DATA PROCESSING ADDENDUM

Parties and Scope

The customer is the “Controller” or “Business,” and FuteurCredX is the “Processor” or “Service Provider” only to the extent each role applies under relevant data-protection law. For processing where FuteurCredX determines purposes and means, the Privacy Policy—not this DPA—governs that independent-controller activity.

Processing Details

• 2.1Subject matter: credit-data aggregation, identity or business verification, analytics, reporting, API processing, integration support, and related contracted services.
• 2.2Data subjects: customer end users, business owners, principals, applicants, and authorized representatives.
• 2.3Data: contact, identity, financial, business, account, transaction, credit, and technical information specified in the agreement.
• 2.4Duration: the agreement term plus a limited return, deletion, backup, dispute, or legally required retention period.

Documented Instructions

FuteurCredX will process covered personal data only on documented instructions in the agreement, order form, configuration, support request, or customer’s lawful use of the Services, unless law requires otherwise. We will notify the customer if an instruction appears to violate applicable law, unless prohibited.

Confidentiality and Security

Personnel authorized to process covered data are subject to confidentiality obligations. FuteurCredX maintains technical and organizational measures designed for the nature of the Services and the risks of processing, which may include access control, authentication, encryption, logging, secure development, incident response, backups, and vendor risk management.

Subprocessors

The customer generally authorizes use of subprocessors needed to provide the Services. FuteurCredX remains responsible for imposing appropriate data-protection obligations on subprocessors for covered processing. Notice, objection, and remediation procedures follow the executed agreement or applicable law. A current subprocessor list may be requested at data@futeurcredx.com.

Customer Responsibilities

• 6.1Provide lawful instructions and an appropriate legal basis
• 6.2Give required notices and obtain required permissions or authorizations
• 6.3Limit submitted data to what the contracted service requires
• 6.4Configure access appropriately and protect credentials
• 6.5Respond to end-user questions concerning the customer’s own practices

Assistance and Individual Rights

Taking into account the nature of processing and information available, FuteurCredX will provide reasonable assistance with covered access, correction, deletion, restriction, portability, objection, security, impact-assessment, and regulatory obligations. If we receive a covered request directly, we may direct it to the customer unless law requires another response.

Security Incidents

We will notify the customer without undue delay after confirming a personal-data breach affecting covered customer data, consistent with the executed agreement and applicable law. Notice will include available information reasonably needed for the customer’s response. Notification does not admit fault or liability.

Transfers, Audit, and Return

Where a restricted international transfer occurs, the parties will use a lawful transfer mechanism required by applicable law. Demonstration of compliance, audit procedures, and return or deletion of data follow the agreement and must protect other customers, confidentiality, security, and service availability. Backup, legal-hold, fraud, and recordkeeping exceptions may apply.

Contact and Order of Precedence

Questions may be sent to data@futeurcredx.com. An executed DPA, security schedule, order form, or negotiated addendum controls over this web version for the applicable customer.