Data Processing Addendum

1.1 This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Novix Technologies, Uttar Pradesh, India (“Vectrox”) and the business that registers a workspace on Vectrox (the “Customer”). It applies to personal data that Vectrox processes on the Customer’s behalf in providing the service (“Customer Personal Data”). It takes effect when the Customer accepts the Terms, and needs no separate signature.

1.2 For Customer Personal Data, the Customer is the controller (under the EU and UK GDPR), the business (under the CCPA, as amended by the CPRA) and the Data Fiduciary (under India’s Digital Personal Data Protection Act, 2023). Vectrox is the processor, service provider and Data Processor respectively. Vectrox is a controller only for the account and billing data it handles for its own purposes, as described in the Privacy Policy.

1.3 Where this DPA and the Terms conflict on the protection of personal data, this DPA prevails.

• Subject matter and duration: providing Vectrox to the Customer, for the term of the Customer’s use of the service and until deletion under clause 9.
• Nature and purpose: storing, organising, displaying, analysing, exporting and deleting the records the Customer keeps in its workspace; sending the emails the Customer sets up; running the AI features the Customer’s users choose to use; and syncing email for mailboxes a user chooses to connect.
• Data subjects: the Customer’s clients, prospects and their contacts; the Customer’s team members who use the workspace.
• Categories of data: names, business contact details, roles, the records of the relationship (deals, quotes, invoices, assets, tasks, notes, meeting notes and transcripts the Customer adds, emails exchanged with clients), custom fields the Customer defines, and usage records (the audit log).
• Special categories: none are intended. The Customer must not store special-category or sensitive personal data in the service.

3.1 Instructions. Vectrox processes Customer Personal Data only on the Customer’s documented instructions, which are given by the Terms, this DPA and the Customer’s use of the service, unless the law requires otherwise; in that case Vectrox informs the Customer first unless the law forbids it. Vectrox tells the Customer if, in its opinion, an instruction infringes data protection law.

3.2 No other use. Vectrox does not sell or share Customer Personal Data, does not use it for advertising, does not combine it with other data except as needed to provide the service, and does not allow its AI providers to use it to train models.

3.3 Confidentiality. Everyone at Vectrox authorised to process Customer Personal Data is bound by confidentiality.

3.4 Assistance. Vectrox assists the Customer, taking into account the nature of the processing, with requests from data subjects and with data protection impact assessments and prior consultations. The service itself lets the Customer find, correct, export (CSV) and delete records; Vectrox helps with anything it does not cover. Vectrox forwards to the Customer any request it receives directly about Customer Personal Data.

• Multi-tenant isolation: every record carries its workspace, and row-level security in the database refuses any read or write for another workspace. The rule sits below the application.
• Access control by role: what each team member can see and change (Owner, Admin, Manager, Member, Viewer) is enforced in the database and re-checked on the server for every action.
• Encryption: at rest with AES-256 by the database and storage providers; in transit with TLS (version 1.2 or higher). Connected-mailbox access tokens are additionally encrypted with AES-256-GCM before storage. Passwords are stored only as one-way hashes.
• Audit logging: changes to records, exports, role changes, bulk deletions and use of AI features are recorded in an audit log that the Customer’s Owner and Admins can read and export, and nobody in the workspace can alter.
• Account integrity: workspaces are registered from verified company email addresses; sessions are verified on the server; rate limits restrict abuse of public forms and costly operations.
• Payments: card details are entered only on the payment provider’s pages and never reach Vectrox’s systems.
• Backups: made by the database provider, encrypted, and used for no other purpose.

Vectrox may update these measures provided the overall level of protection is not reduced.

5.1 The Customer authorises Vectrox to engage sub-processors in the categories set out in clause 7 of the Privacy Policy. Vectrox maintains an active register of the specific sub-processors it engages, available to the Customer on written request to mayureshchaturvedi@gmail.com. Vectrox binds each by written agreement to data protection obligations no less protective than this DPA, and remains responsible to the Customer for their performance.

5.2 Vectrox updates the register and notifies the Customer in writing, at the email address of the workspace Owner, at least 14 days before a new sub-processor begins processing Customer Personal Data. The Customer may object on reasonable data protection grounds within that period; the parties will then discuss it in good faith, and if they cannot resolve it the Customer may end the affected service and receive a pro-rata refund of fees prepaid for the period after it ends.

6.1 Where Customer Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision, the parties agree to the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), which are incorporated by reference. Clause 7 (docking) applies; for clause 9, option 2 (general authorisation) applies with the notice period in clause 5.2 above; for clause 11, the optional language does not apply; for clauses 17 and 18, the law and courts of Ireland apply.

6.2 For data subject to the UK GDPR, the UK International Data Transfer Addendum to those Clauses applies; for Switzerland, the Clauses apply as adapted for the Swiss Federal Act on Data Protection.

6.3 Transfers of personal data from India are made in accordance with the DPDP Act and any restriction notified under it.

6.4 Vectrox requires its sub-processors to provide equivalent safeguards for onward transfers.

7.1 Vectrox notifies the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, so far as then known, what happened, the data and people affected, the likely consequences, and the measures taken or proposed; further information follows as it becomes available.

7.2 Vectrox takes reasonable steps to contain the breach and limit its effects, and assists the Customer in meeting its own obligations to notify authorities and data subjects.

8.1 Vectrox makes available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires.

8.2 Where that is not sufficient, or a regulator requires it, the Customer may audit Vectrox’s compliance once a year, on at least 30 days’ written notice, during business hours, at its own cost, through an auditor bound by confidentiality, and in a way that does not compromise other customers’ data or the security of the service.

9.1 During the term, the Customer can export its records (CSV) and delete them at any time from inside the service. Deleted records are removed from the live database at once.

9.2 After the Customer’s subscription ends, its data is kept so the workspace can be restored if the Customer subscribes again, until the Customer asks for deletion. On the Customer’s written request to mayureshchaturvedi@gmail.com, Vectrox permanently deletes all Customer Personal Data from the live systems within 30 days, unless the law requires it to be kept. Copies in the database provider’s encrypted backups are overwritten in its normal cycle.

9.3 Before deletion, the Customer may export its data or ask Vectrox for help doing so.

10.1 Questions about this DPA, requests for information, and notices under it go to the Data Governance & Grievance Desk at mayureshchaturvedi@gmail.com.