Data Processing Addendum
On this page
1. Parties and roles
This Addendum forms part of the KYTGate Terms of Service between Nordera Works Teknoloji ve Danışmanlık A.Ş., registered at Esentepe Mahallesi, Büyükdere Caddesi, Metrocity No: 171 A, İç Kapı No: 172, Şişli, İstanbul, Türkiye (tax office Zincirlikuyu, tax no. 6312129403) ("KYTGate", the "Processor") and the customer identified in the order ("Controller"). The Controller determines why an address, transaction or customer reference is screened; the Processor screens it, records the decision and keeps the evidence on the Controller's instructions.
2. Subject matter, duration, nature and purpose
Processing of funding-related data to screen crypto transactions and wallet addresses against sanctions data, issuer freeze status, transaction integrity, processor verdicts and the Controller's own behaviour rules; to record decisions, cases and evidence; and to produce reports. Duration: the term of the Terms plus the retention period in section 8.
3. Categories of data and data subjects
Blockchain addresses and transaction identifiers; pseudonymous customer references chosen by the Controller; deposit, withdrawal and trading summary amounts and timestamps; optional device, IP and bank references supplied by the Controller with funding events; processor verdicts and evidence references; wallet ownership signatures; console user names and e-mail addresses; case notes written by the Controller's staff; remediation responses, meaning answers a client gives to an information request (source of funds, explanations, ownership signatures), documents the client uploads (at most three files of 2 MB each, stored base64-encoded); the client's e-mail address where the Controller instructs the Processor to send the request itself, used for that single transmission and not stored; and the IP addresses from which console actions are taken, stored in the audit log. Data subjects: the Controller's clients and the Controller's staff. The Processor does not receive identity documents, names of clients or KYC files unless the Controller writes them into case notes, which it should not.
4. Instructions
The Processor processes personal data only on documented instructions: the Terms, this Addendum, the Controller's API calls, console actions and tenant settings (mode, thresholds, retention). The Processor will inform the Controller if an instruction appears to infringe applicable law.
5. Confidentiality and personnel
Access to production data is limited to personnel who need it to operate the Service, bound by confidentiality, and every console access is recorded in an append-only audit log, including the acting user, the originating network and a keyed hash of the originating IP address, available to the Controller for its tenant. Console logins are tenant-scoped: accounts issued to the Controller (admin or reviewer) see and act on the Controller's tenant only. The Processor's own staff accounts are global and are used solely to operate the Service on the Controller's documented instruction; their actions are recorded in the same audit log.
6. Security measures
As described at /security, which forms part of this Addendum: encryption in transit and at rest, hashed credentials, role-based access, session limits, login throttling, tenant isolation verified by a recurring live audit, signed decision receipts, HMAC-signed webhooks, append-only audit logging, fail-closed decisioning and sanctions list re-sync at least every 6 hours. The Processor may improve these measures but will not materially reduce them during the term.
7. Subprocessors
The Processor engages the following subprocessors. The table states what each one receives, because that is the part that determines whether the Controller can accept it:
| Subprocessor | Role | Location | What it receives | Since |
|---|---|---|---|---|
| Vercel Inc. | Application hosting and server logs | USA / EEA | Everything the application processes passes through it in memory, plus request logs. Secrets are held as encrypted environment variables; the receipt signing key never leaves the runtime. | 2026-08-01 |
| Neon Inc. | Managed Postgres database | USA (AWS us-east-1) | All stored tenant data: screenings, decisions, receipts, cases, customer references, audit log. Encrypted at rest and in transit. One database, tenant isolation by tenant id on every table. | 2026-08-01 |
| Resend Inc. | Transactional e-mail | USA | Recipient address and message body for wallet-watch confirmations and alerts, sandbox claim links, contact and sandbox notifications to our own inbox, and customer information requests sent on a tenant's instruction (the recipient address is passed for that one send and not kept by KYTGate). No marketing mail exists. | 2026-08-01 |
| Functional Software, Inc. (Sentry) | Error reporting | EEA (Germany) | Server-side error messages and stack traces, with request headers, cookies, query strings, bodies, IP addresses and e-mail addresses removed before sending. No browser data and no session recordings. | 2026-10-06 |
| TRON DAO (TronGrid) | Tron network reads | Public network endpoint | The Tron address or transaction hash being checked, and nothing else. | 2026-08-01 |
| Blockscout public explorer API instances | Wallet profile and funds trace reads on EVM networks | Public endpoints (eth, base, arbitrum, polygon, optimism.blockscout.com) | The address or transaction hash being checked, and nothing else. | 2026-08-01 |
| Public blockchain JSON-RPC providers | On-chain reads per network | Public endpoints, per network, configurable per deployment | The address or transaction hash being checked, and nothing else. Which endpoint is used per network is a deployment setting. | 2026-08-01 |
The last three receive only the address or transaction hash being checked, and nothing identifying the Controller or its customers. The Processor will give at least 30 days’ notice of a new subprocessor by e-mail to the Controller’s admin users; the Controller may object on reasonable data-protection grounds, and if the objection cannot be resolved may terminate the affected service without penalty. The Since column is how that promise is checked: a provider appears here with the date it began processing.
8. Retention, deletion and return
Personal data is retained for the evidence period the Controller sets in its tenant settings (default seven years) or as long as a legal hold set by the Controller is active; remediation responses and uploaded documents are deleted together with their case under the same period. On closure of the tenant the Processor disables access immediately and deletes all tenant data 30 days later, unless a legal hold is active. Before deletion the Controller may export all data it holds as a single JSON document from the console, including signed decision receipts that remain verifiable offline.
9. Assistance and data subject rights
The Processor will assist the Controller, by appropriate technical means (search, export, deletion within retention rules), in responding to data subject requests and in meeting its security, breach notification and impact assessment obligations, taking into account that the data is pseudonymous on the Processor's side.
10. Personal data breach
The Processor notifies the Controller without undue delay and no later than 48 hours after confirming a breach affecting the Controller's data, with the nature of the breach, categories and approximate volumes, likely consequences and measures taken.
11. Audits
The Controller may request, once per year or after a breach, the Processor's current security description, the latest isolation audit output and its tenant's audit log; and may conduct or mandate an audit on reasonable notice, at its own cost, limited to the Processor's processing of the Controller's data and subject to confidentiality.
12. International transfers
Where the GDPR or UK GDPR applies and data is transferred outside the EEA or UK, the parties rely on adequacy decisions or the Standard Contractual Clauses (module two, controller to processor), which are incorporated by reference and completed by the details in this Addendum.
13. Liability and precedence
Liability under this Addendum is subject to the limitations in the Terms. In case of conflict this Addendum prevails over the Terms for data-protection matters.