# Data Processing Addendum (template)

**Updated 20.10.2026:** Annex II backups line updated after the restore test.

**DRAFT. Not reviewed by counsel. Not for signature.** It can only be signed after the contracting entity is incorporated. Until then, do not sign this in Amir Latypov's personal name without counsel's advice.

Version: 0.1, drafted 20.10.2026.

## Parties

- **Processor:** Predge [entity to be incorporated] ("Predge"). Contact for privacy matters: hello@predge.io.
- **Controller:** the customer named in the order form ("Customer").

## 1. Subject matter, duration and nature

1.1 Predge processes personal data on behalf of Customer when Customer calls the Predge API, including the verdict endpoints, the data endpoints and the Desk alerts. The processing lasts for the term of the agreement, plus the retention in section 7.

1.2 Purpose: issuing signed verdicts and records, delivering alerts, and running the API.

1.3 Categories of personal data: identifiers Customer submits (`buyer_id`, `merchant_id`, agent identifiers), wallet addresses (public blockchain data), email and company for accounts, IP-derived values, and the endpoint URL submitted in a job spec. Customer must not submit secrets, card data or health data in any field, including URLs.

1.4 Categories of data subjects: Customer's end users, agent operators and staff.

1.5 Delivery bodies are not stored. Predge stores their SHA-256 hash, size and latency only.

## 2. Roles

2.1 For Customer Data processed under this addendum, Predge acts as processor and Customer as controller.

2.2 For Customer account data (the Customer's staff contact details), Predge acts as controller. Those are governed by the privacy notice at predge.io/privacy.

## 3. Processor obligations

Predge shall:

a) process personal data only on Customer's documented instructions, including this addendum and the API documentation;
b) ensure persons authorised to process data are bound by confidentiality;
c) implement the technical and organisational measures in Annex II;
d) respect the sub-processor conditions in section 5;
e) assist Customer, taking into account the nature of processing, with data subject requests and with its obligations under GDPR Articles 32 to 36, insofar as Predge can;
f) at Customer's choice, delete or return personal data at the end of services, subject to section 7;
g) make available the information reasonably needed to demonstrate compliance, and allow reasonable audits as described in section 6.

## 4. Security

Predge shall maintain the measures in Annex II. Predge may update them, provided the level of protection does not fall. Current gaps are published on predge.io/trust.

## 5. Sub-processors

5.1 Customer authorises the sub-processors listed in Annex III.

5.2 Predge shall give at least 30 days' notice of a new sub-processor, by email to Customer's contact and by update to predge.io/trust. Customer may object on reasonable data protection grounds within 14 days. If the objection is not resolved, Customer may terminate the affected service without penalty.

5.3 Predge shall impose data protection terms on each sub-processor no less protective than this addendum.

## 6. Information and audits

6.1 Predge shall answer one security questionnaire per 12 months, using its current published answers.

6.2 Audits: at most one per 12 months, on 30 days' notice, remote or document-based. On-site audits are not offered. Customer bears its own costs.

6.3 Where Predge holds an independent report (for example a penetration test or audit), it may provide that report instead of an audit.

## 7. Retention and deletion

7.1 Predge shall delete Customer Data within 30 days after the end of services, unless law requires retention. Backups are overwritten on their own schedule, not longer than 30 days.

7.2 Note: as of 20.10.2026, automated deletion jobs are not implemented. Deletion is performed manually on request until they are (see predge.io/trust gap list).

## 8. Personal data breaches

8.1 Predge shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and in any case within 48 hours.

8.2 The notice shall describe the nature of the breach, the likely consequences, the measures taken, and a contact point. Information may follow in stages if it is not yet known.

## 9. International transfers

9.1 Customer Data may be processed in the United States and, through sub-processors, in other countries. Where GDPR applies to a transfer to a third country, the parties agree the Standard Contractual Clauses (Module 2, controller to processor, and Module 3, processor to processor, as applicable), which are incorporated by reference. Annex I of the SCCs is completed from Annex I to this addendum.

9.2 Predge shall apply supplementary measures where required by law.

## 10. Liability and governing law

10.1 Liability is governed by the main agreement. Governing law and jurisdiction: [to be set by counsel once the entity exists].

## 11. Term

This addendum applies while Predge processes personal data for Customer, and survives as long as Predge retains Customer Data.

---

## Annex I: Description of processing

- Controller: [Customer name, address, contact]
- Processor: Predge [entity to be incorporated], hello@predge.io
- Data subjects, categories and purposes: as in sections 1.3 and 1.4
- Frequency: continuous for the term
- Retention: section 7

## Annex II: Technical and organisational measures (as of 20.10.2026)

- Transport: HTTPS for all public endpoints.
- Access: production admin access limited to one person. MFA to be enforced on all accounts (target 24.10.2026, not yet verified).
- Database: application role without UPDATE or DELETE on verdict records. Owner role separate. Read-only signing of stored verdicts.
- Keys: one ed25519 signing key in a platform environment variable. No HSM or KMS yet (target 09.11.2026). API keys stored as hashes.
- Rate limiting on public API and web endpoints.
- Logging: platform logs and error reporting; no central log review yet.
- Backups: daily and weekly Postgres backups. A logical restore test of the business tables passed on 20.10.2026. No point-in-time recovery and no working off-site copy yet (see predge.io/trust).
- Vulnerability management: internal review and self-review of contracts. No external pentest yet.
- Known gaps: listed on predge.io/trust with target dates.

## Annex III: Sub-processors (as of 20.10.2026)

| Sub-processor | Purpose | Location |
|---|---|---|
| Railway | Hosting, database, cache | Region to be confirmed |
| Vercel | Web hosting and analytics | To be confirmed |
| Zoho | Email | EU data centre |
| Privy | Sign-in | To be confirmed |
| Telegram | Bot and alert delivery | Global |
| x402 facilitators (per configuration) | Payment verification and settlement | Global |
| Public RPC providers | Blockchain reads | Global |

Full and current list: predge.io/trust.

---

Signed for Processor: ______________________ Name: __________ Date: __________
Signed for Controller: ______________________ Name: __________ Date: __________