Data Processing Agreement

1.Parties and scope

This DPA is between [Customer legal name], of [address], registered under number [number] (the “Customer”, the controller), and Ryntra, [legal name, address and registration completed on signature] (“Ryntra”, the processor).

It applies to the personal data Ryntra processes on the Customer’s behalf in providing the Service (“Customer Personal Data”), described in Annex 1. Terms defined in the GDPR — personal data, processing, controller, processor, data subject, personal data breach and supervisory authority — have the same meaning here. “GDPR” means Regulation (EU) 2016/679 and, where it applies, the UK GDPR and the UK Data Protection Act 2018.

2.Processing on instructions

Ryntra processes Customer Personal Data only on the Customer’s documented instructions — the Terms of Service, this DPA, and the Customer’s use and configuration of the Service — including with regard to transfers to third countries, unless the law to which Ryntra is subject requires otherwise; in that case Ryntra tells the Customer before processing, unless that law forbids it. Ryntra tells the Customer if, in its opinion, an instruction infringes data protection law.

The Customer is responsible for the lawfulness of the processing and of its instructions, for having a legal basis for the personal data it keeps in the Service, and for informing the people concerned — including its recipients and payers — as Articles 13 and 14 of the GDPR require.

3.Confidentiality

Ryntra ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality. Access to the systems that hold Customer Personal Data is limited to the people who operate the Service — today, its founder.

4.Security

Ryntra implements the technical and organisational measures in Annex 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to the people concerned (Article 32 of the GDPR). Ryntra may change the measures, provided the overall level of security does not fall.

5.Sub-processors

The Customer gives Ryntra general authorisation to engage the sub-processors listed in Annex 3. Ryntra announces an intended addition or replacement on this page at least 14 days before it takes effect; within that period the Customer may object on reasonable data protection grounds, and if the objection cannot be resolved, the Customer may stop using the Service. Ryntra imposes on each sub-processor data protection obligations that give at least the protection of this DPA, and remains responsible to the Customer for their performance.

6.Requests from the people concerned

Taking into account the nature of the processing, Ryntra assists the Customer, by appropriate technical and organisational measures, in answering requests from people exercising their rights under the GDPR. If Ryntra receives such a request about Customer Personal Data directly, it passes it to the Customer without undue delay and does not answer it itself, except to confirm that it has been passed on.

7.Assistance

Taking into account the nature of the processing and the information available to it, Ryntra assists the Customer in meeting its obligations under Articles 32 to 36 of the GDPR — security, the notification of personal data breaches, data protection impact assessments and prior consultation.

8.Personal data breaches

Ryntra notifies the Customer without undue delay — and, where feasible, within 48 hours — after becoming aware of a personal data breach affecting Customer Personal Data, and gives the information the Customer reasonably needs to meet its own obligations as it becomes available. Ryntra takes reasonable steps to contain the breach and to limit its effects. A notification is not an admission of fault.

9.Deletion and return

When the Service ends, or when the Customer asks, Ryntra deletes or returns Customer Personal Data, as the Customer chooses, and deletes existing copies unless the law requires Ryntra to keep them. Copies in the database provider’s backups expire on the provider’s schedule (Annex 2).

Data written to the Arc network — amounts, addresses and transaction hashes — is public and permanent; neither party can delete it. A receipt already sealed stays verifiable by its reference unless the Customer asks Ryntra to withdraw it.

10.Information and audits

Ryntra makes available to the Customer the information needed to demonstrate compliance with Article 28 of the GDPR, and allows for and contributes to audits, including inspections, by the Customer or an auditor it mandates. The Customer gives at least 30 days’ notice and bears its own costs; an audit takes place during business hours, no more than once a year unless a supervisory authority requires it or a personal data breach has occurred, and under confidentiality. Ryntra may answer first with written information and with its open-source code where that is enough.

11.International transfers

Ryntra and its sub-processors process Customer Personal Data outside the European Economic Area and the United Kingdom, including in the United States (Annex 3). Where a transfer is not covered by an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA — Module Two (controller to processor), or Module Three (processor to processor) where the Customer is itself a processor — with: clause 7 (the docking clause) included; option 2 of clause 9(a), with the notice period in section 5 of this DPA; the optional wording in clause 11(a) left out; under clause 13, the supervisory authority competent for the Customer; and under clauses 17 and 18, the law and the courts of Ireland. For transfers governed by the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies in addition. For onward transfers, Ryntra relies on a sub-processor’s certification under the EU–US Data Privacy Framework or on standard contractual clauses with it.

12.Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where the law or the Standard Contractual Clauses do not allow it. Where this DPA conflicts with the Terms, this DPA prevails on the processing of Customer Personal Data; where the Standard Contractual Clauses conflict with this DPA, the Clauses prevail.

13.Term

This DPA lasts for as long as Ryntra processes Customer Personal Data for the Customer, and ends when that data has been deleted or returned under section 9.

14.Signatures

15.Annex 1 — Description of the processing

16.Annex 2 — Technical and organisational measures

• No keys and no funds. Ryntra holds no private keys and no standing permission over any wallet, and no customer funds pass through its addresses; every operation is signed in the customer’s own wallet.
• Encryption in transit. The site, the app and the APIs are served over HTTPS only, with HTTP Strict Transport Security; the connection to the database uses verified TLS.
• Sign-in without secrets. A wallet proves who it is by signing a message; the Service never receives a password or a key. The session token lives in a cookie that is HttpOnly, Secure and SameSite=Strict and is sent only to the Service’s own APIs.
• Separation. Arc Mainnet runs on its own deployment and database, apart from Ryntra’s other products.
• Data minimisation. Signing in asks for no name, email or phone number, and the Service has no fields for bank details, tax numbers or identity documents.
• Screening before signing. Addresses are checked against the OFAC list’s digital currency addresses — locally, without sending them anywhere — and against the USDC blocklist before an operation is prepared.
• Integrity of records. Each receipt carries seals — SHA-256 hashes — that anyone can recompute; the verifier is open source.
• Operator switch. The operator can close the preparation of new operations on Arc Mainnet.
• Abuse limits. The Service’s APIs are rate-limited; the IP address used for the limit is held in memory only.
• Browser protections. A Content Security Policy limits the site’s connections to its own origin, frames are refused, and no referrer is sent to other sites.
• Access. Production systems are reachable only by the people who operate the Service — today, its founder — with two-factor authentication on the hosting account.
• Backups. The database provider’s point-in-time restore, within the window its plan provides.

Sign-in, in particular: a single-use challenge valid for 5 minutes, and a session of up to 7 days that the server keeps only as a hash.

17.Annex 3 — Sub-processors

18.Contact

Questions and notices under this DPA: hello@ryntra.io.