This is a working template prepared for review by qualified counsel in the United States, India, the United Kingdom and the European Union. It is not yet in force and creates no rights or obligations until a final version is published.
- For business customers (API, adviser workspace, white-label) who give us personal data to process on their behalf.
- We process it only on your instructions, keep it confidential and secure, and help you meet your obligations.
- We tell you about new sub-processors 30 days in advance and about personal-data breaches without undue delay.
- International transfers use the EU SCCs, the UK Addendum or IDTA, and DPDP-compliant arrangements.
The summary helps you navigate; the sections below are the document.
1Parties, roles and precedence
This Data Processing Addendum (“DPA”) forms part of the agreement between the customer (“Customer”) and AlgoNexus (“Processor”) for the services described in the order form. For Customer Personal Data, Customer is the controller (or data fiduciary) and AlgoNexus is the processor (or data processor / service provider). Where this DPA conflicts with the agreement on data protection, this DPA prevails; the Standard Contractual Clauses prevail over both.
2Processing on instructions
- AlgoNexus processes Customer Personal Data only on Customer’s documented instructions, including those in the agreement and Annex I, unless required by law (in which case it informs Customer first unless prohibited).
- AlgoNexus will tell Customer if, in its opinion, an instruction infringes data-protection law.
- AlgoNexus will not use Customer Personal Data to train models made available to other customers.
3Confidentiality and personnel
Persons authorised to process Customer Personal Data are bound by confidentiality, receive data-protection training, and have access only as needed for their role. Access is logged.
4Security
AlgoNexus implements the technical and organisational measures in Annex II, appropriate to the risk, and reviews them at least annually.
5Sub-processors
- Customer gives general authorisation for the sub-processors on our sub-processors page.
- We give at least 30 days’ notice of a new sub-processor (by email to subscribers of the page). Customer may object on reasonable data-protection grounds; if we cannot accommodate the objection, Customer may terminate the affected service and receive a refund of prepaid fees.
- We impose data-protection terms on each sub-processor at least as protective as this DPA and remain liable for their performance.
6Assistance
Taking into account the nature of processing, AlgoNexus assists Customer with data-subject or data-principal requests, security, breach notification, data-protection impact assessments and prior consultation with regulators.
7Personal-data breaches
AlgoNexus notifies Customer without undue delay, and in any event within 48 hours, after becoming aware of a breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own notification duties (including the 72-hour GDPR timeline and CERT-In and DPDP Board reporting in India), and keeps Customer updated.
8Return and deletion
On termination, AlgoNexus deletes or returns Customer Personal Data at Customer’s choice within 30 days, and deletes copies within 90 days from backups, unless the law requires retention, in which case the data stays protected and is used for no other purpose.
9Audits
AlgoNexus makes available its current third-party audit reports and certifications (for example SOC 2 Type II and ISO/IEC 27001, when obtained) and answers reasonable security questionnaires. Where these do not suffice, Customer may conduct an audit once a year on 30 days’ notice, at its cost, subject to confidentiality.
10International transfers
- EEA: Module 2 (or Module 3) of the Standard Contractual Clauses (Commission Decision 2021/914) are incorporated by reference; Annexes I and II of this DPA complete them. Governing law and forum: [EU member state].
- UK: the UK International Data Transfer Addendum to the SCCs applies.
- Switzerland: the SCCs apply as amended for the Swiss FADP.
- India: transfers comply with the DPDP Act and any country restrictions notified under it.
11US state privacy lawsUS
Where AlgoNexus is a “service provider” or “processor” under the CCPA/CPRA or another state law, it will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in the agreement, or combine it with other data except as permitted. It will comply with the applicable law, provide the same level of protection, and notify Customer if it can no longer meet its obligations.
12Annex I — Details of processing
| Subject matter | Provision of AlgoNexus APIs, adviser workspace or white-label services |
| Duration | Term of the agreement plus the deletion period |
| Nature and purpose | Hosting, analysis, generating research and proposals, reporting, support |
| Data subjects | Customer’s end users, clients and staff |
| Categories of data | Identifiers, contact details, portfolio and transaction data, risk profile, usage logs |
| Special categories | None intended; Customer must not send them |
13Annex II — Technical and organisational measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256); keys in a managed KMS with rotation.
- Single sign-on with phishing-resistant MFA for staff; least privilege; quarterly access reviews; time-boxed, logged support access.
- Network segmentation, default-deny network policies, Web Application Firewall, DDoS protection.
- Secure SDLC: code review, dependency and container scanning, signed builds, SBOMs, secrets scanning.
- Logging and monitoring with alerting; tamper-evident audit log; incident-response plan tested annually.
- Backups encrypted and restore-tested; business-continuity and disaster-recovery plans.
- Independent penetration tests at least annually and a public vulnerability-disclosure programme.
- Vendor risk assessments for all sub-processors.
14Execution and contact
To execute a countersigned copy, email legal@algonexus.trade. Data-protection contact: dpo@algonexus.trade.