Blockchain API Data Processing Agreement

Thank you for using the Blockchain API!

Blockchain API is an American company and our data infrastructure is based in the USA. Processing and storing data in a secure, fair, and transparent way is extremely important to us.

This Data Processing Agreement (“DPA”) is an addendum to the Terms of Service between Blockchain API and the customer.

If you are accepting this DPA on behalf of your customer, you warrant that: (a) you have full legal authority to bind your customer to this DPA; (b) you have read and understand this DPA; and (c) you agree, on behalf of your customer, to this DPA.

These service terms incorporate the Blockchain API Data Processing Agreement” (“DPA”), when the General Data Protection regulation (“GDPR”) applies to your use of Blockchain API services to process CryptoCheckout user data as defined in the DPA. We protect and secure your data to the high standards set out in the agreement.

Definitions

• “You” or “customer” refers to the company or organization that signs up to use the Blockchain API to interact with blockchains in any way.

• In the course of providing the Blockchain API service to customer pursuant to the agreement, Blockchain API may process user data on behalf of customer.

• In this Data Processing Agreement (“DPA”), “Data Protection Legislation” means the General Data Protection Regulation (Regulation (EU) 2016/279), and all other applicable laws relating to processing of visitor data and privacy that may exist in any relevant jurisdiction.

• “data controller”, “data processor”, “data subject”, “personal data” and “processing” shall be interpreted in accordance with applicable Data Protection Legislation.

• The parties agree that the customer is the data controller and that Blockchain API is its data processor in relation to data that is processed in the course of providing the service.

Privacy and security of your payees’ data

We take many measures to protect and secure your user data through backups, redundancies, and encryption. When you use our service to accept payment in crypto, Blockchain API will collect information about your payees.

You entrust us with this data and we take that trust to heart. You agree that Blockchain API may process your data as described in our data policy and for no other purpose. We do our best to deserve that trust by being open about who we are, how we work, and keeping an open door to your feedback.

You own all right, title, and interest to your data. We obtain no rights from you to your data. We do not collect and analyze personal information from users nor use these behavioral insights to sell advertisements. When using Blockchain API, you 100% own and control all of your data. We don’t sell or share your site data to any third-parties, and we don’t abuse your visitor’s privacy.

Even though the purpose of Blockchain API is to interact with the blockchain which creates a public record, we store as little - and often no - personal data or personally identifiable information (PII) as possible.

By using Blockchain API, all the payments that can be carried out anonymously are carried out as such. We minimize data collection in general. We measure only the most essential data points and nothing else.

We do not store, retrieve nor extract anything from visitor’s devices. The data we process cannot be used to identify any single individual, unless they explicitly provide that information to use.

Organizational and technical security measures

All of the data that we do track is kept fully secured, encrypted and hosted on our services in the US. Your visitor data never leaves the US and US-owned cloud infrastructure.

For encryption, we use https in transit and encryption at rest.

Processor’s obligations with respect to the controller

• Blockchain API will process visitor data only in accordance with instructions from customer through the settings of the service, i.e. (a) to operate, maintain and support the infrastructure used to provide the service; (b) to comply with customer’s instructions and processing instructions in their use, management and administration of the service; (c) as otherwise instructed through settings of the service. Blockchain API will only process visitor data in accordance with the agreement.

• Blockchain API shall notify customer without undue delay if, in Blockchain API’s opinion, an instruction for the processing of data given by customer infringes applicable Data Protection Legislation.

• Blockchain API shall guarantee the confidentiality of data processed hereunder.

• We as humans can access your data to help you with support requests you make and to maintain and safeguard Blockchain API to ensure the security of your data and the service as a whole. Blockchain API shall ensure that all Blockchain API personnel required to access the visitor data are trained in GDPR and data privacy, informed of the confidential nature of the data and comply with the obligations sets out in this agreement.

• Blockchain API shall implement and maintain appropriate technical and organizational security measures designed to protect the visitor data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration or disclosure. These measures shall be appropriate to the harm which might result from any unauthorised or unlawful processing, accidental loss, destruction, damage or theft of the visitor data and having regard to the nature of the visitor data which is to be protected.

• We do work with sub-processors. With each vendor, we assess their commitment to privacy. Any such subcontractors will be permitted to process data only to deliver the services Blockchain API has retained them to provide, and they shall be prohibited from using data for any other purpose. Blockchain API shall notify the controller when modifying the list of subprocessors using our in-app notifications, email and/or blog. The controller is able to legitimately object and may terminate the agreement.

• The only two cloud services we use as subcontractors that come in touch with your data are AWS and Stripe. All of your site data is securely stored in the US on US-owned server infrastructure and it never leaves the US. You can find the list of other cloud services and third party services that we use in our privacy policy.

• If Blockchain API becomes aware of any accidental, unauthorized or unlawful security breach, destruction, loss, alteration, or disclosure of the personal data that is processed by Blockchain API in the course of providing the service, it shall without undue delay (not later than 48 hours after having become aware of it), notify customer by email and provide customer with a description of the incident as well as periodic updates to information about the incident, including its impact on customer content. Blockchain API shall additionally take action to investigate the incident and reasonably prevent or mitigate the effects of the incident.

• Blockchain API shall assist the controller in complying with the obligations concerning the security of personal data. Blockchain API will also provide assistance to the controller for DPIAs. Where a data subject asserts their rights as a data subject, this request will be forwarded to the controller without delay.

How we handle delete instructions

You can choose to delete your account and delete your data at any time by contacting us. We provide simple no-questions-asked deletion links.

All of your data will be permanently deleted immediately when you delete your Blockchain API account. We cannot recover this information once it has been permanently deleted.

Customer undertakings and Blockchain API assistance

• Customer warrants that it has all necessary rights to provide to Blockchain API the data for processing in connection with the provision of the Blockchain API Services.

• Customer shall comply at all times with Data Protection Legislations in respect of all data it provided to Blockchain API pursuant to the Agreement.

• Customer understands, as a controller, that it is responsible (as between customer and Blockchain API) for:

1. determining the lawfulness of any processing, performing any required data protection impact assessments, and accounting to regulators and individuals, as may be needed;

2. providing relevant privacy notices to data subjects as may be required in your jurisdiction;

3. implementing your own appropriate technical and organizational measures to ensure and demonstrate processing in accord with this DPA;

4. notifying any relevant regulators or authorities of any incident as may be required by law in your jurisdiction.

Liability and Indemnity

• Each party indemnifies the other and holds them harmless against all claims, actions, third party claims, losses, damages and expenses incurred by the indemnified party and arising directly or indirectly out of or in connection with a breach of this DPA.

Duration and Termination

• The DPA is effective as of October 21, 2021 and replaces and supersedes any previously agreed data processing agreement between you and Blockchain API relating to the GDPR.

• Termination or expiration of this DPA shall not discharge the parties from the confidentiality obligations herein.

Are customers required to sign the Blockchain API DPA?

In order to use our products and services, you need to accept our DPA. By using our product you are agreeing to our terms of service, and you are automatically accepting our DPA and do not need to sign a separate document. We provide the same privacy rights and protection to all customers.

Can a customer share the Blockchain API DPA with its customers?

Yes. The DPA is a publicly available document and customers who wish to share it with their customers to confirm our security measures and other terms may feel free to do so.

Do customers need to notify anyone upon accepting our DPA?

No. You are not required to notify us or any third party upon accepting our DPA though, as mentioned above, you are free to do so.

Contact Us

If you have a question about the Data Processing Agreement (DPA), please contact us.

If you have any questions or concerns regarding your information and personal data, please contact us at info@blockchainapi.com.

Last updated: April 28th, 2022