GDPR Article 28 · Mise à jour: March 2026
Cette traduction est fournie à titre informatif uniquement. En cas de divergence entre cette traduction et la version anglaise, la version anglaise prévaut. La version anglaise constitue le document juridiquement contraignant.
This Data Processing Agreement ("DPA") forms part of the Master Subscription Agreement or Terms of Service ("Agreement") between you ("Controller") and Sanctuary ("Processor") for the processing of personal data as described below.
"Personal Data," "Processing," "Data Subject," "Controller," "Processor," and "Supervisory Authority" have the meanings given in Article 4 of the GDPR (Regulation (EU) 2016/679).
"Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
The Processor processes Personal Data for the purpose of providing blockchain risk analytics services as described in the Agreement. The nature and purpose of processing include:
Categories of data subjects: (a) end users whose wallet addresses are submitted for AML checking; (b) Merchant and enterprise personnel.
Categories of personal data: blockchain wallet addresses (pseudonymised via Blind Protocol for AML Services), check timestamps, IP addresses (server logs, 30 days), transaction amounts.
The Controller warrants that it has a lawful basis for submitting wallet addresses for processing, and that any Data Subjects have been informed of the processing in accordance with Articles 13 and 14 of the GDPR.
The Processor shall:
The Processor implements the following measures:
The current list of approved sub-processors is maintained at sanctuary.cv/legal/subprocessors. The Controller will be notified of any changes with at least 30 days notice.
If Personal Data is transferred outside the European Economic Area, the Processor ensures appropriate safeguards are in place in accordance with Chapter V of the GDPR, including Standard Contractual Clauses (Commission Decision 2021/914) where applicable.
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach. Notification will include: nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to mitigate.
This DPA continues for the duration of the Agreement. Upon termination, the Processor will delete all Personal Data within 30 days unless retention is required by applicable law.
This DPA is governed by the laws of England and Wales, without regard to conflict of laws principles.
To execute this DPA, Enterprise customers should contact [email protected] with your signed copy. A countersigned version will be returned within 5 business days.