Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Montty Finance ("Processor") and the customer ("Controller") governing the processing of personal data in connection with the Montty platform. It reflects our obligations under the GDPR and comparable data protection laws.

Montty processes personal data solely on behalf of the Controller and only to the extent necessary to provide the services described in the main agreement, including account management, financial data aggregation, receipt processing, and AI-driven insights.

Montty may engage vetted sub-processors (e.g. cloud infrastructure, payment processing, bank connectivity providers) to deliver the service. All sub-processors are bound by data protection obligations no less protective than this DPA. A current list of sub-processors is available on request.

Montty maintains technical and organizational measures appropriate to the risk, including encryption at rest and in transit, access controls, audit logging, and regular security reviews, consistent with SOC 2 Type II standards.

Montty will assist the Controller in responding to data subject requests (access, rectification, erasure, portability) to the extent required by applicable law, within a reasonable timeframe.

Where personal data is transferred outside the EEA, Montty relies on appropriate safeguards such as Standard Contractual Clauses to ensure an adequate level of protection.

Upon termination of the agreement, Montty will delete or return all personal data processed on behalf of the Controller within 30 days, unless retention is required by law.

For a countersigned copy of this DPA for your records or procurement process, contact us at info@monttyfinance.com.