● London · 38ms● New York · 41ms
● All systems normal$0 → $79/mo · Free tier live
RobotCopier
●// legal

Data Processing Agreement

The processor terms that apply when RobotCopier handles personal data on your behalf — typically when you use the service as a Provider or run a prop firm on the Institutional plan.

Last updated · 19 May 2026

This Data Processing Agreement ("DPA") forms part of the agreement between you (the "Controller") and RobotCopier.com, 128 City Rd, London EC1V 2NX, UK (the "Processor"), for the processing of personal data in connection with the RobotCopier service. It is drafted to satisfy UK GDPR Art. 28.

1. Subject matter, duration & nature of processing

  • Subject: personal data of the Controller's followers / sub-account holders processed by the Processor in providing the copy-trading service.
  • Duration: the term of the underlying RobotCopier subscription.
  • Nature & purpose: account provisioning, copy-trade execution, audit journaling, billing, customer support.
  • Categories of data: identifiers (email, broker login number), authentication material (broker credentials, encrypted at rest), trading metadata (symbol / side / lot / timestamp / risk verdict).
  • Categories of data subjects: the Controller's followers, sub-account holders, prop-firm-funded traders.

2. Processor obligations

The Processor:

  • Processes personal data only on documented instructions from the Controller, including transfers outside the UK/EEA (Art. 28(3)(a)).
  • Ensures persons authorised to process the data are under a duty of confidentiality.
  • Implements appropriate technical and organisational measures (described in §5).
  • Will not engage another processor (sub-processor) without the Controller's prior authorisation (see §3).
  • Assists the Controller, by appropriate technical and organisational measures, in responding to data subject requests under Chapter III of the UK GDPR.
  • Assists the Controller in ensuring compliance with Arts. 32–36 (security, breach notification, DPIAs).
  • At the Controller's choice, deletes or returns all personal data after the end of the services, save for copies required to be retained by law.
  • Makes available to the Controller all information necessary to demonstrate compliance with these obligations, and allows for audits — on reasonable notice, not more often than annually unless we're responding to a regulator request.

3. Sub-processors

The Controller authorises the following sub-processors:

  • Stripe Payments Europe Ltd — billing, payments, customer portal.
  • Amazon Web Services EMEA SARL (Amazon SES, EU region) — transactional email.
  • OVHcloud SAS — primary compute (London + New York datacentres).
  • Akamai Technologies (Linode) — quorum-witness node (London).
  • Cloudflare, Inc. — TLS termination, DDoS protection.

We'll notify the Controller in writing at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable grounds; in that case the parties will work in good faith to find a resolution, failing which the Controller may terminate the agreement.

4. International transfers

Personal data is hosted in the United Kingdom (London) and the United States (New York metropolitan area). Transfers to the US are made under the UK Addendum to the EU Standard Contractual Clauses (Module 2) and the Data Privacy Framework where applicable.

5. Security measures (UK GDPR Art. 32)

  • Broker credentials encrypted at rest with AES-256-GCM (per-record IV, master key in a separate secret store).
  • Account passwords hashed with Argon2id (memory cost 19MB, time cost 2, parallelism 1).
  • TLS 1.2+ enforced on every public endpoint; HSTS preload.
  • Inter-node communication on a WireGuard mesh; no production service exposed publicly except behind Cloudflare.
  • Strict default-deny firewall; SSH key-only auth; root login disabled.
  • Tiered access to production systems; two-person review for any deploy that touches secrets.
  • Comprehensive audit logging (90-day hot, 6-year cold); alerting on anomalous access patterns.
  • Quarterly penetration test of the dashboard + orchestrator API; results available under NDA.

6. Breach notification

The Processor will notify the Controller without undue delay (and in any event within 72 hours) of becoming aware of a personal data breach, providing the information needed for the Controller to comply with its own notification obligations.

7. Liability & indemnity

Each party's liability under this DPA is subject to the limits in the main agreement. Nothing in this DPA varies a data subject's rights under the UK GDPR.

8. Signing

If you need a signed copy of this DPA on letterhead — common for prop firms and corporate Institutional customers — write to [email protected] and we'll return one within five working days.

For our companion Privacy Policy see the linked page; our security write-up covers the operational controls in more detail.