Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") applies when a business or other organization ("Customer") uses Fips, for example on a Team plan, and T2MA Labs LLC ("T2MA Labs", "we", "us") processes personal data on the Customer's behalf. It forms part of the Terms of Service between the Customer and T2MA Labs. For individual users, our Privacy Policy applies instead.

1. Roles

The Customer is the controller of the personal data it or its users put into Fips, and T2MA Labs is its processor. If the Customer is itself a processor, T2MA Labs is its sub-processor. For data we process for our own purposes, such as account administration, billing, security and legal obligations, we are an independent controller under our Privacy Policy.

2. Details of the processing

• Subject matter: providing Fips to the Customer.
• Duration: for the term of the Customer's subscription and until deletion under section 9.
• Nature and purpose: hosting, storing, syncing and analyzing trading data; managing user accounts; sending notifications; providing support.
• Types of personal data: names and email addresses, account identifiers, trading data (trades, trading accounts, balances, notes, screenshots), connected-account details, device and usage data, and support messages.
• Data subjects: the Customer's authorized users, such as employees, members or traders.
• Special categories of data: none are intended to be processed.

3. Our obligations

We will:

• process personal data only on the Customer's documented instructions, which are this DPA, the Terms and the Customer's use and settings of the Service, and tell the Customer if we believe an instruction breaks data protection law;
• make sure everyone authorized to process the data is bound by confidentiality;
• apply the security measures in section 6, in line with Article 32 GDPR;
• help the Customer respond to requests from data subjects and with data protection impact assessments and consultations with authorities, taking into account the nature of the processing;
• notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data, and give the information the Customer needs to meet its own obligations;
• make available the information needed to show compliance with this DPA, and allow reasonable audits on reasonable prior notice.

4. The Customer's obligations

The Customer is responsible for having a lawful basis for the processing, for giving its users any required notices, and for making sure its instructions comply with the law. The Customer will not use Fips to process special categories of personal data.

5. Sub-processors

The Customer gives general authorization for us to use sub-processors. Our current sub-processors are:

• Cloudflare: hosting of the websites and API, database, file storage and security.
• Resend: transactional email.
• Google: Firebase Cloud Messaging for delivering push notifications, and the Gemini API for drafting support replies (only for support conversations).
• Sentry: crash reports from the mobile app.
• PostHog: product analytics in the mobile app.
• RevenueCat: subscription status for mobile app purchases.
• Our payment provider: web payments; it may act as merchant of record.
• Cloud server provider: hosts our self-hosted support chat (Chatwoot) and our data collection services.

We will update this list before a new sub-processor starts processing Customer data, and the Customer may object on reasonable data protection grounds. If we cannot resolve the objection, the Customer may cancel the affected subscription and receive a refund of prepaid fees for the unused period. We bind each sub-processor to data protection terms that protect the data at least as well as this DPA, and we remain responsible for their work.

6. Security measures

• encryption of data in transit (HTTPS) and at rest by our hosting providers;
• passwords stored only as salted hashes;
• authentication on every API request, with each user limited to their own data;
• rate limiting and network-level protection against attacks;
• read-only access to connected trading accounts;
• access to production systems limited to the people who need it;
• account deletion that removes the user's data from our active systems.

7. International transfers

We process personal data in the United States and in other countries where our sub-processors operate. For transfers of personal data from the EU/EEA, this DPA incorporates the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, with the Customer as data exporter and T2MA Labs as data importer. The optional clause in Clause 11 does not apply, and Clauses 17 and 18 are governed by the law and courts of Ireland. Section 2 of this DPA is Annex I, section 6 is Annex II and section 5 is Annex III.

For transfers from the UK, the UK International Data Transfer Addendum applies; for Switzerland, the Clauses apply with the adjustments required by Swiss law; and for Turkey, we rely on the safeguards allowed by Article 9 of KVKK, such as standard contracts.

8. Requests from data subjects

If a data subject contacts us directly about Customer data, we will forward the request to the Customer and will not respond ourselves, except to direct them to the Customer or where the law requires us to.

9. Return and deletion

When the Customer's subscription ends, the Customer can export its data before closing its accounts. We then delete Customer personal data from our active systems within 30 days, unless the law requires us to keep it. Backups held by our hosting providers expire on their normal schedule.

10. Liability, precedence and governing law

Liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them. If there is a conflict, the Standard Contractual Clauses prevail, then this DPA, then the Terms. This DPA is governed by the law that governs the Terms, which is the law of the State of New Mexico, USA, except that the Standard Contractual Clauses are governed by the law they specify.

11. Contact

T2MA Labs LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA. Email: [email protected]