Effective Date: 2026-09-17
Data Processing Agreement
This Data Processing Agreement ("DPA") is between Zoyn Technologies Inc., a Wyoming corporation, doing business as "Zoyn" ("Zoyn" or "Processor") and the merchant that has accepted the Zoyn Merchant Services Agreement ("Merchant" or "Controller"). It forms part of, and is incorporated into, the Merchant Services Agreement at /legal/merchant-services-agreement (the "MSA"), and through it the Terms of Service. It governs Zoyn's processing of personal data for the Merchant where the Merchant is the controller, and it also stands alone as a data-processing agreement for GDPR Article 28, UK GDPR Article 28, and equivalent laws.
1. Definitions
"Personal data," "controller," "processor," "data subject," "processing," "personal data breach," and "supervisory authority" have the meanings given in the applicable data-protection law (the GDPR, the UK GDPR, the CCPA/CPRA, and equivalent laws, as applicable). For CCPA/CPRA purposes Zoyn acts as a "service provider" for the Merchant's personal information. Other capitalized terms have the meanings in the MSA.
2. Roles
The Merchant is the controller of personal data of its buyers and end-users that passes through Zoyn's systems. Zoyn is the processor of that data, acting on the Merchant's documented instructions.
Zoyn does not provide merchant payroll or employee/contractor payout processing; payroll calculation, recipient records, and payroll payments are outside the Platform.
Zoyn is the controller of the Merchant's own account and operational data, and of the account records of the Merchant's Authorized Users who hold a Zoyn login. That processing is covered by the Privacy Policy at /legal/privacy-policy, not by this DPA.
3. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Configuration and orchestration of stablecoin payments settled on-chain through thirdweb |
| Duration | The term of the MSA, and thereafter for as long as Zoyn retains the data under Section 13 |
| Nature of processing | Receiving and storing payment event notifications; storing the Merchant's transaction records; forwarding events to endpoints the Merchant configures; sending receipts and payment requests on the Merchant's instruction; producing reports and exports |
| Purpose | Enabling the Merchant to receive, reconcile, and report on payments |
| Data subjects | The Merchant's buyers and end-users who start payments |
| Personal data — buyers | Buyer wallet address; the payment event notification as received from thirdweb, stored in full and not limited to the fields Zoyn reads; amount, token, chain, transaction hash, status, and timestamps; buyer email and sometimes name, only where the Merchant used a feature that needs one (an invoice addressed to a named payer, a recurring payment request, or a receipt Zoyn sends for the Merchant); and the content the Merchant placed on the payment page |
| Special categories | None intended. The Merchant must not send special-category data (GDPR Art. 9) or criminal-offence data (Art. 10) through the Platform. |
3.1 Limits
Zoyn holds no buyer identity and does not track buyer funds. Zoyn runs no buyer account, assigns no buyer identifier, links no buyer's payments together, and derives, stores, or tracks no buyer's balance or holdings. Section 10 states the consequence for data-subject requests.
Zoyn does not receive, and has no field for, payment-card data, cardholder names, or customer-due-diligence records. Where a buyer funds a purchase by card or bank transfer, that step is handled by a licensed on-ramp or hosted-checkout provider as an independent controller under its own terms, and Zoyn receives only the resulting payment event notification.
4. Documented instructions
The Merchant instructs and authorizes Zoyn to process personal data to:
- perform the services described in the MSA and Terms of Service;
- store transaction records for the Merchant's access and reconciliation;
- forward webhook events to URLs the Merchant configures;
- send receipts and payment requests to email addresses the Merchant supplies or configures;
- produce reports and exports the Merchant requests;
- detect fraud and abuse patterns;
- screen wallet addresses against a public on-chain sanctions oracle, as described in Privacy Policy §15; and
- comply with legal obligations.
The Merchant may give additional written instructions that are reasonable in scope. Zoyn may decline instructions that conflict with applicable law or the MSA, and will tell the Merchant if it believes an instruction infringes data-protection law. Zoyn processes personal data only on these documented instructions, including as to international transfers, unless the law requires otherwise, in which case Zoyn will tell the Merchant before processing unless the law prohibits it.
5. Confidentiality
Zoyn ensures that people authorized to process personal data are bound by appropriate confidentiality obligations.
6. Sub-processors
6.1 Authorization. The Merchant gives Zoyn general authorization to engage sub-processors. The current list is Privacy Policy Annex B, Part 1, which is adopted into this DPA
6.2 thirdweb is not a Zoyn sub-processor. Non-Fungible Labs, Inc. d/b/a thirdweb operates the payment infrastructure, hosted checkout, settlement-contract execution, and vendor payment records under its own terms and decides the purposes and means of that processing. thirdweb is an independent controller for the data it collects or generates in running those services; Zoyn receives the payment event notification needed for the Merchant's record and processes that notification under this DPA. thirdweb's role is described the same way in the Privacy Policy.
6.3 Changes and objection. Zoyn will notify the Merchant at least 30 days before adding or replacing a sub-processor. The Merchant may object on reasonable data-protection grounds within 14 days of the notice. If the objection cannot be resolved, the Merchant may terminate the affected processing services. Removing a sub-processor, or correcting a statement in the list so it describes processing already happening, is not an addition and does not carry the 30-day notice.
