Data Processing Agreement (DPA)

1. Parties

• Data Controller: the Customer RIA / advisory firm or Family Office entity (or authorized controller) that determines the purposes and means of processing ("Controller").
• Data Processor: RES Solutions Ltd. („ВЕИ СОЛЮШЪНС" ЕООД, UIC 208172790) ("Processor"), Bulgaria, Sofia 1700, Studentski District, Vitosha Residential Complex, 11A Pustar Svyat Str.

2. Scope and Subject Matter

This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the NORDWEND platform ("Service"). Processed data includes: account/profile identifiers and, when enabled by the Controller, client names and contact details, portfolio holdings, financial data, sealed aggregation tokens, CRM webhook configuration, explain-pack audits, and optional CRM note content the Controller chooses to export. The closed beta processes tester account and usage data only; client portfolio data categories apply only when the Controller enables the related features.

3. Nature and Purpose

Processing is for investment-intelligence and narrative tooling (research briefings, meeting draft packs, diagnostic reconciliation). NORDWEND is not a custodian, order-management system, billing system, or trade-execution system of record.

4. Duration and Retention

Data is processed for the duration of the service agreement, plus a retention period needed for security and audit, subject to the Controller's erasure requests (see §9) and any longer retention required by applicable law. Upon termination of the agreement, the Processor shall, at the Controller's choice, delete or return all personal data processed on the Controller's behalf and delete existing copies, unless Union or Member State law requires storage (Art. 28(3)(g) GDPR).

5. Processor Obligations

• Process personal data only on documented instructions from the Controller.
• Implement appropriate technical and organizational measures (encryption in transit and at rest, access controls, audit logging, row-level security, sealed tokens via pepper).
• Notify the Controller of any personal data breach within 24 hours of becoming aware of it.
• Assist the Controller in responding to data-subject requests (access, rectification, erasure, portability).

6. Subprocessors

• Always: Supabase (auth/database, EU-North-1), Render (backend hosting), JetHost (frontend hosting).
• Conditional (only when the Controller enables the related feature/keys): Stripe (billing), Plaid (account linking), Alpaca (broker data), Wealthbox (CRM), PostHog (product analytics; EU cloud), and market-data providers.
• The current subprocessor schedule is available at GET /api/v1/privacy/vendor-pack.
• The Processor shall give the Controller prior notice (at least fourteen (14) days) of any intended change to the subprocessor list, enabling the Controller to object; the schedule above is the notice channel (Art. 28(2) GDPR).

7. International Transfers

Where personal data is transferred outside the EEA (e.g., to the U.S. subprocessors listed in §6), transfers are governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, as applicable Module 2 or Module 3), supplemented by a transfer impact assessment. Where the European Commission has adopted an adequacy decision for a destination country, the transfer relies on that decision. Details of the mechanism applied per subprocessor are available via the subprocessor schedule (§6).

8. Security Measures

• Encryption in transit (TLS) and at rest.
• Row-level security (RLS) on user tables — fail-closed.
• Audit events for oracle/ensemble and sealed tokens via pepper.
• Controls map: SOC2 readiness only — not an attestation or certification.

9. Data Subject Rights, Export and Erasure

• Export: GET /api/v1/privacy/export
• Erase (A+B overlays): POST /api/v1/privacy/erase-ab
• Oracle audit slice: GET /api/v1/compliance/export-oracle-audit

10. Audit

The Controller may audit the Processor's compliance upon fourteen (14) days' written notice, subject to reasonable confidentiality terms.

11. Liability

Liability under this DPA is limited to twelve (12) months' fees paid under the main agreement, to the extent permitted by law.

12. Governing Law

This DPA is governed by the laws of the Republic of Bulgaria.

13. Signature

Note: during the closed beta this DPA is incorporated by reference into the beta agreement; signatures are to be completed before production. It does not constitute SOC2 certification.