Legal & Compliance

Data Processing Agreement

Last updated: May 2026 · Fintelli.Pro · EU & GCC

This DPA governs how Fintelli.Pro processes personal data on behalf of clients as a Data Processor under GDPR (Regulation (EU) 2016/679) and applies where clients are established in the EEA or the UK.

1. Definitions

Controller: The client organisation that determines the purpose and means of processing
Processor: Fintelli.Pro, acting on instructions from the Controller
Personal Data: Any information relating to an identified or identifiable natural person

2. Nature and purpose of processing

Fintelli.Pro may process personal data in the course of providing consulting, data engineering, dashboard development, or related services. The specific categories of data processed, the duration, and the purpose will be defined in the applicable Statement of Work or Service Agreement.

3. Processor obligations

Fintelli.Pro undertakes to:

Process personal data only on documented instructions from the Controller
Ensure all persons authorised to process data are bound by confidentiality
Implement appropriate technical and organisational security measures (Article 32 GDPR)
Not engage sub-processors without prior written consent from the Controller
Assist the Controller in responding to data subject rights requests
Delete or return all personal data upon termination of the engagement
Make available all information necessary to demonstrate compliance with GDPR Article 28

4. Security measures

Fintelli.Pro implements industry-standard technical measures including: encrypted communications (TLS), access controls, password management, and secure deletion practices. Measures are reviewed regularly and updated as necessary.

5. Sub-processors

The following sub-processors may be engaged in delivery of services: Microsoft 365 (email and document storage), Netlify (hosting), Google (analytics — anonymised data only). A full list is available on request.

6. International transfers

Where personal data is transferred outside the EEA, such transfers are covered by Standard Contractual Clauses (SCCs) or an adequacy decision, as applicable.

7. Term

This DPA is in force for the duration of the applicable engagement and the data retention period specified therein.

8. Execution

This DPA may be incorporated by reference in the engagement agreement. A standalone signed DPA is available on request — email hello@fintelli.pro.

Questions about this policy?

hello@fintelli.pro — we respond within one business day.