6.4 Provider terms and liability. Each sub-processor processes personal data under its own published data-processing terms, which Zoyn checks cover confidentiality, security, and assistance obligations appropriate to the processing. Zoyn does not represent that a separately negotiated agreement is signed with any provider. Zoyn remains fully liable to the Merchant for each sub-processor's performance of Zoyn's obligations under this DPA.
7. International transfers
Zoyn is established in the United States, and the Merchant should assume personal data processed under this DPA is transferred to and processed in the United States. For transfers from the EEA, UK, or Switzerland to a country without an adequacy decision, Zoyn relies on the EU Standard Contractual Clauses (Commission Decision 2021/914), the UK International Data Transfer Addendum, or another valid mechanism under applicable law. Where a sub-processor's published data-processing terms include such a mechanism, Zoyn relies on those terms, and does not represent that any separately negotiated transfer agreement is signed.
Some sub-processors operate globally distributed infrastructure. A description of the safeguards is available on request.
8. Security
Zoyn maintains administrative, technical, and physical safeguards appropriate to the risk, including encryption of personal data in transit and of sensitive data at rest, role-based access control, logging of actions on merchant data, separation of each merchant's data, and incident response procedures. Zoyn may update these measures provided it does not materially reduce the overall protection of personal data.
A plain-English security summary is at /legal/security-overview.
9. Personal data breach
If there is a personal data breach affecting personal data Zoyn processes under this DPA, Zoyn will:
- notify the affected Merchant without undue delay after becoming aware of it, so that the Merchant can meet its own notification obligations under applicable law;
- provide the information the Merchant needs to meet its obligations to supervisory authorities and data subjects, as it becomes available; and
- cooperate in investigation and remediation.
If a breach affects multiple Merchants, Zoyn may give initial notice on zoyn.com/status or in the dashboard, followed by individual email.
10. Data subject requests
If Zoyn receives a request from a data subject (for example, a buyer) directed to Zoyn, Zoyn will tell the requester to direct it to the Merchant as controller, forward it to the Merchant, and give the Merchant reasonable technical help to fulfil it.
Zoyn can locate a record given a transaction reference, wallet address, or email address, and the Merchant can export its records through the Platform. Zoyn's records are not organized by person, so Zoyn cannot search for an individual without one of those identifiers.
If the Merchant fails to act on a request directed to it, Zoyn may take direct action to the extent the law requires and Zoyn's systems allow, subject to Section 13. Zoyn does not undertake to erase a record Section 13.1 describes as kept long-term.
11. Assistance
Taking into account the nature of the processing and the information available to it, Zoyn will give the Merchant reasonable assistance with data protection impact assessments, prior consultations with supervisory authorities, and the Merchant's security obligations, where relevant to the processing under this DPA.
12. Audits
Zoyn will make available information reasonably necessary to demonstrate compliance with this DPA, which may be provided as written answers to a reasonable security questionnaire, no more than once every 12 months. Where applicable law or a supervisory authority requires an audit or inspection, the Merchant may conduct one on at least 30 days' notice, at its own cost, during business hours, under confidentiality, and without disrupting Zoyn's operations.
13. Return and deletion
On termination of the MSA, Zoyn will:
- make the Merchant's records available for export, on request, for a reasonable period after termination;
- delete or anonymize personal data only as Section 13.1 describes; and
- continue to keep records the law requires (for example, transaction records for tax and record-keeping purposes).
The retention position applies notwithstanding termination.
13.1 What Zoyn can delete and what it cannot
Zoyn does not operate an erasure or automatic-deletion function, and Privacy Policy §8 sets no period after which a record is removed. Deletion under this DPA is therefore a manual act, limited to what Zoyn's systems allow.
Some records — including audit logs, payment records, and acceptance records — are kept long-term and are designed not to be changed or deleted; this DPA does not require Zoyn to delete them, and Zoyn does not undertake to do so. Where a record is withdrawn, Zoyn's systems mark it as deleted and stop using it rather than removing it.
Zoyn may delete or anonymize other personal data on the Merchant's written instruction, where its systems allow and no legal obligation requires the record to be kept.
14. Liability
Liability under this DPA is subject to the limitations in the MSA (Section 13) and the Terms of Service (Section 15), applied as one cap and not stacked, except where applicable data-protection law does not allow liability to be limited.
15. Governing law
This DPA is governed by the law that governs the MSA, except where applicable data-protection law requires otherwise (including where the Standard Contractual Clauses require the law of an EU member state or of England and Wales).
16. Order of precedence
If this DPA conflicts with the MSA or the Terms of Service on a matter concerning personal data processing, this DPA prevails for that matter. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.
17. Updates
Zoyn may update this DPA. Material changes will be notified at least 30 days before they take effect, and are subject to the re-acceptance terms of MSA §17. Changes needed urgently for legal, regulatory, or security reasons may take effect sooner, with notice as soon as practical.
18. Contact
DPA and data-protection matters: dev@zoyn.com, subject "Privacy".