DPA.
Last updated: 2026-05-29
1. Purpose
This Data Processing Addendum ("DPA") supplements the services agreement between Cillex AI Pty Ltd ("Processor") and you ("Controller"), where Processor processes personal data on behalf of Controller under GDPR (EU 2016/679) or UK GDPR.
2. Scope and roles
Processor will process personal data only to perform the agreed services. Controller determines the purposes and means of processing. The categories of data processed (typically: contact details, marketing performance data, conversion events) and the data subjects (typically: Controller employees and end-customers) are documented in the SOW.
3. Sub-processors
Processor may engage sub-processors with prior general written authorization. The current sub-processor list is available on request. Processor will inform Controller of changes with at least 30 days notice and accept objection in writing.
4. Security
Processor implements appropriate technical and organizational measures including: encryption in transit (TLS 1.3), at-rest encryption on managed storage, least-privilege access, audit logging, MFA on internal systems, annual security review.
5. International transfers
Where personal data is transferred outside the EEA / UK, Processor relies on EU Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum where applicable.
6. Data subject rights
Processor will assist Controller in responding to data subject requests within reasonable timeframes.
7. Breach notification
Processor will notify Controller without undue delay (and in any case within 48 hours) on becoming aware of a personal data breach involving Controller's data.
8. Audit
Controller may audit Processor's compliance with this DPA once per twelve-month period, on reasonable notice. Processor will provide records and answer questions in good faith.
9. Termination
On termination of the services, Processor will return or delete all personal data within 60 days, except where retention is required by law.
10. Execution
For a countersigned copy, email hello@cillexai.com with subject "DPA".