MCP Shield Client DPA and Client B2C Toolkit

Last Updated: December 19, 2025

1. Client Contract: Data Processing Addendum (DPA)

This text should be included in the legal agreement between MCP Insight and the Client.

Service Description: MCP Shield

Role of the Parties: The Client acts as the Data Controller. MCP Insight (“MCP”) acts as the Data Processor.

Subject Matter: Real-time fraud detection and transaction analysis for mobile payments.

Data Types Processed

• Identifiers: MSISDN (Mobile Number), IP Address.
• Device Metadata: Handset type, Operating System, Browser version.
• Behavioural Data: Button presses, navigation coordinates, interaction timing, and movement patterns on the payment page.
• Outcome Data: Fraud scores, “Block/Clear” recommendations, and audit logs of consent.

Purpose of Processing

• Bot Detection: Identifying non-human/programmatic traffic.
• Transaction Verification: Confirming genuine consumer intent prior to billing.
• Audit Trail: Maintaining a secure record of the verification outcome for regulatory compliance and dispute resolution.

Sub-processors & GUI Analytics:

MCP utilizes Pendo.io as a sub-processor within the Client Administration Portal. This is used to analyse how Client staff interact with the Shield dashboard to provide in-app guidance and improve product functionality. No consumer PII (MSISDN) is shared with Pendo.

2. Data Retention Schedule

Data Category	Retention Period	Justification
Transaction Decision (Block/Clear)	7 Years	To match statutory limitation periods for financial records and tax audits.
Consumer MSISDN	3 – 5 Years	Necessary for investigating historical billing disputes or operator inquiries.
Behavioural Data (Coordinates/Clicks)	12 – 24 Months	Sufficient time to analyse fraud patterns; reduced to minimize PII footprint once the dispute window narrows.
Device Metadata (IP, OS, Handset)	12 – 24 Months	Used for forensic investigation of bot-nets and programmatic fraud.
Portal Usage Data (Pendo)	Active + 1 Year	Retained while the Client user is active to improve GUI experience.

3. Consumer-Facing Disclosure (B2C)

The Client must add this to their Privacy Policy or Terms of Service. It is best placed under a “Security & Fraud Prevention” heading.

Fraud Prevention & Transaction Security

To protect our customers and prevent unauthorized charges, we use a security service called Shield (provided by MCP Insight).

How it works:

When you visit our payment page, MCP Shield analyses technical signals to ensure the interaction is being made by a real person and not a malicious bot or automated script.

What data is collected?

• Your mobile number and IP address.
• Information about your device and browser.
• Anonymized patterns of how you interact with this page (such as button clicks or navigation movements).

Why we do this:

This analysis is strictly for security and fraud prevention. It allows us to verify that a transaction is legitimate before any charge is applied to your mobile bill. We maintain a record of this verification to comply with financial regulations and to protect your account from fraud. This data is not used for marketing purposes.

4. Implementation: “Just-in-Time” Notice

For the best balance of transparency and conversion, place this small text near the “Confirm Payment” or “Pay Now” button:

“To protect your account, we use Shield to verify this transaction is secure and bot-free. By continuing, you agree to this security check. [Link: Privacy Policy]”

4.b. Combined “Just-in-Time” & Consent 

If the Client wants to be bulletproof, they can place this text in a footer or a “Learn More” link directly on the checkout page:

Security Notice: > Our checkout process utilizes Shield JS by MCP Insight to prevent programmatic fraud. This script is strictly necessary for the security of your transaction. It processes device technical data and navigation patterns to confirm you are a genuine user. By proceeding, you acknowledge this security check is essential to complete your purchase.

5. For the Client’s Cookie Policy / Settings Manager:

Name: MCP Shield

Provider: MCP Insight

Type: Strictly Necessary / Security

Expiry: Session (or up to 1 year for persistent fraud flagging)

Description: This script is used to distinguish human users from automated “bots” and to prevent fraudulent transactions. It analyzes device characteristics and interaction patterns to ensure the security of the payment process. This script does not track you across other websites or serve advertisements.

6. Data Subject Access Request (DSAR) Response Template

When a consumer asks for their data (a DSAR), the Client (as the Data Controller) is responsible for responding. However, since MCP Shield captures behavioural data (like coordinates and button presses), the response needs to be technical yet easy for a layperson to understand.

Here is a comprehensive DSAR Response Template designed for this specific scenario.

Data Subject Access Request (DSAR) Response Template

To: [Consumer Name/Email]

From: [Client Name] Data Protection Officer

Date: [Date]

Subject: Response to your Subject Access Request – Reference [Ref Number]

Dear [Consumer Name],

We are writing in response to your request dated [Date] to access the personal data we hold about you. As part of our commitment to transparency and the security of your transactions, we utilize a fraud prevention service called Shield, provided by our partner MCP Insight.

Below is a summary of the data we have processed in relation to your interaction with our payment pages.

1. Categories of Personal Data Processed

In relation to your transaction/session on [Insert Date], the following data points were captured for the purpose of fraud prevention and bot detection:

Identifiers: Mobile Number (MSISDN) and IP Address.

Technical Metadata: Device type (e.g., iPhone 15), Operating System, and Browser version.

Behavioural Biometrics: Anonymized interaction data, including navigation coordinates on the payment page and button-press timestamps.

2. Purpose of Processing

This data was processed strictly to confirm that the transaction request was made by a genuine human user and not a programmatic “bot” or automated script. This ensures that no unauthorized charges are placed on your mobile phone bill.

3. Automated Decision Making

Our system performs a real-time analysis of the data above to issue a “Clear” or “Block” recommendation.

Outcome for your session: [Clear / Blocked]

Logic involved: The system analyses if the movement patterns and interaction speeds align with human behaviour or known fraudulent bot patterns.

4. Data Sharing & Retention

Recipients: This data was processed by MCP Insight (Data Processor) on our behalf.

Retention: We retain the “Outcome” and MSISDN for 7 years to comply with financial audit requirements. Detailed behavioural logs (coordinates) are typically purged after 24 months.

5. Your Rights

If you believe any of this information is incorrect, or if you wish to exercise your right to erasure or object to further processing, please contact our support team at [Link/Email]. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Sincerely,

[Name/Signature]

[Client Company Name]

NB: Internal Guidance for the Client

Verification is Key: Before sending the letter above, the Client must verify the requester actually owns the MSISDN (e.g., by sending a code to the phone).

Redaction: If the logs contain IP addresses or data belonging to other people (rare in this case), they must be redacted.

Format: Under GDPR, if the request was made electronically, the response should be provided in a commonly used electronic format (like a PDF).