EMpulse Data Processing Addendum (draft)

Version 2026-10-25-draft. Draft: subject to approval. This addendum is part of the EMpulse Enterprise Terms.

1. Roles and subject matter

1.1. EMpulse provides exchange-rate index data that contains no personal data. The personal data EMpulse processes under the agreement is limited to the account data of the customer's staff: names, work email addresses, company, country and the technical journal of API requests (key identifier, endpoint, time; no IP addresses are stored with requests).

1.2. For account data EMpulse acts as an independent controller for the purposes of running the account, billing, security (detection of key sharing and bulk download) and support. EMpulse does not process personal data on the customer's behalf; if the parties later agree such processing, a processor agreement will be signed separately.

2. Purposes and retention

Account data is processed to issue and operate keys, to invoice, to answer support questions and to send service notices (invoices, renewals, incidents). Request journals are kept for 90 days; billing records for the period required by law; account data for the term of the agreement and 12 months after its end.

3. Security

Keys are stored only as cryptographic hashes; services run in a single EU data centre; access is restricted to the operator; transport is encrypted (TLS); backups are encrypted. Security incidents affecting account data are notified to the customer's contact without undue delay and no later than 72 hours after EMpulse becomes aware of them.

4. Sub-processors

Hosting (EU data centre), email delivery (Google Workspace), payment networks (public TRON blockchain: payment addresses and amounts only). The current list is available on request; changes are notified by email 30 days ahead.

5. Data subject rights and transfers

Requests of data subjects (access, correction, deletion of account data) are handled at hello@empulse.ai within 30 days. Where account data leaves the EU/EEA, the EU standard contractual clauses apply.

6. Order of precedence

Where this addendum and the Enterprise Terms conflict on the processing of personal data, this addendum prevails.