This Data Processing Agreement ("DPA") forms part of, and is subject to, the Customer Agreement between Blob Engineering Pte. Ltd., a company incorporated under the laws of Singapore ("Superbridge"), and the entity identified in the applicable Order Form ("Client") (together, the "Parties").
Capitalised terms not defined in this DPA have the meaning given in the Customer Agreement. In the event of a conflict between this DPA and the Customer Agreement with respect to the Processing of Personal Data, this DPA controls. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control.
Where the Customer Agreement is incorporated as a Supplier Term under a reseller agreement between Superbridge and an Authorised Reseller, references to "Client" in this DPA include a customer procuring the Services through that Authorised Reseller, the applicable Order Form may be submitted by the Authorised Reseller on Client's behalf, and the definitions of "Authorised Reseller", "Resold Services" and "Servicer" in the Customer Agreement apply to this DPA.
1. Definitions
- "Applicable Data Protection Law" means all laws and regulations applicable to a Party's Processing of Personal Data under this DPA, including as applicable: the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as incorporated into UK law by the Data Protection Act 2018 and the European Union (Withdrawal) Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the Singapore Personal Data Protection Act 2012 ("PDPA"); and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
- "Client Personal Data" means Personal Data contained within Service Data and Customer Data that Superbridge Processes on behalf of Client under the Customer Agreement, as described in Annex I.
- "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in the GDPR. "Business", "Service Provider", "Sell" and "Share" have the meanings given in the CCPA.
- "Restricted Transfer" means a transfer of Personal Data to a country or territory that is not the subject of an adequacy decision under Applicable Data Protection Law, where such transfer would be prohibited absent an appropriate transfer mechanism.
- "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
- "Sub-processor" means any third party engaged by Superbridge to Process Client Personal Data.
- "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018, version B1.0.
2. Roles of the Parties
2.1 Superbridge as Processor. With respect to Client Personal Data described in Annex I, Part A, Client is the Controller and Superbridge is the Processor. Superbridge will Process such Personal Data only on Client's documented instructions, as set out in Section 3.
2.2 Superbridge as independent Controller. Client acknowledges that Superbridge acts as an independent Controller, and not as Client's Processor, with respect to the categories of Personal Data described in Annex I, Part B. This includes Personal Data Processed for:
- Sanctions, anti-money laundering and fraud screening. Superbridge screens blockchain addresses transacting through the Services against sanctions and risk datasets in order to comply with legal obligations to which Superbridge is itself directly subject, and to manage its own risk. As stated in Section 9 of the Customer Agreement, this screening is not a compliance service provided to Client.
- Security, abuse prevention and audit logging, including retention of records evidencing access to and administration of the Services.
- Administration of Dashboard accounts (where Superbridge has granted such access) held by Client's Authorized Users, including authentication credentials and records of acceptance of legal terms.
- Billing and account administration, including Personal Data provided to Superbridge's payment processor.
- Usage Data, being aggregated and de-identified data as defined in the Customer Agreement.
Where Superbridge acts as an independent Controller, each Party is independently responsible for its own compliance with Applicable Data Protection Law, and neither Party is a joint Controller with the other.
2.3 Client obligations as Controller. Client warrants that it has, and will maintain throughout the term:
- a valid lawful basis under Applicable Data Protection Law for the Processing of Client Personal Data and for its disclosure to Superbridge;
- all notices, disclosures and, where required, consents necessary for Superbridge and its Sub-processors to Process Client Personal Data as contemplated by this DPA and the Customer Agreement; and
- a privacy policy that accurately describes its collection, Processing and use of End User data in connection with the Services, as required by Section 5.6 of the Customer Agreement, including disclosure that blockchain addresses may be subject to compliance screening.
2.4 Client-configured third-party services. The Services permit Client to configure its own third-party analytics and monitoring services on its Bridge Interface, including Google Analytics measurement IDs, PostHog project keys and hosts, and Sentry DSNs. Where Client configures such a service, Superbridge's sole role is to load that service on Client's instruction. Client is the Controller with respect to all Personal Data collected by such services, those providers are Client's own processors or controllers and not Superbridge's Sub-processors, and Superbridge has no responsibility for their Processing. Superbridge separately operates its own analytics on Superbridge-branded properties as an independent Controller.
3. Instructions
3.1 Documented instructions. Superbridge will Process Client Personal Data only on Client's documented instructions, which comprise: (a) the Customer Agreement and this DPA; (b) Client's configuration of the Services through the Dashboard or API; and (c) any further written instruction agreed by the Parties. Superbridge will not Sell or Share Client Personal Data, and will not retain, use or disclose it for any purpose other than performing the Services or as otherwise permitted by Applicable Data Protection Law.
