Data Processing Agreement
The Article 28 terms governing personal data that OnchainSuite processes on behalf of customers, including the technical and organisational measures we apply.
1. Parties and role
This Data Processing Agreement (“DPA”) forms part of the Terms of Servicebetween the Customer (the “Controller”) and OnchainSuite Ltd(the “Processor”). It applies where OnchainSuite processes personal data on the Customer’s behalf. Where there is a conflict on data protection matters, this DPA prevails.
2. Definitions
“UK GDPR”, “controller”, “processor”, “personal data”, “processing”, “data subject”, and “personal data breach” have the meanings in the UK GDPR and the Data Protection Act 2018. “Applicable Data Protection Law” means the UK GDPR, the DPA 2018, and, where relevant, the EU GDPR.
3. Processing on documented instructions
OnchainSuite processes personal data only on the Customer’s documented instructions (including as set out in the Terms and this DPA), unless required by law, in which case we will inform the Customer unless legally prohibited. We will tell the Customer if, in our opinion, an instruction infringes Applicable Data Protection Law.
The Customer configures and operates the platform itself. The Customer’s configuration and use of the platform’s features constitutes its documented instructions to us, and the Customer determines which end users are messaged, on what basis, and with what content, within the platform’s capabilities.
The platform does not require or ingest the Customer’s internal customer records, CRM data, or contact databases. It processes public on-chain activity, contact identifiers that end users have opted in to provide, and engagement events generated by the service itself.
4. Details of processing (Annex 1)
The processing below applies to the OnchainSuite platform. Concierge is an optional service, and where the Customer purchases or is provided Concierge under a written statement of work, whether paid or pro bono, the additional processing described in the second table also applies for the duration of that engagement.
Platform
| Subject matter | Provision of the OnchainSuite behaviour-triggered retention platform. |
|---|---|
| Duration | For the term of the Terms, plus the deletion/return period in section 9. |
| Nature & purpose | Reading and normalising public on-chain activity; storing engagement events; triggering and delivering in-app and email messages on the Customer’s behalf. |
| Types of personal data | Wallet/public addresses and on-chain activity; opt-in contact identifiers (e.g. email); engagement events (opens, clicks, in-app interactions); segment membership. No special category data is required or intended. |
| Categories of data subjects | The Customer’s end users and wallet holders. |
Concierge (optional)
| Nature & purpose | Named OnchainSuite personnel work within the Customer’s account to plan, build, and operate lifecycle and email programmes on the Customer’s behalf. |
|---|---|
| Personnel | Access is limited to the individuals named in the statement of work, granted for the term of the engagement, and revoked on completion. |
| Types of personal data | As above, plus any personal data the Customer chooses to make available to us for the engagement. |
| Duration | The term of the statement of work. |
5. Confidentiality and access
Outside of Concierge, no OnchainSuite employee or contractor is authorised to access, use, or alter the personal data a Customer processes through the platform. The platform is self-serve and the Customer operates it.
Access to personal data is granted only:
- to the named personnel assigned to a Concierge engagement, for the term of that engagement, revoked on completion;
- to technical personnel at the Customer’s request, to investigate or resolve an issue the Customer has raised, for as long as is needed to resolve it; and
- where strictly necessary to maintain the security or integrity of the service, limited to the minimum necessary and logged.
Every person who may access personal data is bound by a duty of confidentiality, by contract or by statute, that continues after their engagement with us ends.
6. Security
Taking account of the state of the art and the risk, we implement the technical and organisational measures set out in Annex 2 below, and may update them provided protection is not materially reduced.
7. Sub-processors
The Customer gives general authorisation for OnchainSuite to engage sub-processors to provide the service. A current list is maintained on our Sub-processorspage. We impose data protection obligations on each sub-processor that are no less protective than this DPA and remain responsible for their performance. We will give at least 30 days’ notice of new sub-processors (via the Sub-processors page or email), during which the Customer may object on reasonable data protection grounds.
8. Assistance to the Controller
- We assist the Customer, by appropriate measures, to respond to data subject requests (access, rectification, erasure, restriction, portability, objection).
- We assist with the Customer’s obligations on security, breach notification, data protection impact assessments, and prior consultation (Articles 32–36), taking account of the information available to us.
- We notify the Customer without undue delay after becoming aware of a personal data breach affecting their data, with the information reasonably available to help them meet their notification duties.
9. Return or deletion
On termination, the Customer may elect within 30 days to have the personal data returned in a commonly used format or deleted. If the Customer makes no election within that window, we delete it. Deletion from live systems completes within 90 days of termination. Where applicable law requires us to retain personal data, we retain only what the law requires, for only as long as it requires, and it remains subject to this DPA while we hold it. We will confirm deletion in writing on request.
Where we have held working copies of personal data for a Concierge engagement outside the platform, we delete them on completion of that engagement.
10. Audits
We make available information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, by the Customer or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency. We may satisfy audit requests by providing third-party reports or certifications where available.
11. International transfers
Any transfer of personal data outside the UK is made under an approved transfer mechanism as described on our International Data Transfers page, which forms part of this DPA.
12. Liability & governing law
Each party’s liability under this DPA is subject to the limitations in the Terms. This DPA is governed by the laws of England and Wales.
Annex 2, Technical and organisational measures
- Encryption, personal data encrypted in transit (TLS) and at rest.
- Access control, role-based, least-privilege access; unique credentials; multi-factor authentication for administrative access; prompt revocation on role change.
- Non-custodial, read-only chain access, we never custody assets and never initiate or sign transactions; on-chain access is read-only.
- Pseudonymisation & data minimisation, we collect and link contact identifiers only on opt-in and only what is needed for the service.
- Network & application security, segregation, hardened infrastructure, secrets management, dependency and vulnerability management.
- Logging & monitoring, audit logging of administrative access and security-relevant events.
- Resilience, backups, recovery procedures, and tested business continuity.
- Vendor management, due diligence and data protection terms with sub-processors.
- Personnel, confidentiality undertakings and security awareness training.
- Breach response, documented incident response and notification process.