This Data Processing Addendum ("DPA") forms part of the agreement between Malum Limited ("Processor", "Malum") and the Merchant identified in the Malum dashboard ("Controller") and governs the processing of personal data by Malum on the Controller's behalf under the UK GDPR, the EU GDPR, the UK Data Protection Act 2018, and equivalent laws.
Table of Contents
Capitalised terms not defined here have the meaning given in the UK GDPR or in the Malum Terms of Service. "Data Protection Laws" means the UK GDPR, the EU GDPR, the Data Protection Act 2018, the ePrivacy Directive, and any successor or equivalent law applicable to processing under this DPA.
The Controller determines the purposes and means of processing of personal data relating to its customers, end-users, and prospects. Malum processes that personal data solely as a Processor for the purpose of providing the Services. Where Malum processes personal data for its own purposes (fraud prevention, regulatory compliance, network operations), Malum acts as an independent Controller and the Privacy Policy applies.
Malum will process personal data only on the Controller's documented instructions, which are given by (i) the Controller's use of the Services, including configuration of webhooks, custom domains, payouts and notifications, and (ii) any written instruction subsequently agreed in writing. Malum will inform the Controller if, in its opinion, an instruction infringes Data Protection Laws.
Malum ensures that persons authorised to process the personal data are bound by appropriate confidentiality undertakings or are under a statutory obligation of confidentiality.
Malum implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art and the nature of the data. Current measures are described in Annex B and are reviewed at least annually.
The Controller authorises Malum to engage the sub-processors listed at malum.co/legal/sub-processors. Malum will provide at least fourteen (14) days' notice of the addition or replacement of a sub-processor through that page. The Controller may object on reasonable data-protection grounds, in which case the parties will work in good faith to resolve the objection or the Controller may terminate the affected Services.
Malum will impose data-protection obligations on each sub-processor that are no less onerous than those in this DPA and remains liable for the acts and omissions of its sub-processors.
Malum will, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects to exercise their rights under Data Protection Laws. Where Malum receives a request directly from a data subject relating to data processed for the Controller, Malum will refer the data subject to the Controller.
Malum will notify the Controller without undue delay, and in any event within seventy-two (72) hours of becoming aware of a personal data breach affecting the Controller's data, providing the information reasonably required for the Controller to meet its own notification obligations.
Where Malum transfers personal data outside the UK or the EEA to a country that is not the subject of an adequacy decision, the transfer will be made under the UK Addendum to the EU Standard Contractual Clauses (or successor mechanism) executed between the parties, or under another valid Article 46 transfer mechanism.
Malum will make available to the Controller the information necessary to demonstrate compliance with this DPA. On reasonable prior written notice and no more than once every twelve (12) months (unless required by a competent supervisory authority or following a personal data breach), the Controller may audit Malum's compliance, or appoint an independent auditor to do so under appropriate confidentiality. Malum may satisfy audit obligations by providing the most recent SOC 2 Type II, ISO 27001, or PCI-DSS attestations.
On termination of the Services, the Controller may export its data through the dashboard or the API for up to thirty (30) days. Malum will then delete or anonymise the Controller's personal data unless retention is required for compliance with a legal obligation (for example anti-money-laundering record keeping for five years).
Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA limits a data subject's rights against either party under Data Protection Laws.
Provision of card-to-crypto payment processing and ancillary services.
For as long as Malum provides the Services to the Controller.
Collection, storage, transmission and analysis of personal data to authenticate users, process payments, detect fraud, meet anti-money-laundering and Travel Rule obligations, generate receipts and tax invoices, and provide customer support.
None processed as part of normal operations. Selfies and document images supplied for KYC may incorporate biometric data; these are processed under Article 9(2)(g) UK GDPR and retained per the Privacy Policy.
This DPA is incorporated by reference into the Terms of Service and takes effect when the Controller accepts those Terms. Each party warrants that the individual accepting on its behalf is duly authorised to bind it. Where a Controller requires a counter-signed copy or an updated SCC module, contact [email protected].
Last modified 05/12/2026