3.2 Unlawful instructions. Superbridge will notify Client if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law, unless prohibited from doing so by law. Superbridge may suspend performance of the affected instruction until it is amended or confirmed.
3.3 Legally required Processing. Superbridge may Process Client Personal Data where required by law to which it is subject, and will inform Client of that requirement before Processing unless the law prohibits such notice on important grounds of public interest.
3.4 Conflict with regulatory obligations. Client acknowledges that Superbridge may be unable to comply with an instruction to delete or restrict Processing of records that Superbridge is required to retain under anti-money laundering, sanctions, tax or financial record-keeping obligations. In such a case Superbridge will notify Client, will retain only what is required for as long as it is required, and will restrict Processing of the retained records to the purpose that requires their retention.
4. Confidentiality and personnel
Superbridge will ensure that persons authorised to Process Client Personal Data are bound by an appropriate obligation of confidentiality, receive training appropriate to their role, and have access to Client Personal Data only to the extent necessary to perform their duties.
5. Security
5.1 Technical and organisational measures. Superbridge will implement and maintain the technical and organisational measures set out in Annex II, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing, and the risks to Data Subjects.
5.2 Changes to measures. Superbridge may update the measures in Annex II from time to time provided that the updated measures do not materially reduce the overall level of security.
5.3 Client responsibilities. Client is responsible for the security of its own systems, its Bridge Interface, its Authorized Users' credentials, and any API keys issued to it. Client will enable available security controls (including, where Superbridge has granted Client access to the Dashboard, multi-factor authentication on Dashboard accounts), and will promptly de-provision Authorized Users who no longer require access.
6. Personal Data Breach
6.1 Notification. Superbridge will notify Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data.
6.2 Content of notification. The notification will describe, to the extent then known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where the information cannot be provided at once, it may be provided in phases without undue further delay.
6.3 Assistance. Superbridge will provide reasonable assistance to Client in meeting Client's own notification obligations to Supervisory Authorities and Data Subjects. Notification of a Personal Data Breach is not an acknowledgement of fault or liability by Superbridge.
6.4 Client notifications. Client is solely responsible for determining whether to notify Supervisory Authorities or Data Subjects, and for making such notifications. Client will not identify Superbridge by name in any public notification without Superbridge's prior written consent, except where required by law.
7. Sub-processors
7.1 General authorisation. Client grants Superbridge general written authorisation to engage Sub-processors. Superbridge's current Sub-processors are listed in Annex III.
7.2 Notice of changes. Superbridge will give Client at least thirty (30) days' notice before engaging a new Sub-processor, by email to Client's notice address specified in the applicable Order Form (or, in respect of Resold Services, to the Authorised Reseller) and by updating the sub-processor page at superbridge.app/legal/sub-processors. Client may object on reasonable grounds relating to data protection within that period. If the Parties cannot resolve the objection in good faith, Client may terminate the affected Services on written notice and receive a pro-rated refund of prepaid Fees for the unused portion of the then-current Subscription Term (any refund in respect of Resold Services being payable to the Authorised Reseller in accordance with the Customer Agreement).
7.3 Sub-processor terms. Superbridge will impose on each Sub-processor data protection obligations no less protective than those in this DPA, and remains fully liable to Client for the performance of each Sub-processor's obligations.
7.4 Blockchain networks and third-party protocols are not Sub-processors. Client acknowledges that public blockchain networks, bridge and interoperability protocols, decentralised exchanges, liquidity sources, wallet providers and fiat on-ramp providers accessible through or in connection with the Services are not Sub-processors and are not under Superbridge's control. Where an End User transmits a transaction to a public blockchain, or elects to use a third-party on-ramp, that data is disclosed to independent third parties and to the public. Superbridge does not determine and cannot control the purposes or means of that Processing.
8. Data Subject rights
8.1 Assistance. Taking into account the nature of the Processing, Superbridge will assist Client by appropriate technical and organisational measures, insofar as reasonably possible, to fulfil Client's obligation to respond to requests to exercise Data Subject rights under Applicable Data Protection Law.
8.2 Requests received directly. If Superbridge receives a request from a Data Subject relating to Client Personal Data, Superbridge will not respond to the request other than to acknowledge it and direct the Data Subject to Client, unless legally required to respond or otherwise instructed by Client.
8.3 Limits arising from distributed ledger technology. Client acknowledges that data recorded on a public blockchain is, by design, immutable, replicated across independently operated nodes, and outside the control of any party to this DPA. Neither Party can rectify, erase, restrict or port Personal Data once it has been written to such a network. Superbridge's obligations under this Section extend only to Personal Data held within systems that Superbridge controls, and do not extend to data recorded on, or independently re-published from, any public blockchain.
