Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between Struxsion Ltd (“Processor”) and the customer entity (“Controller”) and applies where Struxsion processes personal data on behalf of the Controller in connection with the Struxsion CRM platform.

‍

1. Definitions

Capitalised terms not defined in this DPA have the meanings given in the SaaS Terms and Conditions. “Data Protection Laws” means UK GDPR, EU GDPR, and any applicable data protection legislation.

‍

2. Roles of the Parties

2.1 The Customer acts as Data Controller and determines the purposes and means of processing Customer Data.

2.2 Struxsion acts as Data Processor and processes personal data only on documented instructions from the Controller, unless required by law.

‍

3. Scope of Processing

Processing activities include hosting, storage, transmission, organisation, analysis, support access, and deletion of personal data as necessary to provide the Services.

‍

4. Processor Obligations

Struxsion shall:

• process personal data only on documented instructions;

• ensure personnel are subject to confidentiality obligations;

• implement appropriate technical and organisational measures;

• assist the Controller with data subject rights requests;

• assist with security, DPIAs, and consultations where required;

• delete or return personal data on termination;

• make information available to demonstrate compliance.

‍

5. Security Measures

Struxsion implements technical and organisational measures designed to protect personal data, including access controls, encryption in transit, logical tenant separation, logging, backups, and incident response procedures.

‍

6. Subprocessors

The Controller authorises Struxsion to engage subprocessors. Current subprocessors include Supabase, Resend, Stripe, and OpenAI. Struxsion shall remain responsible for subprocessors’ compliance and will notify customers of material changes.

‍

7. International Data Transfers

Where personal data is transferred outside the UK or EEA, Struxsion relies on appropriate safeguards, including UK IDTA, UK Addendum, and EU Standard Contractual Clauses.

‍

8. Data Subject Rights

Struxsion will assist the Controller, where reasonably possible, in responding to data subject requests. The Controller is responsible for responding to requests.

‍

9. Personal Data Breach

Struxsion shall notify the Controller without undue delay after becoming aware of a personal data breach and provide available information to support compliance with breach notification obligations.

‍

10. Audits and Compliance

The Controller may audit compliance by requesting documentation or third-party audit reports. On-site audits require reasonable notice and are subject to confidentiality and security restrictions.

‍

11. Deletion or Return of Data

Upon termination of the Services, personal data shall be deleted or returned in accordance with the SaaS Terms, unless retention is required by law.

‍

12. Liability

Liability arising from this DPA is subject to the limitations set out in the SaaS Terms and Conditions.

‍

13. Governing Law

This DPA is governed by the laws of England and Wales.

‍

Schedule 1 – Processing Details (Article 28)

Subject matter: Provision of CRM SaaS services.

Duration: For the term of the Services.

Nature: Hosting, storage, transmission, analysis, and support.

Data subjects: Customer’s customers, staff, contractors, leads.

Categories of data: Contact details, project data, communications, images, documents.

Special categories: Not intentionally processed.