Data Processing Agreement (DPA)
Last updated 2026-07-22
This DPA supplements the Terms of Service and applies to all users subject to GDPR (EU/EEA/UK customers). By signing up you accept this DPA as part of your contract with EV Quant Lab.
1. Definitions
- Personal Data: any data relating to an identified or identifiable natural person.
- Processing: any operation on Personal Data (collection, storage, use, disclosure, deletion).
- Controller: the user (you). You decide why and how your data is processed.
- Processor: EV Quant Lab (us). We process data on your behalf to provide the service.
- Sub-processor: a third party we engage to process your data (Stripe, Cloudflare, Polymarket).
2. Subject matter and duration
We process your Personal Data solely to provide the Polymarket EA service (auth, billing, paper/live trading, support). The processing continues as long as your account is active + 30 days post-deletion, with longer retention where required by tax / AML law (7 years for trading records).
3. Nature and purpose of processing
- Account: email, password (bcrypt-hashed, never plaintext), session tokens.
- Trading: orders, fills, P&L (encrypted at rest with AES-256-GCM for any wallet keys).
- Payments: Stripe customer ID, subscription metadata. Card numbers are never seen by us — Stripe handles PCI-DSS compliance.
- Operational: server logs (rotated), anonymized request analytics.
4. Your obligations as Controller
- You warrant that you have the legal basis (consent, contract, legitimate interest) to provide any Personal Data to us.
- You will inform your end-users (if any) about this DPA and our Privacy Policy.
- You will respond to data-subject requests yourself or forward them to us within 7 days.
5. Our obligations as Processor
- Process Personal Data only on documented instructions from you (the ToS).
- Ensure all personnel with data access are bound by confidentiality.
- Implement appropriate technical and organizational measures (AES-256-GCM, bcrypt, network isolation, audit logging).
- Engage sub-processors only with prior notice and an equivalent data-protection agreement.
- Assist you with data-subject requests, DPIAs, and breach notifications.
- On termination, delete or return all Personal Data, subject to legal retention.
6. Sub-processors
We engage the following sub-processors. We notify you via email at least 30 days before adding a new one, giving you the right to object.
| Sub-processor | Data shared | Location | Purpose |
|---|---|---|---|
| Stripe Inc. | Email, billing address, payment method tokens | EU + US (data transfer covered by SCCs) | Process subscription payments |
| Cloudflare Inc. | IP addresses, request logs, content served | Global edge network | Host the application |
| Polymarket (BlockTower) | Trading transactions (public on chain) | Polygon blockchain | Execute live trades when armed |
7. International data transfers
Data may transfer outside the EEA (e.g., Stripe US, Cloudflare global). We rely on Standard Contractual Clauses (SCCs) for any such transfer per Article 46 GDPR.
8. Breach notification
We will notify you of a Personal Data breach within 72 hours of becoming aware of it, per Article 33 GDPR. Notification goes to the email on your account.
9. Audit rights
You may request evidence of our security practices (this DPA, our SECURITY.md, an anonymized breach log of last 90 days) at any time. Formal on-site audits require 30 days written notice.
10. Contact
Data Protection Officer:
dpo@polymarket-bot.com
EV Quant Lab · Madrid, Spain