Data Processing Addendum

Effective date: 4 September 2026. Version 1.0. This addendum applies where Cardencer processes personal data as processor for a customer that is controller or processor.

1. Instructions and compliance

Cardencer processes personal data only on documented lawful instructions, including those necessary to provide the contracted services, unless Union or Member State law requires otherwise. The customer is responsible for the lawfulness of the data, instructions, notices and legal basis.

2. Processing details

The subject matter is the provision, security and support of payment gateway services for the contract term. Processing may include collection, transmission, organization, consultation, fraud analysis, support, storage, deletion and return. Data may concern payers, customers, merchant personnel and other transaction participants and may include identity, contact, technical, transaction and masked payment data.

3. Confidentiality and security

Cardencer ensures that authorized personnel are bound by confidentiality and maintains measures appropriate to risk, including access control, least privilege, encryption in transit, monitoring, backups, vulnerability management, separation of environments and incident response.

4. Subprocessors and transfers

The customer gives general authorization for subprocessors needed to provide the services. Cardencer remains responsible for equivalent data-protection obligations and will make current subprocessor information available. Objections to a new subprocessor must be based on reasonable data-protection grounds. Restricted transfers use a valid Chapter V GDPR mechanism.

5. Assistance and incidents

Taking account of the nature of processing, Cardencer reasonably assists with data-subject requests, security, breach notifications, impact assessments and regulator consultations. Cardencer notifies the customer without undue delay after becoming aware of a personal-data breach affecting customer data and provides available relevant information.

6. Return, deletion and audits

At the end of services, Cardencer deletes or returns customer personal data as instructed, unless law requires retention. Cardencer provides information reasonably necessary to demonstrate compliance. Audits must preserve security and confidentiality, avoid unreasonable disruption and normally rely first on available independent reports and documentation.

7. Order of precedence and contact

A signed addendum or specific agreement takes precedence over this public version. Privacy and data-protection questions may be sent to privacy@cardencer.eu.