Data Processing Agreement

Version 1.1 · 2026-11-04

This Data Processing Agreement (the “DPA”) is part of our Terms of Service (the “Terms”) between SOUSEKI LIMITED (“we”, “us”) and the business that uses Pippodrome (“you”). Words the Terms define, such as Platform and Service, mean the same here. “GDPR” is Regulation (EU) 2016/679, and its terms — controller, processor, personal data, processing, data subject, personal data breach — have their GDPR meaning.

1. Roles

1.1 For the personal data in your Platforms (“Platform Data”) you are the controller and we are your processor. If you yourself process Platform Data for another controller, you confirm that it has authorised you to appoint us, and we are then its sub-processor.

1.2 For the data of your Clubhouse account and your billing, we are the controller, as our Privacy Policy describes. This DPA does not apply to that data.

2. The processing

Subject matter

Hosting and operating your Platforms.

Duration

From the start of your first subscription or trial until all Platform Data is deleted under clause 11.

Nature and purpose

Storing, backing up, restoring, transmitting (such as the email your Platforms send), exporting and deleting Platform Data, and running, securing, monitoring, troubleshooting and supporting the Service. We process Platform Data for no other purpose.

Data subjects

Your clients and prospective clients and their representatives; your introducing brokers and partners; your staff and other users of your Platforms; and anyone named in the documents your clients upload.

Personal data

Identity and contact details (such as name, email address, phone number, address, date of birth and nationality, as you configure); the identity and verification documents your clients upload, which may show photographs and identity numbers; accounts, orders, trades, balances, wallet movements and payments; credentials; technical data such as IP addresses, sessions and logs, including records of the messages a Platform exchanges; and the email your Platforms send.

Special categories

The Service does not need special categories of personal data. If your clients’ documents contain them, you are responsible for having a lawful basis to process them.

3. Your instructions

3.1 We process Platform Data only on your documented instructions. Your instructions are the Terms, this DPA, the settings you make in your Platforms, and the written requests you send to support. This includes transfers of Platform Data to a country outside the European Economic Area (the “EEA”).

3.2 If EU or Member State law requires us to process Platform Data in another way, we tell you before we do, unless that law forbids it.

3.3 We tell you immediately if we believe an instruction infringes the GDPR or other data protection law.

4. Confidentiality

4.1 Only staff who need it to operate, secure or support the Service may access Platform Data, and each of them is bound to keep it confidential.

5. Security

5.1 We take the measures Article 32 of the GDPR requires, including those listed in the Annex. We may change them, but never in a way that lowers the protection of Platform Data.

6. Sub-processors

6.1 You authorise us to use the sub-processors on our sub-processor list.

6.2 We tell you by email at least 30 days before we add or replace a sub-processor. Within that period you may object on reasonable data protection grounds. If we cannot meet your objection, you may cancel the affected subscriptions before the change takes effect.

6.3 We bind each sub-processor by contract to data protection obligations at least as protective as this DPA. We remain fully liable to you for what our sub-processors do.

7. Where Platform Data is, and transfers

7.1 We store Platform Data and its backups only in the EEA. Moving storage outside the EEA is a change of sub-processor under clause 6.2.

7.2 A sub-processor that delivers data, such as email, may handle it outside the EEA on its way. We transfer Platform Data outside the EEA only with a safeguard that Chapter V of the GDPR recognises, such as an adequacy decision of the European Commission or standard contractual clauses.

7.3 If you are established outside the EEA, in a country without an adequacy decision of the European Commission, and the GDPR applies to our transfer of Platform Data to you, then Module Four (processor to controller) of the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 applies to that transfer and is part of this DPA. For those clauses: we are the data exporter and you are the data importer; the optional clause 7 and the option in clause 11 do not apply; the governing law under clause 17 is that of the Republic of Cyprus; the courts under clause 18 are those of Cyprus; and Annex I is completed by your and our details in the Terms and by clause 2 of this DPA. If those clauses conflict with this DPA, the clauses prevail.

8. Requests from data subjects

8.1 If a data subject asks us to exercise their rights over Platform Data, we pass the request to you without undue delay and do not answer it ourselves unless you instruct us to.

8.2 We help you answer such requests, through the Platform’s own tools and otherwise as far as is reasonable. A Platform keeps the history of its records, as trading records require; if you need personal data erased from that history, ask us, and we help you as far as is technically possible.

9. Help with your other obligations

9.1 Taking into account the nature of the processing and the information we have, we help you meet your obligations under Articles 32 to 36 of the GDPR: security, personal data breaches, data protection impact assessments and prior consultation with a supervisory authority. We may charge our reasonable costs for help beyond what the Service already provides, unless the need for it arises from our breach.

10. Personal data breaches

10.1 We tell you of a personal data breach affecting Platform Data without undue delay, and in any case within 48 hours after we become aware of it.

10.2 We tell you what we know: what happened, the kinds and approximate number of data subjects and records concerned, the likely consequences, and what we have done and propose to do about it. We send more as we learn it.

10.3 We do not notify a supervisory authority or data subjects for you unless you ask us to or the law requires it.

11. Return and deletion

11.1 When a subscription ends, we return and delete its Platform Data as clause 12.5 of the Terms says: you can ask for an export until the deletion, and we then delete the Platform Data, including all its backups. You may choose deletion at an earlier date under that clause.

11.2 We keep Platform Data after that only if EU or Member State law requires us to.

11.3 While a subscription runs, a record deleted from a Platform may stay in that Platform’s backups until they expire. We use backups only to restore the Service, and we delete again whatever a restore brings back.

11.4 On request, we confirm the deletion in writing.

12. Information and audits

12.1 We give you the information you need to show that we meet Article 28 of the GDPR: this DPA, its Annex, and answers to a reasonable questionnaire once a year.

12.2 You, or an independent auditor you appoint who is bound to confidentiality, may audit our compliance with this DPA, including by inspection. You give us at least 30 days’ notice, an audit takes place on business days, and it is at your cost. You may audit at most once in any 12 months, except after a personal data breach or when a supervisory authority requires it. An audit never gives access to other customers’ data.

13. Your obligations

13.1 You are responsible for having a lawful basis for the Platform Data, for informing your data subjects, and for the lawfulness of your instructions.

14. Liability and order of precedence

14.1 The limits and exclusions of liability in clause 16 of the Terms apply to this DPA, as far as the law allows.

14.2 If this DPA and the Terms conflict on the protection of personal data, this DPA prevails. If the standard contractual clauses in clause 7.3 apply and conflict with this DPA, the clauses prevail.

Annex: security measures

Hosting and separation

• Platforms run on servers of the hosting providers on our sub-processor list.
• Each Platform’s data is kept apart from every other Platform’s.

Network and encryption

• Servers are protected by firewalls that admit only the traffic the Service needs.
• Connections to Platforms are encrypted in transit.

Access control

• Only authorised staff administer servers, using strong authentication.
• Credentials for third-party services are kept securely and available only to the staff who need them.

Credentials of Platform users

• Passwords are stored only as salted hashes, which never reach a browser.
• Repeated login attempts are limited.
• Credentials that a Platform must store to connect to your third parties are shown only to your Platform administrators.

Backups and recovery

• Platforms are backed up so that they can be restored after a failure or an error.
• Backups are protected as Platform Data is, kept for a limited time, and deleted as clause 11 says.

Operations

• Security updates are applied promptly.
• Platforms keep logs of their activity, so that incidents can be investigated and damaged data repaired.
• Servers and Platforms are monitored, with alerts to our staff.
• Personal data breaches are handled as clause 10 says.