8.4 Pseudonymous identifiers. Where Superbridge holds Client Personal Data consisting only of pseudonymous identifiers such as blockchain addresses and transaction hashes, and is not in a position to identify the Data Subject, Superbridge is not required to acquire additional information in order to identify a Data Subject for the sole purpose of complying with a request, in accordance with Article 11 GDPR. Superbridge will inform Client where this applies.
9. Data protection impact assessments
Superbridge will provide Client with reasonable assistance in carrying out data protection impact assessments and prior consultations with Supervisory Authorities, in each case solely in relation to Processing by Superbridge of Client Personal Data and taking into account the information available to Superbridge.
10. Audit
10.1 Information. Superbridge will make available to Client all information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, which may be satisfied by providing Superbridge's then-current security documentation, a description of the measures set out in Annex II, responses to a reasonable security questionnaire, and, if and when Superbridge obtains them, third-party audit reports or certifications. Superbridge does not currently hold a SOC 2 or ISO 27001 certification.
10.2 On-site audit. Where the information provided under Section 10.1 is not sufficient to demonstrate compliance, Client may, on at least thirty (30) days' prior written notice, no more than once in any twelve (12) month period, and subject to reasonable confidentiality undertakings, conduct an audit of Superbridge's Processing of Client Personal Data. Audits will be conducted during business hours, will not unreasonably interfere with Superbridge's operations, and will not extend to any data, systems or premises relating to Superbridge's other customers. Client bears its own costs and Superbridge's reasonable costs of supporting the audit, save where the audit reveals material non-compliance by Superbridge.
10.3 Additional audits. Client may conduct an additional audit following a Personal Data Breach affecting Client Personal Data, or where required by a Supervisory Authority.
11. International transfers
11.1 Transfer mechanism. Superbridge is established in Singapore and hosts the Services in the United States. To the extent that Superbridge's Processing of Client Personal Data involves a Restricted Transfer, the Parties agree that the transfer is governed by the applicable module of the Standard Contractual Clauses, which are incorporated into this DPA by reference and completed as follows:
- Module Two (Controller to Processor) applies where Client is a Controller established in, or subject to the GDPR in respect of, the EEA. Module Three (Processor to Processor) applies where Client is itself a Processor acting on behalf of a third-party controller.
- Clause 7 (docking clause) applies.
- Clause 9: Option 2, general written authorisation, with a notice period of thirty (30) days, as set out in Section 7.2.
- Clause 11: the optional independent dispute resolution language does not apply.
- Clause 17: the Clauses are governed by the law of Ireland.
- Clause 18(b): disputes will be resolved before the courts of Ireland.
- Annex I, II and III to the SCCs are populated by Annex I, Annex II and Annex III to this DPA respectively.
- The competent Supervisory Authority for the purposes of Annex I.C is determined in accordance with Clause 13.
11.2 United Kingdom. In respect of Restricted Transfers subject to the UK GDPR, the SCCs apply as varied by the UK Addendum. Table 1 is completed with the Parties' details set out in the Customer Agreement; Tables 2 and 3 are completed by reference to Section 11.1 and the Annexes to this DPA; and in Table 4, neither Party may end the UK Addendum as set out in Section 19 of the UK Addendum.
11.3 Switzerland. In respect of Restricted Transfers subject to the FADP, references in the SCCs to the GDPR are to be understood as references to the FADP, the competent authority is the Swiss Federal Data Protection and Information Commissioner, and the term "member state" must not be interpreted to exclude Data Subjects in Switzerland from enforcing their rights in their place of habitual residence.
11.4 Alternative mechanisms. If Superbridge adopts an alternative lawful transfer mechanism recognised under Applicable Data Protection Law, that mechanism will apply in place of the mechanisms in this Section on written notice to Client, provided it affords no lesser protection.
11.5 Government access requests. Superbridge will, to the extent legally permitted, notify Client of any legally binding request by a public authority for disclosure of Client Personal Data, will challenge requests that it considers unlawful, and will disclose only the minimum amount of data lawfully required.
11.6 PDPA transfer limitation. As a Singapore-incorporated Processor, Superbridge also takes contractually appropriate steps to satisfy its own transfer limitation obligation under the Singapore Personal Data Protection Act 2012 when Client Personal Data is transferred outside Singapore, including to its hosting provider.
