Data Processing Addendum

Scope and parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Lebx ("Processor", "we") and the customer using Lebx Mail ("Customer", "you"). It applies whenever we process Customer Personal Data on your behalf in providing the Service, and it takes effect automatically when you accept the Terms.

If this DPA conflicts with the Terms on a data protection matter, this DPA prevails. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.

Definitions

• "Data Protection Laws" means all laws on privacy and personal data that apply to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and US state privacy laws such as the CCPA/CPRA.
• "Customer Personal Data" means personal data in Your Content that we process on your behalf — mainly the contact and subscriber data you upload or collect through the Service and the engagement data generated when your emails are sent, opened or clicked.
• "Controller", "Processor", "Data Subject", "Personal Data Breach" and "processing" have the meanings given in the GDPR. Under the DPDP Act, "Controller" means "Data Fiduciary", "Processor" means "Data Processor" and "Data Subject" means "Data Principal".
• "Sub-processor" means any third party we engage to process Customer Personal Data.

Details of processing

Our obligations as processor

We will:

1. process Customer Personal Data only on your documented instructions — the Terms, this DPA and your use and configuration of the Service are your complete instructions — unless the law requires otherwise (in which case we'll tell you first, unless the law prohibits that);
2. tell you if we believe an instruction breaks Data Protection Laws;
3. ensure everyone authorised to process Customer Personal Data is bound by confidentiality;
4. implement the security measures in section 7;
5. taking into account the nature of the processing, help you respond to Data Subjects exercising their rights — mostly through self-service tools in the Service for finding, exporting, editing and deleting contacts;
6. help you with data protection impact assessments and consultations with supervisory authorities, where required and to the extent the information is available to us;
7. not sell Customer Personal Data, or retain, use or disclose it for any purpose other than providing the Service, and not combine it with personal data from other sources except as the law allows for a service provider.

Personal data breaches

We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Our notice will describe, as far as we know, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. We will take reasonable steps to contain and remedy the breach and provide further information as it becomes available, so you can meet your own notification obligations (for example to a supervisory authority within 72 hours, or to the Data Protection Board of India).

Sub-processors

You give us general authorisation to engage Sub-processors. The categories we currently use are:

• cloud hosting, storage and backup;
• email delivery infrastructure;
• AI model providers, only when you use AI-assisted features, and only for the content you submit to them;
• customer support and communication tools (for support conversations only).

A current list with names and locations is available on request from privacy@lebx.io. We will notify you by email at least 14 days before adding or replacing a Sub-processor. You may object on reasonable data protection grounds within that period; if we can't resolve the objection, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it. We impose data protection obligations on every Sub-processor that are no less protective than this DPA and remain responsible for their performance.

Platforms you choose to connect (for example an advertising or e-commerce platform) are not our Sub-processors — they receive data at your instruction under your own agreement with them.

Security measures

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit using TLS; hashed passwords;
• Access control — role-based permissions, least-privilege access for staff, two-factor authentication available for all user accounts;
• Infrastructure security — firewalls, patched and hardened servers, separation of production systems;
• Availability — regular backups and tested restore procedures;
• Monitoring — logging of access and administrative actions, alerting on suspicious activity;
• People — confidentiality obligations and data protection guidance for everyone with access;
• Data minimisation — access to Customer Personal Data only where needed to provide the Service or support you.

We may update these measures as long as the overall level of security is not reduced.

International transfers

We are based in India. Where Customer Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), which are incorporated by reference, with you as data exporter and us as data importer; Clause 7 (docking) applies, Option 2 of Clause 9 (general authorisation, 14 days' notice) applies, the optional language in Clause 11 does not apply, and Clauses 17 and 18 are governed by the laws and courts of Ireland. For UK data, the UK International Data Transfer Addendum applies; for Swiss data, the Clauses apply with references to the FADP and the Swiss FDPIC. Annexes I and II are completed by section 3 and section 7 of this DPA.

Audits and information

We will make available information reasonably necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires. If that is not sufficient, or a supervisory authority requires it, you may audit our compliance once per year, on at least 30 days' written notice, during business hours, at your cost, and subject to confidentiality and to measures that protect other customers' data and our systems.

Return and deletion

You can export your contacts and reports at any time. After the Terms end, we delete Customer Personal Data from active systems within 30 days, and from backups as they rotate, unless the law requires us to keep it. Suppression records (unsubscribes and complaints) may be kept in minimal form where needed to honour opt-outs.

Your obligations

You are responsible for: having a lawful basis (including valid consent where required) for the Customer Personal Data you upload and the messages you send; giving Data Subjects the notices the law requires, including about email tracking; the accuracy and quality of the data; and ensuring your instructions comply with Data Protection Laws.

Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them. This DPA remains in effect as long as we process Customer Personal Data on your behalf.

Signed copy

This DPA is binding without a signature. If your organisation needs a countersigned copy for its records, email privacy@lebx.io with your company's legal name, address and account email.