Data Processing Addendum

Last updated: 2026-10-29.

This Data Processing Addendum ("DPA") is part of the Terms of Service between Capital Enesti Inc. ("we", "us") and the organization that uses the Services ("you"). It applies whenever we process personal data on your behalf, and it needs no signature: you accept it by accepting the Terms. Where this DPA and the Terms conflict on data protection, this DPA prevails. Terms not defined here have the meaning given in the Terms or in the applicable data protection law (such as the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, or Canada's PIPEDA).

1. Roles

For personal data in what your organization sends through the gateway, and in the account data of its members, you are the controller and we are your processor. For personal data we use to run our own business (billing, fraud prevention, legal obligations), we are a controller and the Privacy Policy applies.

A Provider whose API you call is not our subprocessor. You choose to send it data, and the Provider processes that data on its own terms.

2. What we process

• Purpose and nature: routing your requests to the Providers you call, metering and billing them, keeping your account and Keys, and supporting you, as the Terms describe.
• Data subjects: your organization's members, and anyone whose personal data is in the requests you send.
• Personal data: names, email addresses, IP addresses, account and Key identifiers, request records, and any personal data inside the requests you send. The gateway passes request and response bodies to and from the Provider without recording them.
• Duration: for as long as you use the Services, then as section 7 sets out.

3. Our obligations

We will:

• process the personal data only on your documented instructions, which are the Terms, this DPA, and your use and settings of the Services, unless the law requires otherwise;
• make sure everyone we authorize to process it is bound to confidentiality;
• keep appropriate technical and organizational security measures in place, including encryption in transit and restricted access to production systems;
• tell you without undue delay after we become aware of a personal data breach affecting your data, with the information you need to meet your own obligations;
• help you, as far as reasonably possible, to answer requests from data subjects and to carry out data protection impact assessments or prior consultations the law requires of you;
• give you the information reasonably needed to show that we meet this DPA. We meet audit requests with written information; on-site audits take place only where the law requires them, at your cost and with reasonable notice.

4. Your obligations

You are responsible for having a lawful basis to send the personal data you send through the Services, and for giving the data subjects any notice the law requires. Do not send special categories of personal data unless the Provider's API needs them and the law allows it.

5. Subprocessors

You authorize us to use the subprocessors below. Each one is bound by written terms that protect the personal data at least as well as this DPA.

This list is the record of our subprocessors. We may change it at any time by updating this page; the effective date at the top records the change, so check this page regularly. If you object to a change on reasonable data protection grounds, email [email protected]. If we cannot resolve the objection, you may stop using the Services.

6. Transfers outside your country

Some subprocessors process personal data outside the EEA, the UK, or Switzerland. Where they do, we rely on an adequacy decision or on the Standard Contractual Clauses (or the UK and Swiss equivalents) in that subprocessor's data processing terms.

7. Deletion

When you delete your account or your organization's use of the Services ends, we delete or anonymize the personal data we process for you as the Privacy Policy describes, unless the law requires us to keep it. You can download a copy of your data from Privacy & data before you delete your account.

8. Liability and changes

Each party's liability under this DPA is subject to the limits in the Terms. We may change this DPA at any time. Each version applies from the effective date shown on this page, so check this page regularly.

9. Contact

Email [email protected] with any question about this DPA.