1. Scope and Legal Relationship

Pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR) and the UK GDPR, this DPA applies to all processing of Personal Data conducted by Diliguard (“Processor”) on behalf of the subscriber or enterprise client (“Controller”) across diliguard.com, portal.diliguard.com, Developer APIs, and MCP server integrations.

2. Categories of Data Subjects and Personal Data

The categories of data subjects and types of personal data processed under this agreement include:

• Data Subjects: Corporate directors, beneficial owners (UBOs), individual sole traders, transaction counterparties, and officers submitted by the Controller for statutory risk screening.
• Personal Data Categories: Full legal names, dates of birth, nationalities, corporate filing numbers, registered addresses, politically exposed person (PEP) status, sanctions matches, adverse media citations, and public blockchain wallet addresses.

3. Processor Obligations and Confidentiality

The Processor covenants and agrees to:

• Documented Instructions: Process Personal Data strictly on documented instructions from the Controller to execute requested due diligence scans and return structured intelligence reports.
• Zero AI Model Training: Never use Controller search parameters, uploaded evidence, or output reports to train machine learning models or enrich public databases.
• Strict Confidentiality: Ensure that all employees, contractors, and agents authorized to process Personal Data are bound by strict contractual and statutory confidentiality obligations.

4. Technical and Organizational Measures (TOMs)

The Processor implements and maintains the following security standards:

• HttpOnly Cookie Isolation: Session authentication tokens are stored in HttpOnly cookies inaccessible to browser JavaScript, completely preventing Cross-Site Scripting (XSS) session hijacking.
• Firewalled Backend Proxy Pattern: Database ports are strictly firewalled from the public internet. All client interactions route through authenticated internal server proxies.
• Encryption: All data in transit is encrypted using TLS 1.3 protocols. All stored database records and report caches are encrypted at rest using AES-256 standard encryption.
• Access Controls & Auditability: Strict role-based access control (RBAC), multi-factor authentication, and immutable cryptographic audit logging for all database queries.

5. Sub-Processors and International Transfers

The Controller provides general written authorization for the Processor to engage sub-processors for infrastructure and billing services (such as EU/UK cloud host nodes and Stripe for payment processing). The Processor shall notify the Controller at least 30 days prior to engaging any new sub-processor. International data transfers are governed by European Commission Standard Contractual Clauses (SCCs).

6. Data Retention, Deletion, and Security Incident SLA

In compliance with GDPR Article 5(1)(e), the Processor automatically anonymizes search targets and scan artifacts in accordance with the Controller’s configured retention schedule. In the event of a confirmed security incident affecting Controller Personal Data, the Processor shall notify the Controller within 72 hours in accordance with GDPR Article 33 obligations.