Data Processing Agreement

“Controller” is the client — a wholesale account, an API account, or a customer of a hosted copy of this website — that decides why and how its customers’ data is used. “Processor” is UnlockMyIMEI, Florida, United States, which processes that data on the Controller’s behalf to perform the ordered services. Where we act for our own retail customers we are the controller and the Privacy Policy applies instead.

We process Controller Data only on the Controller’s documented instructions. The instructions are: the orders and requests submitted through the portal, the API or the admin of a hosted copy; the settings the Controller chooses there; this agreement; and any further written instruction we accept. We may also process Controller Data where EU, UK or US law requires us to, in which case we tell the Controller first unless the law forbids it.

The Controller also instructs us to run blacklist, lost/stolen, repeat-order and payment-risk checks on every order and to hold or refuse orders that fail them. For the following we act as an independent controller, not as the Controller’s processor: our own security and sign-in records, fraud and abuse prevention across the platform, accounting and tax records, and disclosures to carriers, manufacturers or law enforcement about a device reported lost, stolen or obtained by fraud. Those uses are described in our Privacy Policy.

We tell the Controller at once if, in our opinion, an instruction breaks data-protection law. The details of what is processed are in Annex 1.

Only staff who need Controller Data to do their job have access to it, under a duty of confidentiality, and only through role-based permissions in the admin. We do not use Controller Data for our own purposes, do not sell it, and do not combine it with other customers’ data except for the platform-wide blacklist and fraud checks described in section 2 and for aggregate, anonymous statistics.

We apply the technical and organizational measures in Annex 2, review them when the service changes, and keep them appropriate to the risk, the state of the art and the nature of the data. The Controller is responsible for the security of its own systems, accounts, passwords and API keys, and for what its staff submit.

Each sub-processor that acts for us (hosting, network, email, AI) is bound by written data-protection terms consistent with this agreement, and we remain responsible for its performance. The Controller gives general authorization for the sub-processors in Annex 3. We publish changes to that list on this page at least 14 days before a new sub-processor of that kind handles Controller Data; the Controller may object in writing within that time on reasonable data-protection grounds, and if we cannot resolve the objection the Controller may stop using the affected service and close its account without penalty.

The suppliers that perform a particular unlock, check or remote service are authorized as a category, because we choose the supplier per order and per service and the list changes often. For them the 14-day notice does not apply; instead, on request we give the Controller the current named list (names, locations, contact details) under a confidentiality undertaking, update it on request, and the Controller may object to a named supplier within 14 days of receiving the list; if we cannot resolve the objection, the Controller may stop using the affected service. Each supplier receives only the identifier and the service needed. The payment providers and Telegram are independent services engaged under their own terms; the Controller instructs us to use them for its orders and accepts that they keep the data they receive under those terms.

If a person contacts us directly about data the Controller submitted, we refer them to the Controller unless the law requires us to answer. We help the Controller answer access, correction, deletion, portability, restriction and objection requests within the legal deadlines, using the portal’s own tools where they exist (orders, statements, exports) and by email otherwise.

• We notify the Controller without undue delay, and within 72 hours of becoming aware of a personal-data breach affecting Controller Data, with what we know at the time (nature, data and people concerned, likely effects, measures taken) and update it as we learn more. This notice is also our notice as a third-party agent under Florida Statutes section 501.171(6); the Controller’s own notification duties and deadlines run from it. The Controller handles its own notifications to authorities and individuals; we help.
• We help the Controller with data-protection impact assessments and consultations with supervisory authorities where our processing is relevant, at reasonable cost if the help goes beyond information we already hold.

When the services end or the account closes, we return Controller Data first if asked — by export from the portal or admin during the 14-day export window in the Master Service Agreement, or by email in a common format — and delete it within 30 days after that window or after the Controller’s request, except for records we must keep under accounting, tax or other law (kept only for that purpose and for that time). A supplier that has performed a completed service keeps the identifier under the terms of its contract with us; we instruct deletion on the Controller’s request and tell the Controller if a supplier does not confirm it.

