Legal
Data Processing Agreement
Last updated: 7 September 2026
1. Scope and roles
This DPA applies where the customer (Controller) submits personal data to Nymetric (Processor) for the service. Nymetric is a controller for its separate account, security, business-contact and legal-compliance processing. Applicable Data Protection Law means the UK GDPR, Data Protection Act 2018 and other law applicable to the processing.
2. Processing details
- Subject matter
- Business-to-business name comparison and associated service operation.
- Duration
- For the term of the services and the deletion period described below.
- Nature and purpose
- Receiving two names, comparing them locally and deterministically, returning a result, and maintaining limited usage/security metadata.
- Data types
- Customer and cardholder names in transit; optional non-personal merchant correlation identifiers; request/result metadata and related technical identifiers.
- Data subjects
- The Controller's customers, cardholders or other individuals whose names it lawfully submits, and authorised merchant personnel.
3. Controller instructions and obligations
The Processor will process personal data only on documented instructions, including the agreement and authorised use of the API, unless required by law. It will inform the Controller before legally required processing unless prohibited. The Controller is responsible for lawful instructions, transparency, accuracy and an appropriate legal basis. The Processor will notify the Controller if it believes an instruction infringes applicable Data Protection Law.
4. Confidentiality and security
The Processor will ensure authorised personnel are subject to confidentiality and implement appropriate technical and organisational measures proportionate to risk, including access controls, credential hashing, tenant-scoped authorisation, encryption in transit, rate limiting, audit logging and retention controls. These measures do not amount to a certification or absolute security guarantee.
5. Subprocessors
The Controller grants general written authorisation to use subprocessors. Current subprocessors are identified in the Subprocessor Notice. Nymetric will provide reasonable advance notice of a material change, allow reasonable data-protection objections, impose materially equivalent data-protection obligations, and remain responsible for its subprocessors' performance to the extent required by law.
6. International transfers
Nymetric does not promise UK-only processing. Where processing involves a restricted international transfer, the parties and relevant subprocessors will use an applicable lawful transfer mechanism, such as adequacy regulations, the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, as appropriate.
7. Assistance
Taking account of the nature of processing and information available, Nymetric will reasonably assist the Controller with data-subject requests and with security, breach notification, data-protection impact assessments and regulator consultation obligations. The Controller remains responsible for responding to individuals unless law requires otherwise.
8. Incidents
Nymetric will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller data and provide information reasonably available to support the Controller's obligations. Contact: security@nymetric-match.com.
9. Return and deletion
On termination and at the Controller's choice where applicable, Nymetric will delete or return Controller personal data, unless law requires retention. Operational deletion will normally complete within 90 days, subject to backup cycles, legal obligations and claims. Current self-service tenant export and deletion tooling is limited; requests should be sent to privacy@nymetric-match.com.
10. Information and audit
Nymetric will make information reasonably necessary to demonstrate compliance with Article 28 obligations available to the Controller and permit reasonable audits, including inspections, subject to proportionate notice, confidentiality, security, non-disruption and allocation of reasonable costs. The parties will first use current independent evidence and questionnaires where suitable.
11. Priority and liability
This DPA prevails over conflicting data-processing terms in the main agreement. Liability under it is subject to the agreed contractual liability framework to the extent lawful.
Contact
Privacy: privacy@nymetric-match.com. Legal: legal@nymetric-match.com.