Data processing addendum
Last updated: 29 October 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between DILENS LTD, a private limited company registered in England and Wales under company number 17406070, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Processor", "we") and the customer ("Controller", "you"). It applies to personal data we process on your behalf through SignupVet and meets the requirements of Art. 28 UK GDPR and EU GDPR and of the Swiss Federal Act on Data Protection, where applicable.
1. Subject matter and details
- Nature and purpose: checking signups to your products for fraud and abuse and returning risk scores; showing check history and statistics in your dashboard.
- Data subjects: people who sign up or try to sign up to your products.
- Personal data: email addresses, phone numbers, IP addresses and data derived from them (e.g. email domain, country, network type, masked values and keyed fingerprints).
- Duration: for as long as you use the service; check logs are deleted after 90 days. Entries on your own block and allow lists stay until you remove them or close your account.
2. Instructions
We process the data only on your documented instructions, which are these terms, the API requests you send and the settings you choose, unless the law requires otherwise; in that case we inform you unless the law forbids it. We tell you if we think an instruction breaks data protection law.
3. Confidentiality
Everyone we authorise to process the data is bound to confidentiality.
4. Security measures
- Encryption in transit (HTTPS/TLS) for the website, dashboard and API.
- No storage of full email addresses, phone numbers or IP addresses from checks or in your block and allow lists: only masked values and keyed one-way fingerprints (HMAC) are kept.
- Automatic deletion of check logs after 90 days.
- Passwords stored with scrypt; API keys and session tokens stored only as hashes; API keys can be revoked at any time.
- Separation of customers: data and fingerprints are only ever compared within the same customer's account.
- Rate limits on the API and on login, and restricted access to production systems.
5. Subprocessors
You authorise us to use the following subprocessors. We bind each of them to data protection obligations equivalent to this DPA and remain responsible for them.
| Provider | Purpose | Location |
|---|---|---|
| Railway Corporation | Hosting of the application and database | United States |
| Stripe | Payment processing, invoices and the billing portal | United States / Ireland / United Kingdom |
| Resend | Sending account emails (e.g. password reset, usage warnings, onboarding tips) | Sending region European Union (Ireland); company in the United States |
| Hostpoint AG | Domain, DNS and our support mailbox | Switzerland |
We will inform you by email at least 30 days before adding or replacing a subprocessor. You may object on reasonable data protection grounds; if we cannot address the objection, you may terminate the affected service.
6. International transfers
Where data is transferred to a country without an adequacy decision, we ensure appropriate safeguards, such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated by reference where needed.
7. Assistance
Taking into account the nature of the processing, we help you respond to requests from data subjects and meet your obligations on security, breach notification, impact assessments and consultations. Requests sent to us directly by your users will be passed on to you.
8. Personal data breaches
We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
9. Deletion and return
Check logs are deleted automatically after 90 days. When the service ends, we delete the remaining personal data processed on your behalf within 30 days, unless the law requires us to keep it. As we do not store data from checks in clear text, it cannot be returned in clear text.
10. Audits
We make available the information needed to demonstrate compliance with this DPA and answer reasonable written questions. Where that is not enough, we allow audits by you or an auditor you appoint, with reasonable notice, at your cost and bound by confidentiality, no more than once a year unless required by a supervisory authority.
11. Liability and precedence
The liability provisions of the Terms of Service apply. If this DPA and the Terms conflict, this DPA prevails for data protection matters. If you need a signed copy, write to support@signupvet.com.