Data Processing Addendum

Version 2026-10-05 · Effective 5 October 2026

How Iteradian processes personal data on your behalf when you use the Service. This DPA forms part of the Iteradian Terms of Service.

This DPA applies automatically when you accept the Terms of Service; no signature is needed. To request a countersigned copy, email [email protected]. See the Terms of Service and the Privacy Policy.

Parties and applicable law

This Data Processing Addendum ("DPA") is entered into between CommRaDian, a business registered in Israel, of Caesarea, Israel, operating the Iteradian service ("Iteradian" or "Processor"), and the customer that has accepted the Iteradian Terms of Service ("Customer" or "Controller"). It forms part of the Terms of Service at https://iteradian.com/terms (the "Terms"). Capitalised terms not defined here have the meaning given in the Terms or in Data Protection Law.

"Data Protection Law" means the Israel Privacy Protection Law, 5741-1981 and the Privacy Protection (Data Security) Regulations, 5777-2017, and, where they apply to the processing, Regulation (EU) 2016/679 ("GDPR") and the GDPR as retained in UK law ("UK GDPR"). "Customer Personal Data" means personal data that Iteradian processes on the Customer's behalf in providing the Service. Terms such as "controller", "processor", "data subject", "personal data breach" and "processing" have the meaning given in the GDPR, or the nearest equivalent under Israeli law.

Where the Customer is itself a processor acting for a third-party controller, the Customer warrants that its instructions, including the appointment of Iteradian as a sub-processor, have been authorised by that controller, and the Customer remains Iteradian's sole point of contact.

1. Scope and roles

The Customer is the controller of Customer Personal Data and Iteradian is its processor. Iteradian processes Customer Personal Data only to provide, secure and support the Service, and only on the Customer's documented instructions. The Terms, this DPA and the settings the Customer chooses in the dashboard are the Customer's complete and final instructions. Any further instruction must be agreed in writing, and Iteradian may charge for it or decline it; if it declines, the Customer's remedy is to stop using the affected part of the Service.

Iteradian will inform the Customer if, in its opinion, an instruction infringes Data Protection Law, and is not required to follow that instruction. Iteradian may also process Customer Personal Data where required by applicable law, in which case it will inform the Customer unless the law prohibits it.

The Customer is responsible for the lawfulness of the processing it instructs, for having a lawful basis and giving any notices required for it, for the accuracy of the data it provides, and for keeping its own accounts, API keys and integrations secure. This DPA does not apply to personal data Iteradian processes as a controller for its own purposes, such as account administration, billing, fraud and abuse prevention and legal compliance, which is covered by the Privacy Policy.

2. Details of processing

The processing carried out under this DPA is described in the table below. The Customer must not send special categories of personal data, private keys, seed phrases, or payment card data through the Service, and Iteradian has no obligation for data sent in breach of this restriction.

3. Confidentiality of personnel

Iteradian ensures that the personnel it authorises to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, receive appropriate instruction on data protection, and have access only to the extent needed for their role.

4. Security measures

Iteradian implements and maintains the technical and organisational measures described below, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the cost of implementation and the nature of the processing. These measures are described at a high level and may be updated over time, provided the overall level of protection is not materially reduced.

Iteradian holds no security certification or audit, including SOC 2, ISO 27001 or PCI DSS. Its servers are hosted by Contabo GmbH in the European Union, and payments are processed by Stripe, a PCI DSS Level 1 certified provider; Iteradian never stores card details. The Customer has assessed these measures and agrees they provide an appropriate level of security for the Customer Personal Data it chooses to process through the Service.

• Encryption in transit. Traffic to the Service, the dashboard and the API is encrypted with TLS. Traffic passes through Cloudflare for DNS, TLS and DDoS protection.
• Encryption of secrets at rest. Sensitive credentials and secrets, such as two-factor secrets, sign-in tokens, webhook secrets and internal keys, are encrypted at rest with AES-256-GCM. Other data is not encrypted at rest.
• Hashed credentials. Passwords and API keys are stored as one-way hashes; raw API keys are not kept.
• Role-based access. Organisation roles limit what each team member can see and change, and staff access is limited to what their role needs.
• Two-factor authentication for staff. Administrative access to production systems requires two-factor authentication.
• Network isolation. Databases and internal services are not exposed to the public internet, and customer data is separated by organisation.
• Rate limiting and abuse protection. Requests are rate limited per organisation, and edge DDoS protection sits in front of the Service.
• Audit logs. Security-relevant account and administrative actions are recorded in audit logs.
• Backups. Databases are backed up regularly, and backups are access-restricted.
• Vulnerability management. Dependencies and infrastructure are scanned for known vulnerabilities, and fixes are applied on a risk basis.

