Data Processing Agreement

Effective 2026-09-20

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer") and FraudNova ("we", "us", "Processor"), and applies where you use the FraudNova service as a business customer acting as a data controller. Where there is a conflict, this DPA governs for the processing of personal data.

1. Roles of the parties

For the personal data contained in the IP addresses and related data you submit to the Service, you are the controller and we act as your processor. You determine the purposes and means of that processing; we process it on your behalf under this DPA.

2. Subject matter, duration, nature and purpose

We process the data to provide the Service — returning fraud-risk scores and signals for the IP addresses you submit, including brief caching to operate the Service — for as long as your account is active, after which §8 applies.

3. Personal data and data subjects

• Type of personal data: IP addresses, email addresses, and phone numbers you submit (depending on the check type you use) and the related lookup results/metadata.
• Categories of data subjects: the individuals or devices associated with the IP addresses, email addresses, and phone numbers you choose to submit.

4. Our obligations as processor

• Instructions: we process the data only on your documented instructions; your configured use of the Service constitutes those instructions. We tell you if an instruction appears to infringe applicable law.
• Confidentiality: personnel authorized to process the data are bound by confidentiality.
• Security: we implement appropriate technical and organizational measures (encryption in transit, access controls, hashed credentials, and operational safeguards) appropriate to the risk.
• Assistance: taking into account the nature of processing, we assist you with data-subject requests, security, breach notification, and data-protection impact assessments.
• Breach notification: we notify you without undue delay after becoming aware of a personal-data breach affecting your data.

5. Sub-processors

You give us general written authorization to engage sub-processors to provide the Service. Our current sub-processors are listed at /subprocessors. We impose data-protection obligations on each sub-processor no less protective than this DPA, and we remain responsible for their performance. We will give you at least 30 days' notice before adding or replacing a sub-processor; you may object on reasonable data-protection grounds, and if we cannot accommodate the objection you may terminate the affected Service.

6. International transfers

Our sub-processors may process data outside the European Economic Area. Where required, such transfers are made under appropriate safeguards (such as standard contractual clauses).

7. Your obligations as controller

You warrant that you have a lawful basis to submit the IP addresses you send to the Service and that your instructions comply with applicable data-protection law.

8. Deletion and return

On termination of your account, we delete or return the personal data we process on your behalf, except where retention is required by law (e.g. anonymized financial records). Cached results expire automatically.

9. Audit and information

We make available the information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, subject to reasonable confidentiality and security conditions.

10. General

This DPA is incorporated into and governed by the Terms of Service, including their limitation of liability and governing law (Pakistan). For a counter-signed copy, contact legal@fraudnova.com.