Data Processing Addendum

1. Definitions and precedence

Capitalised terms have the meanings set out in the Agreement. Data protection terms such as “controller,” “processor,” “personal data,” and “data subject” have the meanings given by applicable data protection law. If this DPA conflicts with the Agreement or a negotiated DPA, the signed document controls.

2. Subject matter and nature of processing

Processing may relate to onboarding, KYC, KYB, AML screening, sanctions and PEP workflows, ongoing due diligence, enhanced due diligence, case management, audit logs, SDK/API activity, and managed operations. The actual processing scope depends on the Services selected, the customer configuration, and the final signed Agreement.

AutoKYC processes customer-service data only for documented business purposes connected with the Agreement, applicable law, service security, or customer instructions. AutoKYC does not assume responsibility for the customer’s regulatory programme, lawful basis, risk appetite, or final onboarding decisions unless the signed Agreement expressly says so.

3. Roles of the parties

The customer normally determines the purposes and means of processing for its applicants, customers, beneficial owners, and case records. AutoKYC’s role is determined by the signed Agreement. Where AutoKYC acts as a processor or sub-processor, it will process personal data according to documented instructions and applicable law. Where AutoKYC acts as a controller for website, sales, security, or business records, its Privacy Policy applies.

4. Customer responsibilities

• Determine and document lawful bases, notices, consents, and regulatory obligations for the customer use case.
• Provide accurate instructions, configuration choices, retention settings, and escalation rules.
• Review any provider, subprocessor, residency, or transfer terms included in the final contract package.
• Maintain internal compliance, legal, information security, and business continuity controls.

5. Personnel and confidentiality

AutoKYC limits access to customer-service data to personnel and authorised support resources with a business need to know, subject to confidentiality obligations and access controls appropriate to the service model. Specific staffing, analyst qualification, or managed-operation requirements apply only if included in the signed Agreement.

6. Security measures

AutoKYC uses technical and organisational measures intended to reduce risk to personal data. Depending on the service model, these measures may include encryption, access controls, logging, vulnerability management, environment separation, secure development practices, and incident response procedures.

Public security descriptions are summaries only. Binding control obligations, evidence access, audit rights, certification requirements, and service-specific exclusions must be stated in the signed Agreement.

7. Subprocessors and providers

AutoKYC may use affiliates, infrastructure services, software vendors, data sources, verification services, communications tools, managed operations resources, and professional advisers to support the Services. Specific subprocessor lists, notice periods, objection rights, pass-through terms, and remedies are provided only where required by law or agreed in the signed Agreement.

Provider names, coverage, availability, datasets, and performance characteristics are not guaranteed by this public DPA and may vary by region, contract, configuration, licensing, or customer eligibility.

8. Retention, return, and deletion

Customer-service data is retained, returned, anonymised, or deleted according to the Agreement, customer instructions, configuration, and applicable law. Any example retention period shown in public materials is illustrative unless included in the final signed Agreement.

9. Data subject requests

Where AutoKYC acts as a processor or sub-processor, it will provide reasonable assistance for data subject requests as required by applicable law and the signed Agreement. The customer remains responsible for verifying the requester, determining whether a right applies, and responding to the data subject unless the signed Agreement allocates that responsibility differently.

10. Personal data incidents

AutoKYC maintains incident response processes intended to identify, assess, contain, and communicate relevant personal data incidents. Notification timing, contents, cooperation duties, and escalation contacts are governed by applicable law and the signed Agreement.

11. International transfers

Data hosting, access locations, transfer mechanisms, regional restrictions, and residency options depend on the selected service model and final contract. Where transfer safeguards are required, they must be documented in the signed Agreement or related data transfer schedule.

12. Information and audit

Any audit, questionnaire, evidence, certification, penetration-test summary, or onsite review right is subject to the signed Agreement, confidentiality, security limitations, availability, and reasonable cost controls. Public website content is not a complete audit report or assurance statement.

13. Liability

Liability for data processing is governed by the signed Agreement. If no Agreement incorporates this DPA, this page does not create independent liability, remedies, warranties, service commitments, or third-party rights.

Annex – Illustrative processing details

Data subjects

Applicants, beneficial owners, directors, authorised signatories, customer personnel, support contacts, and managed-service users, as configured by the customer.

Personal data

Contact details, identification data, business records, document images, device metadata, consent records, workflow data, audit logs, and case notes, depending on the selected service.

Sensitive data

Biometric, identity, criminal-risk, sanctions, or similar high-sensitivity data may be processed only where enabled by customer configuration, applicable law, and the signed Agreement.

Operations

Collection, routing, review, storage, matching, case management, reporting, deletion, and export as needed for the contracted workflow.

Contact

Data protection questions can be sent to privacy@autokyc.com. Customer-specific notices must follow the notice clause and contacts stated in the signed Agreement.