 28(3) of Regulation (EU) 2016/679 (GDPR) and the Cyprus Law 125(I)/2018. It applies automatically when the Customer accepts the Terms. A signed copy is available on request.
1. Subject-matter, duration, nature and purpose
Subject-matter: providing the Services described in the Terms. Duration: the term of the Terms plus the deletion period in clause 10. Nature: storage, hosting, transmission, retrieval, screening against third-party data sources, automated document and website analysis, and deletion. Purpose: only to provide the Services to the Customer and as otherwise instructed by the Customer in writing.
2. Types of personal data and categories of data subjects
| Service | Data subjects | Types of data |
|---|---|---|
| Vault | The Customer's clients, counterparties, staff and other persons in case files | Any data in uploaded files and records, which may include identity documents, contact details, financial and legal information and, where the Customer chooses to upload them, special categories of data and data about criminal convictions. Files are end-to-end encrypted and cannot be read by the processor. |
| Client portal | The Customer's clients | Name, email, sign-in records, uploaded documents (encrypted) |
| AML & Sanctions | Persons and companies screened by the Customer | Name, date of birth, nationality, document number, ID document images, phone, email, wallet address, address documents, screening results |
| GDPR Compliance (ComplyGuard) | Persons named in submitted documents or websites | Any data contained in documents, which are processed in memory and deleted immediately after the check; short text excerpts kept as evidence in reports |
| All Services | The Customer's Users | Names, emails, roles, activity logs, IP addresses |
3. Processing only on documented instructions
The processor processes personal data only on the documented instructions of the controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case it informs the controller of that legal requirement before processing, unless the law prohibits this. The Terms, this DPA and the Customer's use and configuration of the Services are the controller's instructions. The processor immediately informs the controller if, in its opinion, an instruction infringes the GDPR or other data protection law.
4. Confidentiality
The processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and access it only as needed to provide the Services.
5. Security (Article 32)
The processor implements the technical and organisational measures in Annex 2, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, and the risks to data subjects. It may update the measures provided the overall level of security is not reduced.
6. Sub-processors
- The controller gives general written authorisation for the processor to engage the sub-processors listed in Annex 1.
- The processor informs the controller of any intended addition or replacement at least 30 days in advance by email or in the Platform. The controller may object on reasonable data protection grounds within that period; if the parties cannot agree, the controller may terminate the affected Service and receive a pro-rata refund of fees paid in advance.
- The processor imposes on each sub-processor, by contract, the same data protection obligations as in this DPA, in particular sufficient guarantees of appropriate security measures, and remains fully liable to the controller for the sub-processor's performance.
7. Assistance with data subject rights
Taking into account the nature of the processing, the processor assists the controller by appropriate technical and organisational measures, insofar as possible, to fulfil requests from data subjects under Chapter III GDPR. Most requests can be handled directly by the Customer in the Services (for example by finding, exporting or deleting files and records). If the processor receives a request directly, it forwards it to the controller without undue delay and does not respond itself except to confirm the forwarding.
8. Assistance with security, breaches, DPIAs and consultation
The processor assists the controller in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to it, including by providing information for data protection impact assessments and prior consultation with the supervisory authority.
Personal data breaches
The processor notifies the controller without undue delay and in any event within 24 hours after becoming aware of a personal data breach affecting the controller's data. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases. The processor documents every breach and supports the controller in meeting its 72-hour notification duty under Article 33 GDPR.
9. International transfers
The processor hosts the Platform in the European Union. It transfers personal data to a third country only in accordance with Chapter V GDPR, on the basis of an adequacy decision or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3 for processor-to-processor transfers) with supplementary measures where needed. Data sent to the AI research sub-processor is masked and approved by a lawyer before it is sent.
10. Deletion or return at the end of the Services
At the choice of the controller, the processor deletes or returns all personal data after the end of the provision of the Services and deletes existing copies, unless Union or Member State law requires storage. The controller can export data itself in the Services for 30 days after termination; the processor then deletes the remaining data within a further 60 days, including from backups in their normal rotation.
11. Audits and information
The processor makes available to the controller all information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the controller or an independent auditor mandated by it. Audits are carried out with at least 30 days' notice, during business hours, no more than once a year unless required by a supervisory authority or after a breach, under confidentiality, and at the controller's cost. The processor may first answer by providing documentation and written answers.
12. Liability and precedence
Liability under this DPA is subject to the limits in the Terms, except where Article 82 GDPR or other law does not allow a limitation. If this DPA conflicts with the Terms, this DPA prevails for matters of data protection.
Annex 1: Sub-processors
| Sub-processor | Purpose | Location and safeguard |
|---|---|---|
| OVHcloud (OVH SAS, France) | Server hosting of the Platform and all stored data | European Union |
| Our email service provider | Delivery of sign-in codes, invitations and reminders | European Union |
| Didit | AML, sanctions, PEP, adverse media, ID document, wallet, phone, email and proof-of-address checks | As set out in Didit's terms; Standard Contractual Clauses where data leaves the EEA |
| Anthropic | AI research of similar cases, on masked text approved by a lawyer | United States; Standard Contractual Clauses |
Annex 2: Technical and organisational measures
- Encryption: HTTPS (TLS 1.2 or higher) for all traffic; Vault files encrypted end to end in the browser with AES-256-GCM, file keys wrapped with each user's RSA-OAEP 3072-bit key, private keys protected by a passphrase (PBKDF2-SHA256, 600,000 iterations); authenticator secrets encrypted at rest.
- Access control: two-step sign-in for every user; rights assigned per user by the Customer's administrator; locked folders require a fresh one-time code; automatic sign-out after 10 minutes of inactivity; least-privilege server administration with key-based SSH only.
- Logging: activity log of sign-ins and file actions available to the Customer; security logs on the server.
- Attack protection: rate limiting, automatic blocking of IP addresses after repeated failed sign-ins (application, SSH and web server), firewall allowing only required ports, strict Content Security Policy, CSRF protection, file-type checks by content and refusal of files with macros.
- Integrity and availability: automatic security updates, rootkit and integrity scanning, encrypted backups, containerised services restarted automatically on failure.
- Data minimisation: ComplyGuard documents processed in memory and not stored; screening details masked on screen after 60 minutes; AI research only on masked text.
- Organisation: confidentiality commitments, documented incident response, vulnerability disclosure policy, and regular review of these measures.
Topify Consulting Ltd, registration no. HE 409159, VAT no. 10409159B, Alkyonis 1, 3087 Limassol, Cyprus. Contact: info@cyprusconnect.net. If a translation of this document differs from the English version, the English version applies.