Data Processing Addendum (DPA)

1. Scope

This DPA applies where Metiflow Group Ltd processes personal data on behalf of business customers using TraderFlow.

2. Roles

Customer acts as data controller for customer-submitted personal data. Metiflow Group Ltd acts as processor for that data, except where acting as controller for account administration and legal compliance.

3. Processor Obligations

• Process personal data only on documented customer instructions.
• Implement industry-standard safeguards and commercially reasonable security measures.
• Restrict personnel access based on need-to-know principles.
• Assist with data subject rights and incident response where required.

4. Subprocessors

We use subprocessors to deliver hosting and platform services. The current list is maintained at /subprocessors.

5. Contact and Company Details