Data Processing Agreement

1.Parties

This Data Processing Agreement (“DPA”) forms part of the Bullion API Terms of Service between you (the Controller) and Bullion API (the Processor, “we”, “us”). It applies whenever you use Bullion API under a paid plan that includes this DPA (currently the Business tier) or when you have otherwise agreed to it. Where this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.

2.Definitions

Capitalised terms have the meaning given in the UK GDPR, except:

• “Personal Data”, “Processing”, “Controller”, “Processor”, “Sub-processor” and “Data Subject” have the meanings given in Article 4 UK GDPR.
• “UK GDPR” means the United Kingdom General Data Protection Regulation as defined in section 3(10) (and supplemented by section 205(4)) of the Data Protection Act 2018.
• “Services” means the Bullion API platform, API endpoints, and associated dashboard, provided to you under the Terms.

3.Scope and roles

You are the Controller of Personal Data you submit to the Services (account details, support correspondence, billing metadata). We are the Processor, processing that Personal Data on your documented instructions to provide, secure and bill the Services. This DPA covers all processing carried out by us under the Terms. The duration of processing, the nature and purpose, the types of Personal Data, and the categories of Data Subjects are described in the sections below.

4.Categories of Personal Data and Data Subjects

• Categories of Personal Data: name, email address, hashed password, hashed API keys, request metadata (timestamp, endpoint, method, status and response time), separate session IP addresses and user agents, billing references, support correspondence, and the portfolio transaction records you enter (transaction dates, quantities and units, amounts paid or received, delivery costs, fees, product descriptions and declared tax treatment).
• Categories of Data Subjects: your end-users who sign up to your account or contact support, and your named billing and technical contacts.

5.Purposes and instructions

We process Personal Data only for the purposes of (a) providing and authenticating the Services; (b) billing, invoicing and tax accounting; (c) enforcing per-plan quotas and detecting abuse; (d) diagnosing outages; (e) responding to support requests you send us; and (f) complying with legal obligations. We will not process Personal Data for our own purposes, train third-party models on it, or use it for advertising. You give us documented instructions by using the Services; any additional instruction must be agreed in writing.

6.Authorised sub-processors

These providers and recipients support the service. Before entrusting Personal Data to a sub-processor, we require appropriate written data-protection terms. Independent-controller processing, including some Stripe activities, is governed by that provider's own terms.

7.Security measures (Article 32 UK GDPR)

• TLS 1.2+ in transit on every endpoint.
• At-rest encryption for Cloudflare D1 storage and retained recovery snapshots.
• API keys stored as SHA-256 hashes; plaintext shown once at creation only.
• Worker secrets for third-party credentials, never committed to source.
• Least-privilege access for personnel, logged and reviewed.
• Regular backup verification and recovery testing of the production database.
• An up-to-date vulnerability-management process for runtime dependencies.

8.Changes to sub-processors

We will give you at least 30 days’ notice by email before adding or replacing a sub-processor that handles Personal Data. You may object on reasonable data-protection grounds within that period; we will work with you in good faith to address the objection and, if we cannot, you may terminate the affected Services for termination-for-cause and receive a pro-rated refund.

9.Data Subject requests

We will assist you, by appropriate technical and organisational measures, in fulfilling Data Subject rights requests (access, rectification, erasure, restriction, portability, objection). If we receive a request directly from a Data Subject relating to Personal Data we process on your behalf, we will forward it to you without undue delay and not respond directly except to confirm receipt and identify you as the Controller.

10.Personal-data breaches

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting your Personal Data. The notification will describe the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and the measures taken or proposed. We will assist you in meeting your obligations under Articles 33 and 34 UK GDPR.

11.Retention

Account, portfolio, preference, usage and local billing records are removed on account deletion. Request logs are limited to 30 days and the latest 50 per account. Expired sessions and security tokens are removed daily. Financial audit amounts remain immutable, with account identity links removed on deletion; unlinked email evidence is removed by daily cleanup after 30 days. Account-deletion confirmation messages have separate delivery evidence removed by daily cleanup after 30 days. Stripe retains its own records under its obligations. Gmail support-correspondence retention targets 12 months after the last exchange but enforcement is not yet verified. The Privacy Notice explains external records and separate suppression/recovery-copy controls.

12.Return and deletion at end of Services

On termination of the Services, we will, at your choice, delete or return all Personal Data processed under this DPA within 30 days, and delete any existing copies unless retention is required by law. Deletion is logged and a confirmation is provided on request.

13.Liability

Liability arising under or in connection with this DPA (including any non-contractual liability arising from it) is subject to the limitations and exclusions of liability set out in the Terms. Nothing in this DPA limits any liability that cannot be excluded by applicable data-protection law.

14.Governing law

This DPA is governed by the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales in relation to any dispute arising out of or in connection with it, without prejudice to either party’s right to seek interim or injunctive relief in any competent jurisdiction.