Supplier Data Processing Agreement

Purpose and scope

This Supplier DPA applies when a supplier processes Personal Data for MatosPay or a MatosPay service. The supplier may receive only the information, access, and permissions needed for the contracted service. The supplier must follow MatosPay’s documented instructions and the applicable statement of work.

Supplier obligations

The supplier will process Personal Data only for the service, keep it confidential, use authorized personnel, maintain appropriate safeguards, assist with rights and incidents, return or delete information when instructed, and comply with applicable privacy and security law. The supplier may not sell, rent, use for unrelated advertising, or combine the information with unrelated datasets unless expressly authorized and legally permitted.

Security and personnel

The supplier will maintain access controls, authentication, least privilege, secure transmission, vulnerability management, logging, backups, incident response, business continuity, and training appropriate to risk. Personnel with access must have a business need and confidentiality obligation.

Subcontracting

A supplier may not appoint another processor that will access Personal Data without MatosPay’s written authorization or the authorization process in the supplier contract. The supplier remains responsible for its approved subprocessors and must flow down equivalent obligations.

Incidents and cooperation

The supplier will notify MatosPay without undue delay after becoming aware of a Personal Data incident, preserve evidence, contain the event, investigate, provide updates, and support legally required notifications. The supplier will not notify an affected person, regulator, or media about MatosPay data unless MatosPay directs it or the law requires it.

Audit and evidence

The supplier will provide reasonable security and privacy information, certifications, summaries, questionnaires, and audit assistance needed to demonstrate compliance. Reviews will be proportionate, confidential, and designed not to expose other customers or secure systems.

International transfers

The supplier must identify where Personal Data is accessed or stored and use the transfer mechanism required by MatosPay and applicable law. Transfer changes require advance notice where the contract requires it.

End of service

At the end of the service, the supplier will return or securely delete Personal Data and copies, except for legally required records or protected backups that are isolated and deleted under the supplier’s retention cycle.