Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer ("Customer") and Server Armour (Pty) Ltd trading as Trace Exit ("Processor" or "Trace Exit").

Standard Contractual Clauses (SCCs) and/or the UK IDTA may be attached for international customers on request.

Roles

• Customer = controller (or processor for its end users) for IP addresses and tags it submits
• Trace Exit = processor for customer-submitted IPs / tags; controller for account data, billing metadata, and aggregated corpus statistics

Data

• IP addresses submitted for lookup
• Optional `requestTag` (must not contain personal information beyond what Customer intentionally sends)
• Account email, organisation, and billing metadata
• Usage metering

Not processed under this DPA as product features: SteamIds, payment card PANs, device fingerprints outside the Trace Exit product lane.

Instructions

Trace Exit processes Customer personal information only to provide the service, comply with law, and as described in the Privacy Policy, unless Customer gives further documented instructions that Trace Exit accepts in writing.

Subprocessors

See the Subprocessors list. Customer authorises Trace Exit to engage those subprocessors. Material changes will be notified as described there. International transfers: SCCs / UK IDTA as applicable.

Security

Encryption in transit (TLS 1.2+); secrets in a secret manager; access audited; no raw IPs as metric labels.

Assistance and deletion

Trace Exit will assist Customer with reasonable data-subject requests and, on termination of the service relationship, delete or return Customer personal information in lookup/account systems within commercially reasonable periods, except where retention is required by law or for aggregated non-identifying statistics.