12. CCPA
Where Superbridge Processes Personal Data of California residents on Client's behalf, Superbridge acts as a Service Provider. Superbridge is prohibited from, and will not: (a) Sell or Share such Personal Data; (b) retain, use or disclose it for any purpose other than the business purposes specified in the Customer Agreement, including retaining, using or disclosing it for a commercial purpose other than providing the Services; or (c) combine it with Personal Data received from another source, except as permitted by the CCPA. Superbridge certifies that it understands and will comply with these restrictions.
13. Deletion and return
13.1 On termination. On expiry or termination of the Customer Agreement, Superbridge will, at Client's election, delete or return Client Personal Data, and delete existing copies, within ninety (90) days, save to the extent that Superbridge is required to retain a copy by law to which it is subject.
13.2 Retained data. Any Client Personal Data retained under Section 13.1 remains subject to this DPA, and Superbridge will restrict Processing of it to the purpose requiring its retention.
13.3 Backups and blockchain data. Client acknowledges that data contained in routine encrypted backups is deleted in accordance with Superbridge's backup rotation cycle, currently seven (7) days, rather than on demand, and that Superbridge cannot delete data recorded on a public blockchain, for the reasons set out in Section 8.3.
14. Liability
Each Party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in Section 10 of the Customer Agreement. Nothing in this DPA limits any liability that cannot be limited under Applicable Data Protection Law, including a Data Subject's rights under Clause 12 of the SCCs.
15. Term and general
This DPA takes effect on the date the Customer Agreement takes effect, or on the date it is countersigned if later, and continues until Superbridge ceases to Process Client Personal Data. Sections 4, 5, 6, 8.3, 11, 13 and 14 survive termination. This DPA is governed by the law stated in Section 16.1 of the Customer Agreement, except where Applicable Data Protection Law or the SCCs require otherwise. Prior versions of this DPA are archived and available on request at superbridge.app/legal/archive.
Annex I — Description of Processing
Part A — Processing by Superbridge as Processor
Categories of Data Subjects
- End Users who access a Bridge Interface deployed or embedded by Client.
- Client's Authorized Users (including, in respect of Resold Services, the Authorised Reseller and its Servicers acting on Client's behalf), in respect of activity carried out on Client's behalf through the Dashboard (where access has been granted) and API.
Categories of Personal Data
| Category | Detail |
|---|---|
| Blockchain identifiers | Sender and recipient addresses across EVM and non-EVM chains, treated as Personal Data where a Data Subject is identifiable directly or indirectly. |
| Transaction records | Transaction hashes, origin and destination chain, token, amount, route and provider selected, status, timestamps, fees, and refund records. |
| Technical and connection data | IP address, user agent, request path and method, origin, and response metadata. |
| Derived location | Country or region inferred from IP address, used for jurisdictional access control. |
| Configuration and support data | Data submitted by Client or its Authorized Users in configuring a Bridge Instance, and correspondence relating to support requests. |
Special categories of data. None. Client must not submit, and must not configure its Bridge Interface to transmit to Superbridge, any special category Personal Data within the meaning of Article 9 GDPR, or any data relating to criminal convictions and offences, or any data of children below the age of digital consent.
Nature and purpose of Processing. Hosting and operating a configurable Bridge Interface; quoting, routing and indexing cross-chain bridge and swap transactions; displaying transaction status and history to End Users; providing support and operational monitoring to Client.
Frequency of transfer. Continuous, for the duration of the Subscription Term.
Duration of Processing. For the duration of the Subscription Term, plus the deletion period set out in Section 13.1, subject to the retention periods below.
Retention. Transaction and indexing records are retained for the duration of the Subscription Term in order to provide transaction history to End Users, and are then deleted or returned in accordance with Section 13.1. Indexer service logs are retained for seven (7) days. Application request logs written by the API service, which include the connecting IP address, are retained for ninety (90) days. Records retained under a legal obligation are retained for the period that obligation requires.
Part B — Processing by Superbridge as independent Controller
| Category of data | Data Subjects | Purpose | Lawful basis (GDPR) |
|---|---|---|---|
| Blockchain addresses submitted for screening | End Users | Sanctions and illicit-finance screening prior to processing a transaction | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| IP address, user agent, request metadata in security and audit logs | End Users, Authorized Users | Security monitoring, abuse and fraud prevention, incident investigation, evidencing administrative access | Legitimate interests (Art. 6(1)(f)) |
| Name, email address, password hash, two-factor authentication secret and recovery codes, session and refresh token hashes, records of terms and privacy policy acceptance | Authorized Users | Provision and security of Dashboard accounts; evidencing acceptance of legal terms | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Billing contact details and payment processor identifiers | Client's billing contacts | Invoicing, payment collection, financial record-keeping | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Aggregated, de-identified Usage Data | — | Operating, maintaining, improving and developing the Services | Legitimate interests (Art. 6(1)(f)), to the extent Personal Data is involved |
Retention of Part B data. Dashboard account records are retained for the life of the account and deleted on account closure, subject to any legal retention obligation. Security and audit records — which include actor email address, IP address and user agent — are retained for the duration of the Client relationship and thereafter for so long as required for security, audit, dispute resolution and legal record-keeping purposes. These records are not presently subject to an automated deletion schedule. Superbridge will review the necessity of continued retention of these records at least annually. Screening results are retained as required to evidence compliance with the sanctions and anti-money laundering obligations to which Superbridge is subject.