5. Subprocessors

The Customer gives Iteradian general authorisation to engage subprocessors, including those listed below. Iteradian imposes on each subprocessor data protection obligations that are substantially no less protective than those in this DPA, and remains responsible for its subprocessors' performance to the extent required by Data Protection Law.

Iteradian gives notice of a new or replacement subprocessor by updating this page. The Customer may object within 14 days of the update, in writing to [email protected], on reasonable grounds relating to data protection. The parties will discuss the objection in good faith. If it is not resolved, the Customer's sole and exclusive remedy is to terminate the affected part of the Service, without refund of prepaid fees except as the Terms allow. If no objection is received within 14 days, the change is deemed accepted.

6. International transfers

Iteradian is established in Israel, which is the subject of an adequacy decision of the European Commission and is recognised as adequate under UK law. Iteradian and its subprocessors may process Customer Personal Data in other countries where they operate.

To the extent the processing involves a transfer of personal data from the European Economic Area or Switzerland to a country without an adequacy decision that is not otherwise covered by an approved transfer mechanism, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 are incorporated by reference: Module 2 (controller to processor) and, where the Customer is a processor, Module 3 (processor to processor). For those clauses, the Customer is the data exporter and Iteradian the data importer; the optional docking clause and Clause 9(a) Option 2 (general authorisation, with notice as set out in section 5) apply; Clause 11 optional wording does not apply; the governing law and forum under Clauses 17 and 18 are those of Ireland; and Annexes I and II are completed by sections 2 and 4 of this DPA. For transfers subject to UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner is incorporated by reference and completed with the same information.

7. Data subject requests

If Iteradian receives a request from a data subject relating to Customer Personal Data, it will refer the data subject to the Customer and will not respond itself except to confirm the referral or where required by law. Taking into account the nature of the processing, Iteradian will provide reasonable assistance to help the Customer respond to data subject requests, primarily through the functions available in the dashboard. Where the assistance requires more than minimal effort, the Customer will pay Iteradian’s reasonable costs.

8. Personal data breach

Iteradian will notify the Customer without undue delay, with a target of 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will be sent to the Customer's account email address and will include the information reasonably available to Iteradian at the time, with further information provided in phases as it becomes available. Iteradian will take reasonable steps to contain and mitigate the breach.

Iteradian's notification of, or response to, a personal data breach is not an acknowledgement of fault or liability. The Customer is responsible for any notifications to supervisory authorities or data subjects that the law requires of a controller. To report a suspected security incident, email [email protected].

9. Impact assessments and consultations

Taking into account the nature of the processing and the information available to it, Iteradian will provide reasonable assistance to the Customer with data protection impact assessments and prior consultations with supervisory authorities that the law requires of the Customer in connection with the Service, at the Customer’s cost.

10. Deletion or return

On termination of the Service, the Customer may export its data through the dashboard or by request during the period allowed by the Terms. Iteradian will then delete Customer Personal Data within 30 days, except where applicable law requires it to be retained, and except for copies held in backups, which are deleted as the backups age out on their normal cycle and remain protected under this DPA until then.

11. Audits

Iteradian will make available the information reasonably necessary to demonstrate compliance with this DPA. The Customer agrees that this obligation, including any audit right under Data Protection Law or the Standard Contractual Clauses, is satisfied by Iteradian's written answers to a reasonable security questionnaire, no more than once in any 12-month period. These answers also serve as Iteradian's periodic report on its compliance with this DPA and the applicable data security requirements.

An on-site audit is permitted only where Data Protection Law or a competent regulator requires it. It must be requested with at least 30 days' written notice, take place during normal business hours without unreasonable disruption, be limited to what is necessary, be carried out by the Customer or an independent auditor bound by confidentiality, and be at the Customer's cost. Information obtained in any audit is Iteradian's confidential information.

12. Liability

Each party’s liability arising out of or in connection with this DPA, including under the Standard Contractual Clauses to the extent permitted by law, is subject to the limitations and exclusions of liability in the Terms. This DPA does not increase either party’s liability, and any reference to liability in the Terms includes liability under this DPA.

13. Precedence

If this DPA conflicts with the Terms, this DPA prevails, but only as to the processing of Customer Personal Data. Where the Standard Contractual Clauses or the UK Addendum apply, they prevail over this DPA and the Terms to the extent of any conflict. In all other respects the Terms govern.

14. Governing law

This DPA is governed by the law that governs the Terms, the law of the State of Israel, and the competent courts of Tel Aviv-Jaffo have exclusive jurisdiction, except where the Standard Contractual Clauses or the UK Addendum require a different governing law or forum. Questions about this DPA go to [email protected].

Questions about this DPA?

For a countersigned copy or any question about data processing, contact our legal team.

• Support: [email protected]
• Sales and Dedicated plans: [email protected]
• Security incidents: [email protected]
• Legal and privacy: [email protected]