Customer instructions

When your users enter contacts, employees, consignors, customers, vendors, or similar records, you determine the purpose. CoinDealerPro processes that information to provide the service you configured.

You are responsible for the lawful basis, notices, and instructions you give us, including the files your users upload.

CoinDealerPro as controller

CoinDealerPro LLC is the controller for account login data, billing data, website visit data, demo-request forms, and communications you send directly to us.

Processing commitments

We will:

process personal information in Customer Data only to provide, secure, support, and operate the service, to comply with law, and to follow documented customer instructions
bind subprocessors that handle Customer Data by written data-protection terms, which may be the provider’s standard terms
not sell Customer Data
assist with deletion, export, and access requests that a customer cannot complete in the product, subject to verification and law
notify the customer without unreasonable delay if we become aware of a personal-data breach affecting that customer’s Customer Data

Current subprocessors are listed on the Subprocessors page.

Security measures

We use measures such as encrypted connections, including to the database; organization and workspace isolation; server-side authorization; role-based permissions; optional two-factor authentication; password hashing, strength rules, and checks against known compromised passwords; login rate limiting; restricted secret handling; audit records for material actions; signed billing webhooks; and automated vulnerability and dependency scanning.

Record fields that do not need to be searched are encrypted before storage with separately managed keys. Banking details, authentication secrets, eBay credentials, and buyer contact information receive additional encryption. Searchable fields are protected by authentication and access controls.

Business records and uploaded files are backed up to separate, encrypted storage, and restore procedures have been tested. Production infrastructure, monitoring, backup, and recovery otherwise follow our then-current operating controls.

International transfers

The application is hosted on Amazon Web Services in the United States. Some providers may process information in other countries. If a restricted-transfer mechanism is required, the parties may add standard contractual clauses or another lawful mechanism in a signed addendum.

Audit information

Subject to confidentiality and reasonable limits, we may provide current security documentation or questionnaire responses. On-site audits, custom controls, or extensive assistance may require a separate agreement and fee.

Retention and deletion

Cancellation does not automatically delete Customer Data. We may delete Customer Data after the paid term ends, and a customer may request deletion at admin@coindealerpro.com. Uploaded files, including from incomplete imports, may be retained. Copies may persist in backups for a period, and we may retain information as needed for legal, billing, security, or dispute purposes.

We do not promise post-term storage of Customer Data, and backup media are not a customer archive.

Requesting a DPA

If you need a signed data processing addendum, email admin@coindealerpro.com with the subject Data processing addendum request. Include your organization name, jurisdiction, role, and any transfer mechanism you believe is required.

A public summary is not a substitute for an executed addendum where one is legally or contractually required.