Data Processing Addendum

1. Who this is between, and what it covers

This Data Processing Addendum ("DPA") is between Sinrix ("Sinrix", "we") and the customer who accepted the Terms of Service ("you"). It is part of those terms, and applies whenever we process personal data for you as part of the service and a data protection law applies to it, such as the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection or the California Consumer Privacy Act ("Data Protection Law"). If this DPA and the terms disagree about personal data, this DPA wins.

Words such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings Data Protection Law gives them. "Customer Personal Data" means the personal data inside your brands that we process for you.

2. Roles

You are the controller of Customer Personal Data, or a processor acting for your own controller, and we are your processor (or subprocessor). Under the CCPA, we are your service provider. Annex 1 describes the processing. For the account and billing data we need to run Sinrix itself, we are the controller, as the Privacy Policy describes.

You are responsible for having a lawful basis for the Customer Personal Data you, your people and your agents put into Sinrix, and for the instructions you give us.

3. Processing only on your instructions

We process Customer Personal Data only on your documented instructions: these terms, the way you set up and use your brands (including what you ask your agents to do and the apps you connect), and any other written instructions we agree. We tell you if we believe an instruction breaks Data Protection Law, unless the law forbids us to. If the law requires us to process the data otherwise, we tell you first, unless that law forbids it.

4. Confidentiality

We give access to Customer Personal Data only to the people who need it to run Sinrix, support you or meet the law, and every one of them is bound to keep it confidential.

5. Security

We keep in place the technical and organizational measures in Annex 2, which give a level of security appropriate to the risk. We may improve them over time, but never so that they protect the data less.

6. Subprocessors

You authorize us to use the subprocessors listed on the Subprocessors page. We bind each by a written contract with data protection obligations at least as protective as this DPA, and remain responsible for them. We email each brand's owner at least 30 days before adding or replacing one. You may object on reasonable data protection grounds within that time by writing to privacy@sinrix.com; if we cannot resolve your objection, you may end the affected brand's subscription and receive a refund of fees paid for the time after it ends.

7. Helping you meet your obligations

• Data subject requests. Your brand's people can find, correct and delete much of the data in it themselves, and download its files. If we receive a request about Customer Personal Data directly, we pass it to you without answering it ourselves, unless you ask us to. We help you with requests you cannot meet through the brand, as far as we reasonably can.
• Assessments and consultations. We give you the information you reasonably need for a data protection impact assessment, or a prior consultation with an authority, about your use of Sinrix.

8. Personal data breaches

We tell you of a personal data breach affecting Customer Personal Data without undue delay, and in any event within 72 hours of becoming aware of it, at the email address of each affected brand's owner. We tell you what we know of its nature, the data and people likely affected, its likely consequences and what we have done and will do, and we keep you informed as we learn more. Telling you is not an admission of fault. Report a suspected breach to legal@sinrix.com.

9. Deletion at the end

While a brand runs, you can export and delete its data yourself. When its subscription ends, the brand is stopped and kept for 30 days, so that you can return. After that, we delete the brand and all Customer Personal Data in it, backups included, unless the law requires us to keep it. If you want it deleted sooner, write to privacy@sinrix.com.

10. Audits

We make available the information reasonably needed to show that we meet this DPA. You may ask questions in writing at legal@sinrix.com at any time. Where those answers are not enough, or an authority requires it, you may audit our compliance, once a year unless an authority requires more, with at least 30 days' notice, at your cost, through an independent auditor bound to confidentiality, and in a way that does not reach other customers' data or disrupt the service.

11. International transfers

Where Customer Personal Data is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 apply and are incorporated into this DPA by reference, as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor.
• Clause 7 (the docking clause) applies. Under Clause 9, option 2 (general authorization) applies, with the notice period in section 6 of this DPA. The optional wording in Clause 11 does not apply.
• Clauses 17 and 18 refer to the law and courts of Ireland.
• Annexes I and II of the Clauses are completed by Annexes 1 and 2 of this DPA, and Annex III by the Subprocessors page.
• For transfers from the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner applies, completed with the information above. For transfers from Switzerland, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

12. California

As your service provider under the CCPA, we process Customer Personal Data only for the business purpose of providing Sinrix to you. We do not sell or share it, retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing Sinrix, or combine it with personal data we receive from others, except as the CCPA permits. We tell you if we can no longer meet these obligations.

13. Liability and duration

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where Data Protection Law does not allow it. This DPA lasts as long as we process Customer Personal Data for you.

Annex 1: The processing

• Part

  Subject matter

  What it is

  Running the customer's brands on Sinrix, as the Terms of Service describe.

• Part

  Duration

  What it is

  The term of the customer's subscriptions, and up to 30 days after each ends, unless deleted sooner.

• Part

  Nature and purpose

  What it is

  Hosting, storing, retrieving, organizing, analyzing and transmitting data, including with AI models, so the customer's co-founder and agents can do the work its people ask of them, in its brand and in the apps it connects.

• Part

  Data subjects

  What it is

  The customer's people invited to its brands; its own customers, prospects, suppliers and contacts; and anyone else whose data the customer, its people or its agents put into or reach from its brands.

• Part

  Categories of personal data

  What it is

  Names, contact details, job details, the content of messages, documents and files, and any other personal data in the customer's brands and connected apps.

• Part

  Special categories

  What it is

  None intended. The customer decides whether to process any, and is responsible for the lawful basis and safeguards it would need.

• Part

  Frequency

  What it is

  Continuous, while the customer's brands run.

Annex 2: Security measures

Separation

• Every brand has its own database, database role, storage volume and containers, never shared with another brand. Brands share the machines and the database server they run on, and are kept apart by those boundaries.
• Each brand holds only its own credentials, and every call it makes to Sinrix is made with its own token.

Encryption and secrets

• Sinrix, each brand's pages and the service a brand calls use HTTPS.
• Passwords and sign-in codes are stored hashed. Credentials we hold for brands, such as app sign-ins, are encrypted, with a separate key for each purpose, kept apart from the data.

Access

• Only the people who need it have access to production systems, each with their own sign-in.
• Support sessions as a brand's owner are limited in time, shown on every page to the person signed in and recorded on the timeline of each of the owner's brands.
• The servers brands run on are reached only by Sinrix's own systems, with a key no person signs in with, to start, update and stop brands; our team uses that access only to keep a brand running, to restore one, or when the law requires.

Control over agents

• Anything an agent would send, post, book, change or delete in a connected app waits for approval by the person who owns that account, unless the customer sets a routine to act on its own.
• Connected apps can be disconnected, routines paused and agents archived at any time.

Resilience

• Each brand is backed up every 24 hours and each backup is kept for 14 days, with a copy stored away from the server it runs on. Backups are restored by our team. An update replaces a brand's containers, so a brief interruption is possible, and work in progress carries on after it.
• Brands report their health to Sinrix, and problems alert the team.

Models

• Customer content is not used to train AI models, and our model provider does not train on it under its commercial terms.