Verwerkersovereenkomst

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement (the “Agreement”) between Noxart Games Co. (“Noxtica” or “Processor”) and the customer that has accepted the Agreement (“Customer” or “Controller”). It applies automatically, without signature, to the extent Noxtica processes Customer Personal Data subject to Data Protection Laws on Customer’s behalf. Capitalised terms not defined here have the meaning given in the Agreement.

1. Definitions

“Data Protection Laws” means all laws relating to the processing of personal data that apply to a party’s processing of Customer Personal Data under the Agreement, including, where applicable, Regulation (EU) 2016/679 (“GDPR”), the GDPR as retained in the law of the United Kingdom (“UK GDPR”) and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Turkish Personal Data Protection Law No. 6698, and the California Consumer Privacy Act as amended (the “CCPA”) and similar U.S. state laws.
“Customer Personal Data” means personal data contained in Customer Data that Noxtica processes on behalf of Customer under the Agreement.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by Noxtica.
“Subprocessor” means any processor engaged by Noxtica to process Customer Personal Data.
“SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
“controller”, “processor”, “data subject”, “personal data”, “processing” and “supervisory authority” have the meanings given in the GDPR; “business”, “service provider”, “sell” and “share” have the meanings given in the CCPA.

2. Scope and Roles

2.1 Customer is the controller (or “business”) and Noxtica is the processor (or “service provider”) of Customer Personal Data. Where Customer is itself a processor for a third party, Customer warrants that its instructions and this DPA are authorised by that third party, and Noxtica is a subprocessor.

2.2 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

2.3 This DPA does not apply to personal data that Noxtica processes as a controller, as described in our Privacy Policy.

3. Customer Obligations

3.1 Customer is solely responsible for: (a) the lawfulness of the processing of Customer Personal Data and of its instructions, including having a valid legal basis and, where required, explicit consent (including for biometric data and data relating to criminal offences); (b) providing all notices to data subjects required by Data Protection Laws, including about fingerprinting, monitoring, session replay, verification, automated decision-making and international transfers; (c) the accuracy, quality and legality of Customer Personal Data and the means by which it was obtained; (d) carrying out any data protection impact assessment and prior consultation required of a controller; (e) configuring the Services (including retention, masking, sampling, features and AI Features) appropriately for its processing; and (f) ensuring that any decision based on Output that significantly affects a data subject is subject to meaningful human review.

3.2 Customer must not provide, or cause the Services to collect, special categories of personal data, government identifiers, payment card data or data relating to children except through features designed for that data and only where Customer has a lawful basis and all required consents.

4. Processing on Instructions

4.1 Noxtica processes Customer Personal Data only on Customer’s documented instructions, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law (or other applicable law) to which Noxtica is subject; in such a case, Noxtica will inform Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2 Customer’s complete and final instructions at the time of acceptance are: (a) the Agreement and this DPA; (b) Customer’s configuration and use of the Services; and (c) the processing necessary to provide, secure, maintain and support the Services, to prevent fraud and abuse, and to comply with law. Any additional or different instruction requires Noxtica’s written agreement and may be subject to additional fees.

4.3 Noxtica will immediately inform Customer if, in its opinion, an instruction infringes Data Protection Laws. Noxtica is not obliged to perform a legal review of Customer’s instructions, and may suspend the relevant processing until the instruction is confirmed or modified.

5. Confidentiality

Noxtica ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that this commitment continues after their engagement ends.

6. Security

6.1 Noxtica implements the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.

6.2 Customer has assessed those measures and agrees that they are appropriate for its processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. Noxtica may update the measures from time to time, provided that the update does not materially decrease the overall level of security.

6.3 Customer is responsible for the security of its own accounts, credentials, keys, systems, integrations and configurations, and for any data once exported from the Services.

7. Subprocessors

7.1 General authorisation. Customer gives Noxtica general written authorisation to engage Subprocessors. The Subprocessors in use at the date of this DPA are listed on our Subprocessors page, which forms Annex 3.

7.2 Changes. Noxtica will inform Customer of any intended addition or replacement of a Subprocessor by updating the Subprocessors page and, for customers who have asked to be notified, by email at least fifteen (15) days in advance (except in an emergency affecting security or continuity of the Services, in which case Noxtica will notify Customer as soon as reasonably practicable), giving Customer the opportunity to object.

7.3 Objections. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If Noxtica does not withdraw the change, Customer may terminate the affected Service by written notice before the change takes effect. This is Customer’s sole and exclusive remedy.

7.4 Flow-down and responsibility. Noxtica imposes on each Subprocessor, by contract, data protection obligations that provide the same level of protection required by Article 28(3) GDPR, as relevant to the services the Subprocessor provides. Where a Subprocessor fails to fulfil its data protection obligations, Noxtica remains liable to Customer for the performance of that Subprocessor’s obligations to the extent required by Article 28(4) GDPR or other Data Protection Laws, subject to Section 14.

