Legal
Information

This Data Processing Agreement (“Agreement” or “DPA”) is entered into by and between Aquila Private LTD, a company registered in the United Kingdom of Great Britain and Northern Ireland (hereinafter referred to as the “Company” or “Controller”), and any third-party service provider engaged in connection with the provision of services through the Platform (hereinafter referred to as the “Processor”).

This Agreement supplements the Terms of Use and Privacy Policy of the Platform and governs the processing of personal data in accordance with the UK Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), and applicable international standards.

Definitions
“Controller” – the entity that determines the purposes and means of processing personal data.
“Processor” – the entity that processes personal data on behalf of the Controller.
“Data Subject” – any identified or identifiable natural person.
“Personal Data” – any information relating to a Data Subject.
“Processing” – any operation performed on Personal Data, including collection, storage, use, or deletion.

Subject of Processing
The Processor shall process Personal Data only for the purpose of providing services to the Platform on behalf of the Controller, including but not limited to:
– Payment systems and crypto gateways
– Identity verification (e.g., KYC/AML providers)
– Hosting, cloud and infrastructure services
– Analytics, statistics, and advertising tools
– Customer support and email delivery systems

Obligations of the Processor
– Process data only based on written instructions from Aquila Private LTD
– Apply appropriate technical and organizational security measures
– Ensure confidentiality of authorized personnel
– Not transfer data outside the UK or EEA without adequate safeguards
– Assist in handling requests from Data Subjects (e.g., access, deletion, portability)
– Delete or return data upon service termination unless otherwise required by law
– Provide information necessary to demonstrate compliance with this DPA

Sub-Processors
Sub-processors may only be engaged with the prior written authorization of the Controller. The Processor remains fully liable for the actions of any authorized sub-processor.

Security Measures
Processors shall implement appropriate measures to protect Personal Data, including but not limited to:
– SSL/TLS encryption
– Secure storage and access control
– Two-factor authentication (2FA), if applicable
– Regular backups and infrastructure monitoring
– Anti-malware and intrusion prevention systems

Data Subject Rights
The Processor shall assist the Controller in ensuring that users may exercise their rights under applicable law, including:
– Right of access and correction
– Right to erasure and objection
– Right to data portability
– Right to restrict or withdraw consent

International Transfers
If Personal Data is transferred outside the UK or EEA, the Processor must apply recognized mechanisms such as:
– Standard Contractual Clauses (SCCs)
– Adequacy decisions or equivalent safeguards under UK GDPR

Audits and Records
Processors must maintain appropriate records of processing and provide them to the Controller or relevant supervisory authorities upon request. The Controller reserves the right to audit compliance with this Agreement.

Liability
The Processor shall be liable for any damage resulting from processing performed in violation of this Agreement, including failure to implement sufficient safeguards or unauthorized transfers of Personal Data.

Term and Termination
This Agreement remains in effect for the duration of the data processing relationship. Upon termination, all Personal Data shall be securely deleted or returned, unless otherwise required by law.

Governing Law
This Agreement shall be governed by and construed in accordance with the laws of England and Wales. All disputes shall be resolved in the competent courts of London, United Kingdom.

Contact
For questions regarding this DPA or data protection practices, please contact: legal@wisebitcapital.com