Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Y-COMMERCIAL TECHNOLOGIES LIMITED t/a HedgePoint ™ (the "Processor") and the customer organisation (the "Controller") for the provision of the HedgePoint platform.

This DPA sets out the terms on which we process personal data on your behalf in compliance with the UK GDPR and the Data Protection Act 2018.

• Personal Data: Any information relating to an identified or identifiable natural person as defined in GDPR Article 4(1)
• Processing: Any operation performed on personal data, including collection, recording, storage, retrieval, and deletion
• Sub-processor: A third party engaged by us to process personal data on your behalf
• Data Subject: The individual whose personal data is being processed

• Process personal data only on documented instructions from the Controller
• Ensure personnel with access to personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist the Controller in responding to data subject rights requests
• Notify the Controller without undue delay upon becoming aware of a personal data breach
• Delete or return all personal data upon termination of the agreement
• Make available all information necessary to demonstrate compliance with GDPR obligations

We implement the following technical and organisational measures:

• AES-256 encryption at rest and TLS 1.3 in transit
• Tenant-level data isolation in our multi-tenant architecture
• Role-based access controls with principle of least privilege
• Comprehensive audit logging of all data access and modifications
• Regular security assessments and penetration testing
• Automated backup with encrypted off-site storage
• Incident response procedures with defined escalation paths

We use the following sub-processors. We will notify you before adding or replacing any sub-processor and give you the opportunity to object.

Where personal data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), or other approved transfer mechanisms. All sub-processors listed above operate under such safeguards.

In the event of a personal data breach, we will notify the Controller without undue delay and no later than 48 hours after becoming aware of the breach. The notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken to address the breach.

For DPA-related inquiries, contact our Data Protection Officer at info@hedgepoint.app.