Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between TrueValue Technologies Ltd, a company registered in England and Wales under company number 17462580, whose registered office is at 66 Paul Street, London, England, United Kingdom, EC2A 4NA ("TrueValue" or the "Processor"), and the Customer ("Controller"), and governs the processing of personal data in connection with the TrueValue platform.

This DPA is designed to ensure compliance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR).

• "Controller" means the entity that determines the purposes and means of processing personal data.
• "Processor" means the entity that processes personal data on behalf of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data.
• "Data Subject" means the identified or identifiable natural person to whom personal data relates.
• "Sub-processor" means any third party engaged by the Processor to process personal data.

3.1 Subject Matter

The Processor shall process personal data on behalf of the Controller for the purpose of providing the TrueValue M&A advisory platform services as described in the Terms of Service.

3.2 Duration

This DPA shall remain in effect for the duration of the Controller's use of the Service and shall automatically terminate upon termination of the Terms of Service.

3.3 Nature of Processing

The Processor shall:

• Store and retrieve personal data in encrypted databases
• Process personal data to provide platform features
• Transmit personal data securely between services
• Create backups for disaster recovery purposes

4.1 Categories of Personal Data

• Contact information (names, emails, phone numbers)
• Professional information (job titles, company names)
• Financial data (transaction values, commission data)
• Communication records
• Account and authentication data

4.2 Categories of Data Subjects

• Controller's employees and authorized users
• Controller's clients and prospects
• Business contacts and deal counterparties
• Third-party service providers

The Processor shall:

• Process personal data only on documented instructions from the Controller
• Ensure persons authorized to process personal data are bound by confidentiality
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to data subject requests
• Assist the Controller with data protection impact assessments
• Delete or return all personal data upon termination
• Make available all information necessary to demonstrate compliance
• Allow for and contribute to audits conducted by the Controller

The Processor implements the following security measures:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for data in transit
• Access Control: Role-based access control (RBAC) with row-level security (RLS)
• Authentication: Multi-factor authentication support
• Monitoring: Continuous security monitoring and logging
• Backups: Automated encrypted backups with geographic redundancy
• Incident Response: Documented incident response procedures

For detailed security information, see our Security page.

The Controller authorizes the Processor to engage the following sub-processors:

• Supabase Inc. - Database hosting and authentication (United States)
• Stripe Inc. - Payment processing (United States)
• Resend Inc. - Email delivery (United States)
• Cloudflare Inc. - Content delivery and security (United States)

The Processor shall notify the Controller of any intended changes to sub-processors, giving the Controller an opportunity to object. All sub-processors are bound by data processing agreements with equivalent protections.

Personal data may be transferred to countries outside the UK/EEA. For such transfers, the Processor ensures appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs)
• UK International Data Transfer Agreement (IDTA)
• Sub-processor certifications under applicable frameworks

The Processor shall assist the Controller in fulfilling data subject requests within applicable timeframes, including:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object

In the event of a personal data breach, the Processor shall notify the Controller without undue delay and no later than 48 hours after becoming aware of the breach. The notification shall include:

• Description of the nature of the breach
• Categories and approximate number of data subjects affected
• Categories and approximate number of records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach

For questions about this DPA or to request a signed copy, please contact: