Schedule G | Data Processing and Privacy Requirements
Version 3.0 applies only through valid acceptance of the online MSA or a valid amendment. A private commercial order and provider approvals remain separate.
G.1 Roles and scope
Each party acts as an independent controller/business for processing whose purposes and means it determines, including its own account administration, underwriting, sanctions/fraud prevention, legal duties, disputes and claims. Where RT processes personal data solely to perform Merchant's documented instructions for the selected Services, Merchant is controller/business and RT is processor/service provider. Provider roles follow their actual processing and contracts. RT's public privacy notice at https://rt.app/privacy/ informs individuals and is not a substitute for this processor agreement.
G.2 Processing particulars
Subject matter: operation, integration, support and records of Merchant's selected payment software Services. Duration: the service term plus lawful retention and deletion periods. Nature: collection from approved sources, hosting, organization, access, transmission to approved providers, reconciliation, support, security, return and deletion. Purpose: performing those Services on Merchant's lawful documented instructions. Data subjects: Merchant representatives/users, buyers, payers, payees and relevant contacts. Data: business/contact identifiers, account references, order/transaction/fulfillment data, provider verification results, device/security records and support records, limited to the selected function. No special-category data, government-ID copies, full card credentials or unnecessary public-chain identifiers may be supplied to RT as processor unless specifically approved with suitable legal and technical measures. Provider-hosted collection remains subject to that provider's role.
G.3 Instructions and purpose limits
The Agreement, selected service configuration and authenticated lawful requests are the documented instructions. RT will process processor data only for those instructions or a binding legal obligation, informing Merchant of a legal requirement where lawful. RT must notify Merchant if an instruction appears unlawful and may suspend it. RT will not sell or share processor data for cross-context behavioral advertising, use it for unrelated marketing or outside the direct business relationship, or combine it with other personal data except as applicable law permits. Each party certifies compliance with service-provider restrictions applicable to it. Lawfully de-identified data may be used for analytics only with safeguards, a commitment not to reidentify and corresponding downstream restrictions.
G.4 People and security
RT will ensure personnel access is authorized, necessary and confidential and maintain safeguards proportionate to the nature, scope and risks, including access control, secure transport and storage as appropriate, logging, resilience and incident response. Schedule C supplies the operational control requirements without asserting an unverified certification. Merchant remains responsible for its endpoints, credentials, lawful collection, disclosures and instructions. RT must not treat a hash or wallet address as automatically anonymous.
G.5 Subprocessors
Before processor data is disclosed, RT must provide Merchant a current named subprocessor register identifying function and processing location and obtain the authorization required by law. Merchant gives general authorization to the named register supplied with its activation record and permits changes on at least 30 days' advance notice, except a legally justified urgent replacement with prompt notice. Merchant may object on reasonable data-protection grounds within 15 days; the parties will seek a compliant alternative, and if none is available the affected processing must stop or be terminated without charges for future unused processing. RT must impose materially equivalent processor obligations by contract and remains responsible for its subprocessors' performance as required by law. An independent payment controller is not automatically a subprocessor.
G.6 Assistance and audit
RT will reasonably assist Merchant with rights requests, security duties, breach notifications, impact assessments and supervisory consultations relevant to processor data, taking account of information available to RT. It must forward a request it receives for Merchant unless legally prohibited and not respond substantively without instruction unless required by law. RT will make information necessary to demonstrate processor compliance available and allow proportionate audits by Merchant or an independent auditor, subject to safeguards protecting others' information. Ordinary assurance may begin with existing reports and summaries; restrictions may not defeat mandatory audit rights or regulator access. Reasonable extraordinary assistance costs may be agreed where lawful, excluding costs caused by RT's own breach.
G.7 Incident and notification
RT must notify Merchant without undue delay after awareness of a personal-data breach affecting processor data, with an initial notice where feasible within 24 hours and subsequent updates. Include known nature, affected categories/approximate scope, likely consequences, response measures and a contact point. Merchant must notify RT within 24 hours of awareness of a relevant suspected or actual incident in its responsibility. Notices are not admissions of liability. Mandatory authority/individual deadlines remain applicable and a party must not wait for confirmation where the legal clock starts at awareness.
G.8 Transfers
No restricted international transfer may begin merely because this schedule is posted. The parties must first establish an applicable adequacy basis or a valid transfer instrument with completed annexes, actual parties, processing/locations, security measures and subprocessor details. Where required and validly selected, the European Commission 2021 standard contractual clauses, appropriate Module 2 or 3, and applicable UK addendum apply in their unmodified official text and prevail over conflicting terms. They are available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj and the UK ICO website. This reference does not falsely represent that missing annexes are complete or that a transfer assessment has been performed. If no lawful basis exists, the affected transfer must not proceed.
G.9 Return and deletion
At Merchant's choice on termination RT will return or delete processor data and require its subprocessors to do likewise, except necessary lawful retention. Merchant may request an available export for 30 days; RT will then delete active processor copies within a reasonable documented period, ordinarily 90 days, with isolated backup expiry under an established retention cycle. Legally retained copies must remain protected, restricted to the retained purpose and deleted when the basis ends. RT will provide reasonable confirmation on request. Public-chain erasure cannot be promised; direct personal identifiers must remain off-chain; necessary public wallet/transaction references require a lawful basis and disclosure.
G.10 Oversight and changes
Merchant may take reasonable steps to confirm processor compliance, require notice if RT can no longer comply and require unlawful processing to stop or be remediated. No liability cap limits an individual's or authority's mandatory rights. This schedule controls data-processing matters; mandatory transfer clauses prevail. Material reduction of mandatory processor protections requires a lawful written agreement, not a silent page edit. Statutory rights and appropriate complaints to supervisory authorities are preserved.