8. Data Subject Requests

Taking into account the nature of the processing, Noxtica will assist Customer, by appropriate technical and organisational measures insofar as this is possible, in fulfilling Customer’s obligation to respond to requests to exercise data subject rights. The Services include self-service tools for this purpose, and Customer must use them first. If Noxtica receives a request from a data subject relating to Customer Personal Data, Noxtica will refer the data subject to Customer (where Customer is identifiable) and will not respond to the request except as required by law or as instructed by Customer. Assistance beyond the self-service tools is provided at Customer’s cost.

9. Other Assistance

Taking into account the nature of the processing and the information available to Noxtica, Noxtica will provide Customer with reasonable assistance in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), primarily by making available its documentation, this DPA and information about the Services. Assistance beyond this is provided at Customer’s cost.

10. Personal Data Breaches

10.1 Noxtica will notify Customer without undue delay, and where feasible within seventy-two (72) hours, after becoming aware of a Personal Data Breach. The notice will be sent to the email address associated with Customer’s account and will include, to the extent then known and reasonably available, the information described in Article 33(3) GDPR. Information may be provided in phases.

10.2 Noxtica will take reasonable steps to contain and investigate the Personal Data Breach. Customer is responsible for any notification to supervisory authorities and data subjects that is required of a controller.

10.3 Noxtica’s notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as pings, port scans, denial-of-service attacks or failed login attempts) are not Personal Data Breaches.

11. Deletion and Return

11.1 Customer can export and delete Customer Personal Data using the Services during the term and must do so before termination if it wants to keep a copy.

11.2 After termination or expiry of the Agreement, Noxtica will delete Customer Personal Data within thirty (30) days, except copies that Noxtica is required or permitted by applicable law to retain, and copies held in rotating backups, which will be deleted in the ordinary course (within approximately thirty (30) days) and protected in accordance with this DPA until then. This deletion is Customer’s choice of deletion under Article 28(3)(g) GDPR; Customer may request a return instead before termination, at Customer’s cost.

11.3 During the term, Noxtica deletes Customer Personal Data in accordance with the retention settings that apply to Customer’s plan and configuration. Customer is responsible for configuring retention in line with its own legal obligations.

12. Audits and Information

12.1 Noxtica will make available to Customer the information reasonably necessary to demonstrate compliance with Article 28 GDPR. Customer agrees that this obligation is satisfied primarily by Noxtica providing this DPA, its documentation and written responses to a reasonable security questionnaire, no more than once in any twelve (12) month period.

12.2 If that information is not sufficient to demonstrate compliance, or where a supervisory authority requires it, Customer may conduct an audit, including an inspection, by an independent auditor that is bound by confidentiality and not a competitor of Noxtica, on at least sixty (60) days’ written notice, during normal business hours, without disrupting Noxtica’s operations or compromising the security or confidentiality of other customers’ data, at Customer’s sole cost (including Noxtica’s reasonable costs of supporting the audit), and no more than once in any twelve (12) month period unless required by a supervisory authority or following a Personal Data Breach. The results are Noxtica’s confidential information.

13. International Transfers

13.1 Customer acknowledges that Noxtica and its Subprocessors process Customer Personal Data in the countries described in our Privacy Policy and on the Subprocessors page, including Türkiye, the United States and the European Union, and authorises those transfers.

13.2 To the extent that Customer’s use of the Services involves a transfer of Customer Personal Data subject to the GDPR to Noxtica in a country that has not received an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor; Customer is the “data exporter” and Noxtica is the “data importer”; the optional docking clause (Clause 7) applies; Clause 9 option 2 (general written authorisation) applies, with the time period set out in Section 7.2; the optional language in Clause 11 does not apply; Clause 17 option 1 applies and the governing law is the law of Ireland; the courts of Ireland are chosen under Clause 18(b); and Annexes I, II and III of the SCCs are completed with the information in Annexes 1, 2 and 3 of this DPA. The competent supervisory authority is the one determined in accordance with Clause 13.

13.3 For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner applies, completed with the information above, and either party may end it as permitted by its Section 19. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the necessary adaptations, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers.

13.4 If there is a conflict between the SCCs and this DPA or the Agreement, the SCCs prevail to the extent of the conflict. Nothing in this DPA or the Agreement limits any right of a data subject under the SCCs.

14. Liability

To the maximum extent permitted by applicable law, each party’s liability arising out of or relating to this DPA (including the SCCs, to the extent the SCCs permit) is subject to the exclusions and limitations of liability in the Agreement, and Noxtica’s total aggregate liability under this DPA and the Agreement together will not exceed the liability cap in the Agreement. This Section does not limit any party’s liability to data subjects under the SCCs or Data Protection Laws where such liability cannot be limited.