On request, we give the Controller the information needed to show compliance with this agreement — this page, Annexes 1–3, our security description and answers to a reasonable questionnaire. Where that is not enough for a legal requirement, the Controller (or an independent auditor bound by confidentiality) may audit the relevant parts of our processing once in any 12 months, on 30 days’ notice, during business hours, without disrupting the service, at the Controller’s cost; the parties agree the scope in advance and the Controller receives the findings.

We process data in the United States and our sub-processors may be elsewhere. For Controller Data that is subject to the GDPR, the UK GDPR or the Swiss FADP, the EU Standard Contractual Clauses (Decision 2021/914) are incorporated into this agreement between the Controller as data exporter and UnlockMyIMEI as data importer: Module Two (controller to processor), or Module Three (processor to processor) where the Controller itself acts as a processor for its own business customers; with the Docking Clause, option 2 of clause 9 (general authorization, 14 days), Irish law and courts, and the UK International Data Transfer Addendum and Swiss adjustments as applicable. Annexes 1 and 2 serve as the Clauses’ Annex I and II; Annex 3 and the named supplier list provided under section 5 serve as Annex III.

The Clauses are concluded on the date we approve the Controller’s account (or, for a hosted copy, the date of the order confirmation). For the Controller, the business name, address and contact email entered in the account form Annex I.A, with the role “data exporter”; for us, UnlockMyIMEI, Florida, United States, with the contact address below, role “data importer”. The competent supervisory authority under Clause 13 is the authority of the EU Member State where the Controller is established or, for a Controller outside the EU, the Irish Data Protection Commission. On request we give the Controller the information it needs for its transfer assessment under Clause 14. Where another lawful transfer mechanism applies, it takes precedence.

Each party is liable for its own breach of data-protection law and of this agreement, subject to the limitation of liability in the Terms of Service or the Master Service Agreement, whichever governs the account — except that nothing limits liability that the law does not allow to be limited. This agreement lasts as long as we process Controller Data and ends when section 8 has been completed.

If this agreement conflicts with the Terms or the MSA on a data-protection matter, this agreement wins; the Standard Contractual Clauses win over everything where they apply.

• Transport encryption — HTTPS everywhere with HSTS, a content-security policy and modern TLS; API calls and portal sessions are encrypted in transit.
• Authentication and access — passwords stored as one-way hashes (scrypt); session tokens stored hashed and expiring; staff permissions by role, so each teammate sees only what their job needs; sign-in history and alerts when a client account signs in from more addresses than allowed; API keys per client that can be withdrawn at once.
• Integrity and traceability — money movements and order status changes are written to append-only records; administrative changes are audited with the acting user.
• Isolation of documents — uploaded identity and business documents and proof files live on a private volume that the web server never serves publicly; they are reached only through authenticated, permission-checked downloads.
• Abuse prevention — per-connection rate limits on sign-in, ordering, checks and chat; automated blacklist and fraud checks; request-size caps at the edge; prompt-injection and data-fishing guards on the chat assistant, which never reveals supplier, cost or other customers’ data; security events our systems detect are shown to the team.
• Minimization — suppliers receive only the identifier and service needed; the AI provider receives chat text with identifiers masked where they are not needed, and order details only when the client’s own order ID and email are given; store chats are removed from the server after about 12 hours.
• Operations — the service runs in containers on a dedicated server in the United States, with the database reachable only from the application; releases are built from a checked copy of the code that passes automated tests before it goes live.
• Incident handling — the breach procedure in section 7 applies.

Independent services the Controller instructs us to use, under their own terms (not sub-processors acting for us): PayPal, Inc. and the payment rails the Controller chooses (independent controllers of payment data); Telegram FZ-LLC for the updates a client links; the public blockchains a crypto payment is written to.

Data-protection matters for wholesale, API and hosted-copy clients: support@unlockmyimei.com (write “DPA” in the subject). A countersigned copy of this agreement or of the Standard Contractual Clauses, or the named supplier list under confidentiality: sales@unlockmyimei.com. All legal documents are on the Legal page.