Version 1.3. Effective from 20 September 2026. Earlier versions and their acceptance records are preserved; acceptance of an earlier version is not acceptance of this version.
This page summarises the full Data Processing Agreement, version 1.3, including its processing and security annexes. The full agreement governs if there is a difference.
This DPA forms part of the agreement between the merchant (“Controller”) and LAUDATUS LTD, registered in England and Wales, company number 17453960, with registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ (“Processor”), for personal data processed on the merchant’s behalf through EUWithdraw. It applies when the merchant installs or uses EUWithdraw and is intended to satisfy Article 28 of the EU GDPR and UK GDPR where applicable. The authenticated app may also record explicit acceptance for the merchant’s account.
1. Scope and instructions
The Processor processes customer, order, withdrawal, communication, privacy-request and related workflow data only to provide and secure EUWithdraw, follow documented merchant configuration and instructions, assist with applicable privacy obligations, and comply with binding law. The merchant’s use and configuration of the service constitute documented instructions.
2. Confidentiality and security
Authorised personnel are bound to confidentiality and least-privilege access. Measures include encrypted transport, access control, tenant separation, secure authentication, secret management, input validation, authenticated webhooks, audit logging, retention controls, incident response, vulnerability management and backup/recovery procedures appropriate to the risk.
3. Breaches and assistance
EUWithdraw will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data and provide available information in phases. Taking account of the processing and available information, EUWithdraw will reasonably assist with data-subject rights, security, breach obligations, DPIAs and prior consultation.
4. Subprocessors and transfers
The Controller gives general written authorisation for the providers in the Subprocessor Register. EUWithdraw will impose applicable data-protection obligations, remain responsible as required by law, give notice of material changes where required and consider reasonable objections. Restricted transfers outside the EEA or UK require an applicable transfer mechanism, including Standard Contractual Clauses and the UK Addendum where relevant. Information or copies of applicable safeguards may be requested from support@euwithdraw.eu.
5. Return, deletion and audit
At termination, Controller data will be returned where supported and/or deleted, subject to documented legal retention and protected backup lifecycles. Previously deleted data must not return to ordinary use after restore. EUWithdraw will make information reasonably necessary to demonstrate compliance available and permit proportionate audits subject to confidentiality, security, scope and frequency safeguards.
6. Controller duties
The merchant is responsible for lawful instructions, notices, legal bases, data minimisation, retention configuration, authorised users and substantive decisions concerning customer rights and withdrawal requests.
Processing details and technical and organisational measures are described in this DPA, the Privacy Policy and the Subprocessor Register. Contact support@euwithdraw.eu for a copy or questions about this DPA.