Data Processing Addendum
Version of 24 October 2026. Part of the Novarithm Subscription Terms. Prudent standard template under Article 28 of the EU GDPR (Regulation 2016/679) and the UK GDPR; it is not legal advice.
1. Roles
The Customer is the controller of the personal data it sends to the services. Novarithm (trade name of Salim Doucouré, sole trader, SIREN 831 841 077, France) is the processor and processes it only to provide the services. For billing data, Stripe and PayPal act as independent controllers under their own terms.
2. Processing details
| Subject matter and purpose | Answering the Customer's API requests: sanctions-list screening, merchant web-presence reports and re-checks, pre-purchase checks, agent endpoint checks. |
|---|---|
| Data subjects | Persons whose names or details the Customer chooses to submit (for example customers, merchants, their directors), and the Customer's own staff using the key. |
| Categories of data | Names, optional country and birth year, business names and domains, email addresses submitted for checks, contact email of the subscriber. |
| Special categories | None intended. The Customer must not submit special-category data. |
| Duration and retention | Screening and check requests are processed in memory and not stored; query parameters are not written to logs. Merchant reports are stored 400 days (evidence feature) and watchlist entries until removed by the Customer or the end of the subscription. All Customer data is deleted within 30 days after the end of the subscription, unless the Customer asks earlier. |
3. Processor obligations
- Process personal data only on the Customer's documented instructions, which are these terms and the Customer's use of the API.
- Ensure that persons authorised to process the data are bound by confidentiality.
- Implement appropriate security measures, including: encryption in transit (HTTPS), API keys stored only as one-way hashes, services bound to the local network behind a single gateway, least-privilege system accounts, no query parameters in logs, regular updates.
- Assist the Customer, taking into account the nature of the processing, with data-subject requests, security, impact assessments and prior consultations.
- Notify the Customer without undue delay after becoming aware of a personal data breach affecting its data, with the information available.
- Delete or return personal data at the end of the service, as set out above.
- Make available the information reasonably necessary to demonstrate compliance, and allow audits by the Customer or its mandated auditor on reasonable notice, at the Customer's expense, no more than once a year except after a breach.
4. Sub-processors
The Customer authorises the following sub-processors. We will inform the Customer of any intended change at least 15 days in advance by email or on this page, giving it the opportunity to object and, if the objection cannot be resolved, to cancel.
| Sub-processor | Role | Location |
|---|---|---|
| Elestio (managed hosting) | Server management | EU |
| netcup GmbH | Data-centre infrastructure | Nuremberg, Germany |
To answer a request, the services query public official sources (for example government sanctions lists, registries, recall databases) or the website named in the request. Only the item to check is sent to the public source concerned, never the Customer's identity.
5. International transfers
Customer data is hosted in the European Union. Where a transfer outside the EEA is required, it will be covered by an adequacy decision or the European Commission's Standard Contractual Clauses.
6. Liability and order of precedence
Liability under this addendum is subject to the limits of the Subscription Terms, except where the law does not allow it. In case of conflict on personal data, this addendum prevails.
7. Contact
Privacy questions and requests: contact@novarithm.com.