Data Processing Agreement

“Applicable Data Protection Law” — Regulation (EU) 2016/679 (the “GDPR”), Regulation 2018/1725 (where applicable), national laws implementing or supplementing the GDPR (including the Estonian Personal Data Protection Act), the UK General Data Protection Regulation and the UK Data Protection Act 2018 (where the Controller is established in the United Kingdom), and any successor, supplementing or replacement legislation, in each case as amended from time to time.

“User Personal Data” — the personal data processed by the Processor on behalf of the Controller in connection with the Principal Agreement, as further described in Annex 1.

“Standard Contractual Clauses” or “SCCs” — the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.

“UK Addendum” — the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner and laid before Parliament on 2 February 2022.

“Sub-processor” — any third party engaged by the Processor to process User Personal Data on behalf of the Controller.

2.1. As between the Parties, the Controller is the controller and the Processor is the processor in respect of User Personal Data processed in connection with the Principal Agreement.

2.2. In respect of certain processing activities relating to the BIN Sponsorship Chain - including regulatory reporting, fraud monitoring, sanctions screening, scheme compliance, AML compliance and dispute handling - the Processor and/or entities forming part of the BIN Sponsorship Chain may act as controllers in their own right.

2.3. Each Party is responsible for its own compliance with Applicable Data Protection Law.

3.1. The subject matter, nature, purpose, duration of processing, types of personal data and categories of data subjects are set out in Annex 1.

3.2. The Processor shall process User Personal Data only on documented instructions from the Controller, as set out in the Principal Agreement, in this DPA, or as otherwise agreed in writing, save where required to do so by Union or Member State law.

3.3. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law.

6.1. The Controller grants the Processor a general written authorisation to engage Sub-processors. Current Sub-processors are listed in Annex 3.

6.2. The Processor shall notify the Controller of any intended addition or replacement of Sub-processors no less than fifteen (15) calendar days before such change takes effect. The Controller may object within ten (10) calendar days on reasonable data protection grounds.

6.3. The Processor shall enter into a written agreement with each Sub-processor on terms providing protection no less than those set out in this DPA.

6.4. The Processor shall remain fully liable for the performance of each Sub-processor's obligations.

6.5. The Controller acknowledges that the identity of entities forming part of the BIN Sponsorship Chain is confidential. The Processor shall abstractly identify categories of such entities and describe the nature of their processing in Annex 1.

7.1. The Processor shall assist the Controller in fulfilling its obligations to respond to data subject requests under Chapter III GDPR.

7.2. If the Processor receives a request directly from a data subject, it shall promptly forward the request to the Controller and shall not respond directly save to confirm receipt, unless authorised or required by law.

8.1. The Processor shall notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting User Personal Data.

8.2. Such notification shall include the information described in Article 33(3) GDPR to the extent then known.

8.3. The Processor shall cooperate with the Controller in investigation, mitigation and remediation of the breach.

9.1. The Controller acknowledges that User Personal Data will be transferred to entities forming part of the BIN Sponsorship Chain, including entities located outside the EEA, UK and Switzerland.

9.2. Where the Processor transfers User Personal Data to a Sub-processor in a third country without an adequacy decision, the Processor shall ensure an appropriate transfer mechanism is in place, including SCCs or the UK Addendum as applicable.

9.3. Where required, the Parties enter into the Standard Contractual Clauses (Module Two: Controller to Processor) by reference, governed by the laws of Estonia with jurisdiction in the courts of Estonia.

10.1. The Processor shall make available information reasonably necessary to demonstrate compliance with Article 28 GDPR, on reasonable written request and not more than once per calendar year (save in case of a personal data breach).

10.2. Such information may take the form of certifications under recognised standards, summaries of third-party audit reports, or responses to a written questionnaire.

10.3. Where such information is insufficient, the Controller may conduct an audit on not less than thirty (30) days' written notice, at the Controller's expense, during normal business hours and in a manner not unreasonably interfering with the Processor's operations.

11.1. Upon termination of the Principal Agreement, the Processor shall, at the choice of the Controller (communicated within thirty (30) days of termination), delete or return all User Personal Data and delete existing copies, save where retention is required by applicable law or scheme rules.

11.2. Failing any choice within thirty (30) days, the Processor may delete the User Personal Data.

11.3. The Processor shall confirm deletion in writing upon request.

13.1. This DPA enters into force on the Effective Date and remains in force for so long as the Processor processes User Personal Data on behalf of the Controller.

13.2. Clauses 5(b), 8, 11 and 12 survive termination of this DPA.

14.1. Updates. The Processor may amend this DPA by publishing a new version at https://payca.vc/dpa, with not less than fifteen (15) calendar days' notice of material amendments.

14.2. Severability. If any provision is held invalid or unenforceable, the remaining provisions continue in full force.

14.3. Governing law. This DPA is governed by the laws of the Republic of Estonia. Disputes shall be submitted to the exclusive jurisdiction of the Harju County Court.