1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Data Controller") and TCGAPIs ("Data Processor") and applies to the extent that TCGAPIs processes Personal Data on behalf of you in the course of providing our API services.

2. Definitions

For the purposes of this DPA, the following terms shall have the meanings set out below:

• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation or set of operations which is performed on Personal Data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Data Controller: The entity that determines the purposes and means of the Processing of Personal Data.
• Data Processor: The entity that Processes Personal Data on behalf of the Data Controller.
• Data Subject: The identified or identifiable natural person to whom the Personal Data relates.

3. Data Processing

TCGAPIs shall:

• Process Personal Data only on documented instructions from you, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by law.
• Ensure that persons authorized to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Take all measures required to ensure the security of Processing.
• Assist you in ensuring compliance with your obligations regarding the security of Personal Data, notification of Personal Data breaches, data protection impact assessments, and prior consultations with supervisory authorities.
• At your choice, delete or return all the Personal Data to you after the end of the provision of services relating to Processing, and delete existing copies unless storage is required by law.
• Make available to you all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you.

4. Sub-processors

TCGAPIs shall not engage another processor without prior specific or general written authorization from you. In the case of general written authorization, TCGAPIs shall inform you of any intended changes concerning the addition or replacement of other processors, thereby giving you the opportunity to object to such changes.

5. Data Subject Rights

TCGAPIs shall, to the extent legally permitted, promptly notify you if it receives a request from a Data Subject to exercise the Data Subject's right of access, right to rectification, restriction of Processing, erasure, data portability, objection to Processing, or right not to be subject to automated decision-making. Taking into account the nature of the Processing, TCGAPIs shall assist you by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of your obligation to respond to such requests.

6. Personal Data Breach

TCGAPIs shall notify you without undue delay after becoming aware of a Personal Data breach. Such notification shall include, at a minimum:

• A description of the nature of the Personal Data breach including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned.
• The name and contact details of the data protection officer or other contact point where more information can be obtained.
• A description of the likely consequences of the Personal Data breach.
• A description of the measures taken or proposed to be taken to address the Personal Data breach, including, where appropriate, measures to mitigate its possible adverse effects.

7. Termination

This DPA shall terminate automatically upon termination of the Terms of Service or upon completion of the Processing of Personal Data by TCGAPIs under the Terms of Service.

8. Contact Us

If you have any questions about this DPA, please contact us at support@tcgapis.com.