1. Customer instructions

For personal data a customer enters about its own staff, customers, consignors, dealers, vendors, and other contacts, the customer generally acts as controller or business and CoinDealerPro acts as processor or service provider. The Terms, product settings, user actions, and any signed order form are the customer’s documented instructions.

2. CoinDealerPro as controller

CoinDealerPro acts as controller for account administration, direct sales and support relationships, website operations, security and abuse prevention, subscription administration, and compliance with our own legal obligations. Our Privacy Policy describes those activities.

3. Processing commitments

Process Customer Data only to provide, secure, support, and improve the service; follow documented instructions; and comply with law.
Ensure people authorized to process Customer Data are subject to confidentiality obligations.
Maintain technical and organizational measures appropriate to the service and risk.
Use subprocessors under appropriate data-protection obligations and remain responsible for their performance as required by contract and law.
Assist customers with reasonable data-subject requests, security inquiries, impact assessments, and regulator consultations as applicable to the service.
Notify affected customers of a confirmed breach of Customer Data without undue delay as required by law and contract.
Return, export, delete, or de-identify Customer Data after termination according to instructions, legal requirements, and controlled backup cycles.

4. Security measures

Implemented application measures include protected transport configuration, organization and workspace isolation, server-side authorization, role-based permissions, restricted secret handling, auditable material actions, and signed billing webhooks. Any executed DPA will describe the production infrastructure, monitoring, backup, and recovery controls that have been verified for the deployed service. See Security.

5. International transfers

Where a restricted transfer mechanism is required, the parties may incorporate applicable standard contractual clauses or another lawful mechanism in a signed data processing addendum.

6. Audit information

Subject to confidentiality and reasonable limits, we may provide current security documentation, questionnaire responses, and other information needed to demonstrate compliance. On-site audits, custom controls, or extensive assistance may require a separate agreement and fee.

7. Requesting a DPA

Email sales@coindealerpro.com with your organization name, jurisdiction, role, and any required transfer mechanism. A public summary is not a substitute for an executed DPA where one is legally or contractually required.