Last updated: 8 November 2026.
This data processing agreement ("DPA") is part of the platform service agreement between the firm that orders a hosted site (the "controller") and BuildPropFirm (the "processor").
1. Subject and duration
The processor hosts and runs the controller's prop firm website and the services behind it. It processes personal data for that purpose only, for as long as the service runs and until the site's data is removed 30 days after the service ends.
2. Data and data subjects
- Data subjects: the controller's traders, customers, partners and staff who use the site.
- Personal data: identity and contact details, account and sign-in data, orders and payments, trading accounts and their history, payout records, identity documents if the controller collects them, support messages and technical logs.
3. The processor's obligations
- It processes the data only on the controller's documented instructions: the service agreement, the site's settings and the controller's requests.
- Its staff with access are bound to confidentiality.
- It keeps appropriate security measures: encryption in transit, encrypted secrets, access control with two-factor sign-in, daily backups with encrypted off-site copies.
- It helps the controller answer data subjects' requests; the site's admin panel exports and deletes a person's data.
- It reports a personal data breach to the controller without undue delay, within 72 hours of becoming aware of it.
- At the end of the service it removes the data as the refund and termination policy describes, after the controller's export.
4. Sub-processors
The processor uses these kinds of sub-processors: the provider of the servers and data centres that host the platform and the hosted sites, and storage for encrypted off-site backups. The e-mail a site sends goes through the mail provider the controller connects in the site's admin, under the controller's own account. Their names and locations are given to the controller on request. The controller is told of a new sub-processor before it is used and may object.
5. Transfers
Where data is processed outside the controller's country, the processor uses safeguards the applicable law recognises for such transfers, and off-site backups are encrypted before they leave the server.
6. Audits and liability
On request the processor gives the controller the information needed to show that this DPA is respected and answers its reasonable questions about the security measures. Liability is as in the platform service agreement.
