This Data Processing Agreement ("DPA") applies to Customer's use of the Polyterminus Service to the extent ARCADA LLC processes personal data on Customer's behalf. It supplements the Terms of Service.
1. Definitions
- Controller / Processor / Data Subject / Personal Data have the meanings given in the EU General Data Protection Regulation 2016/679 ("GDPR") and equivalent laws.
- Customer is you or the entity you represent that has agreed to the Terms.
- Sub-processor is a third party engaged by us to process personal data on Customer's behalf.
2. Roles
Where ARCADA LLC processes personal data on behalf of Customer (e.g. Customer's end-users' account records, trading preferences), ARCADA LLC is the Processor and Customer is the Controller.
3. Subject-matter and duration
Subject-matter: provision of the Polyterminus Service to Customer. Duration: for the term of Customer's subscription plus 90 days for backup rotation.
4. Nature and purpose of processing
Hosting user accounts, storing encrypted signer credentials, executing user-initiated actions, delivering AI features, sending platform notifications, and generating usage telemetry needed to operate the Service.
5. Categories of personal data
Account identifiers, contact email, encrypted Polymarket signer key, trading preferences, watchlists, alert rules, usage events. Categories of data subjects: Customer and Customer's authorised end-users.
6. Processor obligations
ARCADA LLC shall: (a) process personal data only on documented instructions from Customer; (b) ensure that authorised personnel are subject to confidentiality obligations; (c) implement appropriate technical and organisational measures (encryption at rest and in transit, least-privilege access, audit logs); (d) assist Customer in responding to data-subject requests and regulator inquiries; (e) notify Customer without undue delay of any personal data breach that affects Customer's personal data; (f) at the end of the term, delete or return all personal data at Customer's choice.
7. Sub-processors
Customer authorises ARCADA LLC to engage the following current sub-processors:
- Google Cloud (Ireland) Limited — infrastructure hosting, Firestore, Cloud Run, Secret Manager. EU region.
- Sentry (Functional Software, Inc.) — error monitoring. US, with EU-region data-residency add-on where enabled.
- Stripe Payments Europe, Ltd — payment processing for paid plans.
- AI providers (OpenRouter Inc., Anthropic PBC, Google Ireland Ltd) — invoked only when Customer\'s users use AI features and depending on cascade routing.
ARCADA LLC will notify Customer of any change to this list at least 30 days in advance and give Customer a reasonable opportunity to object.
8. International transfers
To the extent personal data is transferred outside the EEA or UK, ARCADA LLC relies on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, as applicable, incorporated by reference into this DPA.
9. Audit rights
ARCADA LLC will provide Customer with reasonably requested information to demonstrate compliance (SOC 2 report, penetration-test summaries, security whitepaper) when available. On-site audits may be conducted at Customer's expense, no more than once per year, with 30 days' notice.
10. Liability
The liability limits set out in the Terms of Service apply to claims arising under this DPA to the extent permitted by law.
11. Contact
Data-protection matters: privacy@polyterminus.com.