Data Processing Agreement (DPA)

Data Processing Roles

Predax acts as a processor for customer-submitted IP data used with the API. Customers are controllers of their own end-user data. Where Predax processes data about its own registered users (account information, billing, usage), Predax acts as a controller. Data about a customer's own use of the Service — including the IP address from which API requests are made, the identity of the calling site or application, and request volumes and outcomes — is processed by Predax as a controller, for the purposes set out in the Privacy Policy.

Subprocessors

Predax uses the following subprocessors to deliver the Service. Transfers from the UK to US processors are governed by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses.

Predax will notify customers of material subprocessor changes with at least 14 days' notice via email or in-product notification.

Security Measures

Encryption in transit (TLS 1.3), network isolation, least-privilege access controls, audit logging, and API key rotation are enforced across all systems.

Data Subject Requests

Predax will assist controllers in fulfilling data subject rights requests (access, erasure, portability, restriction) where applicable and within a reasonable timeframe.

Retention

Raw request logs, including calling IP addresses and site or application identifiers, are retained for 90 days and then automatically deleted. Raw integration telemetry is deleted after 90 days. Aggregated data derived from these logs contains no IP addresses. Customers may request deletion or shorter retention periods where technically supported.