Data Processing Addendum

1. What this is, and why it exists

This Addendum forms part of the Terms of Service between you and MARTMINT LTD (company number 17373502, 20 Wenlock Road, London, England, N1 7GU). Accepting the Terms accepts this. You do not need to sign anything separately.

It exists because Article 28 of the UK GDPR requires a written contract wherever one organisation processes personal data on another's behalf, setting out specific terms. It applies whenever we process personal data relating to your customers.

Where this Addendum and the Terms of Service conflict on the processing of your customers' personal data, this Addendum wins. On everything else, the Terms win.

2. Who is who

Your own account data — your name, email, billing details and how you use the dashboard — is different. We are the controller of that, and our Privacy Policy governs it. This Addendum does not cover it.

3. What we process, and for how long

4. We act only on your instructions

We process your customers' personal data only on your documented instructions, including on international transfers, unless the law requires otherwise. Where the law compels us, we will tell you first unless we are legally barred from doing so.

Your instructions are: the Terms of Service, this Addendum, the configuration choices you make in the dashboard, and anything else you tell us in writing. Switching on a feature is an instruction to process the data that feature needs.

If we believe an instruction breaches data protection law, we will tell you and may pause that processing until it is resolved.

We will not sell your customers' data, will not use it to market to your customers on our own behalf, and will not use it to build products for anyone else. We do use aggregated and anonymised statistics about platform usage — figures from which no individual can be identified — to operate and improve the service.

5. Confidentiality

Everyone we authorise to process your customers' data is bound by a duty of confidentiality, is given access only where their role requires it, and loses that access when the role ends.

6. Security

We apply appropriate technical and organisational measures, including:

• encryption of data in transit, and of credentials and access tokens at rest;
• passwords stored hashed, never in a readable form;
• each merchant's data isolated at the database layer, so one store cannot read another's;
• role-based access control, with staff permissions set by you;
• an audit trail of administrative actions, recording who did what and from where;
• financial records held in an append-only store, so they cannot be quietly altered after the fact;
• regular backups, and the ability to restore service after an incident;
• payment card details collected by our payment provider and never stored on our servers.

We review these measures as the platform changes. We may improve them, and will not reduce them in a way that materially weakens the protection of your customers' data.

7. Sub-processors

You give us general authorisation to engage sub-processors. Each is bound by written terms no less protective than this Addendum, and we remain fully liable to you for what they do.

The current list is published in section 4 of our Privacy Policy and is part of this Addendum by reference. It names, among others, Amazon Web Services, Cloudflare, Stripe, Whish Money, Brevo, Groq, Google, OpenAI, Meta Platforms, TikTok and Sentry.

We will give you at least 30 days' notice before adding or replacing a sub-processor. If you have a reasonable objection on data protection grounds, tell us within that period and we will work with you to find an alternative. If we cannot, you may terminate the affected service without penalty for the remainder of your paid period.

8. Helping you meet your obligations

Taking account of what we know and what we can see, we will help you with:

• responding to a customer exercising their rights — access, correction, erasure, restriction, portability or objection;
• keeping your processing secure under Article 32;
• notifying the ICO and affected individuals after a personal data breach;
• carrying out a data protection impact assessment, and consulting the ICO where one is needed.

Most rights requests you can handle yourself from the dashboard, which is deliberate — you should not have to wait on us to answer your own customer. Where you cannot, email [email protected] and we will help within a timeframe that lets you meet your own deadline.

If a customer contacts us directly about data in your store, we will not respond on your behalf. We will tell them to contact you, and tell you it happened.

9. Personal data breaches

If we become aware of a personal data breach affecting your customers' data, we will notify you without undue delay and in any event within 48 hours of becoming aware of it.

The notice will describe what happened, the categories and approximate number of people and records involved so far as we know them, the likely consequences, what we are doing about it, and a contact point. Where we do not have everything at once, we will send what we have and follow up rather than wait.

Reporting to the ICO within 72 hours, and telling affected individuals where that is required, is your decision as controller — you are the one who must make it. We will give you what you need to make it.

10. Return and deletion

You can export your data at any time while your account is active.

When your account ends, we keep your customers' data for 30 days so you can request an export, then delete or anonymise it. You can ask us to delete it sooner and we will.

Two exceptions, and only two. Payment, invoice and revenue records are kept for six years because UK tax and company law require it — those records are held append-only and cannot be altered. Backups are deleted on their normal rotation rather than individually, and remain protected by this Addendum until they are.

11. Audits

We will make available the information reasonably needed to show we are meeting this Addendum, and will allow and contribute to audits, including inspections, carried out by you or an auditor you appoint.

In practice: ask us first and we will answer in writing, which resolves nearly every case. Where that is genuinely not enough, an on-site or remote audit takes place on at least 30 days' notice, during business hours, no more than once a year unless a breach or a regulator makes it necessary, and without disrupting other merchants. Your auditor must not be a competitor of ours and must sign a confidentiality agreement. You cover the cost unless the audit finds a material breach on our side, in which case we do.

12. International transfers

Your customers' data is hosted in the European Economic Area. Some sub-processors are outside the UK, mainly in the EEA and the United States.

Where we transfer personal data out of the UK we rely on UK adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with whatever additional safeguards the transfer needs. You authorise us to enter into those clauses with sub-processors on your behalf.

13. Liability, and how this ends

The limitations of liability in the Terms of Service apply to this Addendum, except where the law does not permit them to.

This Addendum lasts as long as we process your customers' data, and the obligations that by their nature should survive termination — confidentiality, deletion, and the duty to tell you about a breach — do survive it.

We may update this Addendum where the law changes or our processing does. Material changes carry at least 30 days' notice, and the version and effective date at the top of this page tell you which version you are reading.

14. Contact

Data protection enquiries, rights requests you need help with, and audit requests: [email protected]. MARTMINT LTD, 20 Wenlock Road, London, England, N1 7GU.

The English text of this Addendum is the only version that governs; any translation is provided for convenience.