Legal

Data Processing Addendum

This policy is being finalised. Details shown in [brackets] will be completed before it takes effect. Nothing here is legal advice.

Effective date: 29 September 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Onekey ("Onekey", the processor) and the customer ("Customer", the controller). It applies where Onekey processes personal data on the Customer's behalf and data protection law such as GDPR, UK GDPR or the DPDP Act applies.

1. Roles

  • Customer account data (contact data of the account holder): Onekey is a controller. See the Privacy Policy.
  • Personal data in API responses and any content the Customer stores with Onekey (for example saved queries, watchlists, cached results tied to the account): the Customer is the controller (data fiduciary) and Onekey is the processor.
  • The Customer decides why and how the data is used. Onekey processes it only to provide the service and on the Customer's documented instructions, which are the Terms, this DPA and the API calls the Customer makes.

2. Details of processing

  • Subject matter and duration: providing the Onekey API for the term of the Terms, plus deletion periods.
  • Nature and purpose: fetching, normalising, caching and returning public data; billing and abuse prevention.
  • Data subjects: people whose public profiles or posts are returned or stored; the Customer's users.
  • Data types: public profile data, handles, posts, counts, timestamps, and account identifiers.
  • Special categories: not intentionally processed; the Customer must not request them.

3. Processor obligations

Onekey will:

  • process personal data only on documented instructions, unless the law requires otherwise (and tell the Customer, unless barred);
  • ensure people with access are bound by confidentiality;
  • apply the security measures in section 6;
  • help the Customer respond to data subject requests and meet its duties on security, breach notice and impact assessments, taking into account the nature of processing;
  • delete or return personal data at the end of the service, at the Customer's choice, unless the law requires storage;
  • make available information needed to show compliance and allow reasonable audits (by questionnaire and reports first; on-site audits no more than once a year, with [30] days' notice and at the Customer's cost);
  • tell the Customer if an instruction seems to infringe the law.

4. Sub-processors

The Customer gives general authorisation for the sub-processors listed in the Privacy Policy (AWS, Cloudflare, payment provider, third-party fetching services, email provider, error monitoring). Onekey will bind each in writing to terms no less protective than this DPA and stays responsible for them. Onekey will give at least [30] days' notice of a new or replaced sub-processor. The Customer may object on reasonable data protection grounds; if not resolved, the Customer may terminate the affected service and receive a pro-rata refund of unused paid credits.

5. International transfers

Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) and, where relevant, Module Three, apply, with the UK Addendum where needed. They are incorporated by reference and completed as follows: clause 7 docking clause included; clause 9 option 2 (general authorisation, [30] days); clause 11 optional language omitted; clause 17 governing law [EU MEMBER STATE]; clause 18 courts of the same. Annexes are completed by sections 2, 4 and 6 of this DPA. [Counsel to confirm.]

6. Security measures

  • Encryption in transit (TLS) and at rest for stored data.
  • Passwords and API keys stored as hashes only.
  • Role-based, least-privilege access to production, with multi-factor authentication and access logs.
  • Logs kept without request or response payloads containing personal data.
  • Network protection through a CDN/WAF, rate limits and monitoring.
  • Regular patching, dependency scanning and backups with tested restore.
  • Written incident response process.

7. Personal data breaches

Onekey will notify the Customer without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach affecting the Customer's data. The notice will include the information then available (nature, categories and approximate numbers, likely consequences, measures taken) and will be updated as we learn more. Notices go to the account email, or a security contact the Customer names.

8. Liability

Each party's liability under this DPA is subject to the limits in the Terms.

9. Order of precedence, changes and signing

If this DPA conflicts with the Terms on data protection, this DPA wins. The SCCs prevail over everything else. To get a countersigned copy, email hello@onekey.dev with your company details. Onekey may update this DPA to reflect legal changes, with notice.

Onekey: Onekey, [REGISTERED ADDRESS]. Contact: [GRIEVANCE OFFICER], hello@onekey.dev.