Annex II — Technical and organisational measures
The following describes the measures in place at the date of this DPA.
Infrastructure and network security. The Services are hosted on Amazon Web Services in the United States. Application and database resources run within a dedicated virtual private cloud with segregated subnets. Database instances are not publicly routable and are reachable only from application security groups or via a controlled bastion host. Address-screening infrastructure is deployed in full isolation: it accepts ingress only from the API service security group, has no database access, no load balancer or internet exposure, and no interactive shell access.
Edge protection. Public traffic is fronted by Cloudflare, providing TLS termination, DNS, and web application firewall and bot-mitigation controls. Cloudflare Turnstile is applied to sensitive public endpoints to mitigate automated abuse.
Encryption. Personal Data is encrypted in transit using TLS. The managed database is encrypted at rest using AWS Key Management Service. Runtime configuration and secrets are held in a managed secrets store, encrypted with a dedicated customer-managed key.
Access control and authentication. Dashboard passwords are stored only as salted hashes. Time-based one-time-password two-factor authentication is available, with single-use recovery codes. Sessions use refresh tokens stored as hashes, with token rotation, explicit expiry and revocation. Dashboard access is limited to Superbridge personnel and, where granted at Superbridge's discretion, Client's Authorized Users; End Users have no access to the Dashboard or any administrative surface. Administrative and infrastructure access is limited to named personnel on a least-privilege basis, and secrets are held outside application code and source control.
Logging, monitoring and auditability. Administrative and privileged actions across the admin and Dashboard surfaces are written to an append-only audit log recording actor, role, session, action, target, outcome, correlation identifier, IP address and user agent. Application logs and traces are collected via CloudWatch and OpenTelemetry instrumentation. Indexer log groups are retained for seven (7) days and address-screening log groups for thirty (30) days.
Error monitoring. Client-side error reporting is filtered before transmission to reduce incidental capture of unnecessary data.
Segregation. Client configurations, Bridge Instances and API projects are logically segregated and scoped by identifiers enforced at the application layer.
Resilience and continuity. Automated database backups are enabled and run daily, with a retention period of seven (7) days. Backups inherit the encryption at rest described above. Network, compute and edge infrastructure is defined as code and version controlled, enabling reproducible rebuild.
Personnel. Personnel with access to Personal Data are subject to written confidentiality obligations. Access is reviewed on role change and revoked on termination.
Sub-processor governance. Sub-processors are subject to written data protection terms as required by Section 7.3.
Annex III — Authorised Sub-processors
| Sub-processor | Purpose | Personal Data involved | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, managed database, object storage, logging, key management | All categories in Annex I | United States |
| Cloudflare, Inc. | DNS, CDN, TLS termination, WAF, bot mitigation (Turnstile) | IP address, connection metadata | Global edge network |
| TRM Labs, Inc. | Blockchain address risk and sanctions screening | Blockchain addresses | United States |
| Stripe, Inc. | Billing and payment processing | Billing contact details, payment identifiers | United States, Ireland |
| Mailgun Technologies, Inc. | Transactional email delivery | Email address, name, message content | United States |
| Functional Software, Inc. d/b/a Sentry | Application error monitoring on Superbridge-operated properties | Technical and connection data | United States |
Not Sub-processors. ZeroShadow address-screening software is deployed and operated by Superbridge within its own isolated infrastructure and does not transmit Client Personal Data to a third party. Public blockchain networks, bridge and interoperability protocols, liquidity sources, wallet providers and fiat on-ramp providers are not Sub-processors, as set out in Section 7.4. Analytics and monitoring services configured by Client on its own Bridge Interface are not Sub-processors, as set out in Section 2.4.
This DPA is incorporated by reference into the Customer Agreement and takes effect without signature; a countersigned copy is available on request. Prior versions are archived at superbridge.app/legal/archive. For data protection enquiries: [email protected].