15. CCPA and U.S. State Privacy Laws

Where the CCPA or similar U.S. state law applies, Noxtica: (a) will not sell or share Customer Personal Data; (b) will not retain, use or disclose Customer Personal Data for any purpose (including any commercial purpose) other than the business purposes specified in the Agreement, or outside the direct business relationship with Customer, except as permitted by those laws; (c) will not combine Customer Personal Data with personal data received from other sources except as permitted by those laws; (d) will comply with the obligations that apply to it under those laws and provide the same level of privacy protection they require; (e) will notify Customer if it determines that it can no longer meet its obligations under those laws; and (f) grants Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data. Noxtica certifies that it understands these restrictions.

16. General

16.1 This DPA lasts for as long as Noxtica processes Customer Personal Data under the Agreement.

16.2 If there is a conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA prevails. In all other respects the Agreement prevails, including its disclaimers, limitations of liability, indemnities, governing law and dispute resolution provisions (except as required by Section 13).

16.3 Noxtica may update this DPA from time to time where required by changes to Data Protection Laws, guidance or the Services, provided that the update does not materially reduce the protection of Customer Personal Data; updates are notified as described in the Agreement.

16.4 Only the English version of this DPA is legally valid and binding. The controlling version is the English text published at https://noxtica.com/dpa. Any translation of this DPA is provided for reference purposes only, does not have any legal value and should not be relied upon as a legally binding document. In the event of any discrepancies or inconsistencies between a translation and the English version, the English version shall prevail.

16.5 Customers who require a countersigned copy of this DPA may request one at [email protected] (subject: “DPA”).

Annex 1 — Description of Processing

Item	Description
Subject matter	Provision of the Services under the Agreement: device fingerprinting, bot, fraud and risk detection, application performance and real-user monitoring, session replay, identity, business and merchant verification, sanctions and watch-list screening, AI Features, the Backoffice and related support
Duration	The term of the Agreement plus the deletion period in Section 11
Nature of processing	Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, comparison (including face comparison and list matching), analysis, scoring, transmission, display, restriction and erasure, by automated means
Purpose	To provide the Services to Customer as configured by Customer, including generating Output for Customer’s own decisions; to secure, maintain and support the Services; and to prevent fraud and abuse of the Services
Categories of data subjects	Visitors and users of Customer’s websites and applications; individuals and representatives of businesses who undergo verification requested by Customer; Customer’s Authorized Users; any other individuals whose data Customer submits
Types of personal data	Online identifiers and device, browser and network signals (including IP address, approximate location and hashed fingerprints); behavioural and interaction data; performance, error and session replay data; identity document images and data (name, date of birth, nationality, document number and other data printed on or encoded in the document); selfie, liveness and face images; short voice samples and, where enabled, speech recordings with the audio-property measurements, speech features, same-speaker consistency, spoken-digit match and synthetic-or-replayed-audio risk scores derived from them; email addresses; business registration, ownership and representative data; screening results; Authorized User account data; any other data Customer submits
Special categories and criminal-offence data	Biometric data processed to verify identity (face comparison and, where enabled, voice comparison, including the temporary same-speaker comparison of speech recordings within one verification), only where Customer enables those features and has obtained any required explicit consent. Speech analysis outputs are advisory estimates and are not solely automated decisions. Screening against public sanctions or watch lists may reveal data relating to criminal offences. Customer must not otherwise submit special category data
Frequency	Continuous, for as long as Customer uses the Services
Retention	As configured by Customer within its plan, and as described in Section 11 and our Privacy Policy
Subprocessor processing	As described on the Subprocessors page (Annex 3)

Annex 2 — Technical and Organisational Measures

Encryption. Encryption in transit (TLS) for all external connections. Verification evidence is encrypted with envelope (key-encryption-key / data-encryption-key) encryption before storage. Storage providers encrypt data at rest.
Pseudonymisation and minimisation. Rendering fingerprints are stored as one-way hashes; IP addresses and user agents are hashed where used for session security and acceptance records; data sent to the data warehouse is minimised to allowlisted fields; face-comparison templates are not stored.
Access control. Role-based access control with least privilege; tenant isolation enforced on every request; multi-factor authentication and single sign-on available for Backoffice users; administrative access to infrastructure through authenticated secure tunnels and access policies.
Credential and key protection. Passwords stored as salted, iterated hashes; API keys hashed; secrets stored in managed secret stores and not in source code; short-lived tokens.
Integrity and logging. Audit logging of administrative actions; append-only records for consent and legal acceptance; change control and code review for production changes.
Availability and resilience. Globally distributed edge infrastructure; rate limiting and DDoS protection; database backups stored in EU-jurisdiction storage and rotated; documented restore procedures.
Retention and deletion. Automated, scheduled deletion according to configured retention; soft-delete followed by hard-delete; erasure workflows that cover primary stores and derived copies.
Testing and evaluation. Automated tests, security checks and review of security measures as the Services change.
Personnel. Confidentiality commitments for personnel with access to Customer Personal Data; access limited to personnel who need it.
Subprocessors. Contractual data protection obligations imposed on Subprocessors as described in Section 7.

Annex 3 — Subprocessors

The list of Subprocessors published at https://noxtica.com/subprocessors, as updated in accordance with Section 7.

This Data Processing Addendum is effective as of the Effective Date above.