Data Controller Statement - Hiram Trade

Version: 2026-10-01. Effective date: 2026-10-01.

This English version is a translation. The Polish version is legally binding.

Companies using the Platform sometimes ask about a data processing agreement (Art. 28 GDPR). This document explains why, for the Services covered by the Terms of Service, JIII-LEGACY (the "Operator") does not process personal data on behalf of Companies but acts as an independent controller, and why no data processing agreement is concluded.

1. Operator's statement

The Operator declares that, with respect to the personal data processed on the Platform - including the data of Users, representatives and employees of Companies, contact persons designated in Deals and persons whose data appear in Content - it is a controller within the meaning of Art. 4(7) GDPR and processes such data in accordance with the Privacy Policy.

2. Reasons

1. The Operator determines the purposes of processing. Data are processed to provide a trading platform service whose rules (staged disclosure of data, contact data masking, Matches, verification, moderation, Success Fee settlement, DAC7 and DSA obligations) are set by the Operator, not by individual Companies. One Company's data are made available to other Companies according to the Operator's rules.
2. The Operator determines the means of processing. The Operator decides on the scope of data collected, retention periods, the immutability of commercial history, infrastructure providers and security measures. Companies do not give the Operator instructions on processing.
3. The Operator also processes data for its own purposes, including to establish and pursue Success Fee claims, to prevent circumvention of the Platform, to calculate trust indicators and to comply with legal obligations. A processor may not process data for its own purposes (Art. 28(10) GDPR).
4. This approach is consistent with the view that operators of intermediation platforms, classified-ad portals and social networks are, as a rule, controllers of the data processed within their services. It reflects the criteria for distinguishing controllers from processors described in European Data Protection Board Guidelines 07/2020 on the concepts of controller and processor in the GDPR.
5. Each Company is a separate controller of the data it enters on the Platform itself (e.g. data of its employees or business partners) and of the data it receives from other Companies (e.g. contact person data once a Deal reaches AGREED status). Each Company is responsible for the legal basis for providing such data to the Platform and for informing the data subjects, in particular its employees designated as Users or contact persons.
6. The Operator and the Companies are not joint controllers within the meaning of Art. 26 GDPR, as they do not jointly determine the purposes and means of processing.

3. Operator's commitments to Companies

Regardless of its status as controller, the Operator undertakes towards Companies to:

1. process data provided by a Company only for the purposes described in the Privacy Policy;
2. apply the security measures described in the Privacy Policy;
3. use only the processors listed in the document "List of Subprocessors" and give at least 15 days' notice of changes to that list;
4. inform the Company without undue delay of a personal data breach concerning the data of its Users where the breach may affect the Company;
5. cooperate in handling requests from data subjects addressed to the Company, with respect to data processed on the Platform.

4. When a data processing agreement may be needed

If the Operator begins to provide services in which it processes data solely on the instructions and on behalf of a Company (e.g. importing a Company's supplier base into a procurement module independent of the Platform, integration with a Company's ERP system or bespoke services under the ENTERPRISE plan), the Operator will conclude a data processing agreement with the Company in accordance with Art. 28 GDPR. On the Operator's side the agreement is concluded by the company represented in accordance with its entry in the National Court Register; the Operator will present its template before it starts providing such a service.

5. Contact

Questions about personal data: privacy@hiramtrade.com.