Data processing addendum
This page summarises the terms on which Axora Payments LLC processes personal data on behalf of its clients. The binding data processing addendum forms part of each client agreement; if it differs from this summary, the signed addendum applies.
1. Roles
- Client or programme operator: controller. It decides why and how its end users' data is processed.
- Axora Payments LLC: processor. It processes that data only to provide the platform to the client.
- Licensed partners: independent controllers for the regulated services they provide, under their own privacy notices.
- Axora's own business data, such as client contacts and website enquiries, is covered by the Privacy policy.
2. Data subjects and data
| Data subjects | Data |
|---|---|
| Individual end users | Identity and contact details, identity documents and verification results, account and transaction data, wallet addresses, device and technical data, communications |
| Business end users | Details of directors, beneficial owners and authorised users; company documents; account and transaction data |
| Payers and payees | The names, account or wallet details and payment information a transaction requires |
| Client users | Names, work contact details, roles and activity in the operations dashboard |
Where a verification service uses facial images to confirm that a person is present, that data is processed only on the controller's instruction and under the safeguards the law requires.
3. Processing on instructions
Axora processes client personal data only on the client's documented instructions, which include the client agreement and the client's configuration of the platform. If Axora believes an instruction breaks data-protection law, it tells the client. Where the law requires Axora to process data in another way, it tells the client first unless the law prevents it.
4. Confidentiality and access
Only people who need the data for the service can access it, and they are bound by confidentiality obligations. Verification documents, credentials, keys and transaction identifiers are treated as confidential.
5. Security
Axora applies technical and organisational measures appropriate to the risk, including access control, separation of client environments and records of processing activity. The measures are described in the client agreement and in the security documentation shared during due diligence. See also Security & compliance.
6. Sub-processors
Clients give general authorisation for Axora to use sub-processors in these categories:
- Identity verification and transaction monitoring
- Wallet infrastructure and key management
- Cloud hosting and infrastructure
- Email, support and communication tools
The current list of sub-processors, with their locations, is provided to clients in the client agreement and on request. Axora tells clients before it adds or replaces a sub-processor, so they can object on reasonable data-protection grounds. Each sub-processor is bound by data-protection terms at least as protective as these, and Axora remains responsible for it.
7. International transfers
Personal data may be processed outside the country where it was collected. Where the law requires it, transfers rely on a recognised mechanism, such as an adequacy decision or standard contractual clauses, with any additional safeguards needed. Clients can ask which mechanism applies.
8. Assistance to clients
- Requests from individuals. Axora passes on requests it receives about client data and helps the client respond.
- Personal data breaches. Axora tells the client without undue delay after becoming aware of a breach affecting client data, with the information the client needs for its own notifications.
- Impact assessments. Axora provides information the client needs for data-protection impact assessments and consultations with authorities.
9. Deletion and return
When the services end, Axora deletes or returns client personal data as the client chooses, unless the law requires Axora or the obliged provider to keep it, for example under anti-money-laundering record-keeping rules. Data kept for that reason is used only for that purpose.
10. Information and audits
Axora makes available the information needed to show that it meets these obligations, and allows audits as set out in the client agreement, including by an auditor the client appoints.
11. Contact
Data protection questions and requests for the signed addendum: dpo@axorastack.com.