Data Processing Addendum

1. Scope and parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service, or any other written agreement for SendAxion services (the "Agreement"), between Walexbiz Group Ltd ("SendAxion", "we") and the customer that accepts the Agreement ("Customer"). It applies whenever SendAxion processes Customer Personal Data in providing the Services.

This DPA takes effect when Customer accepts the Agreement and continues for as long as SendAxion processes Customer Personal Data. No separate signature is needed. Customers that need a countersigned copy for their records can request one from legal@sendaxion.com.

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

2. Definitions

Applicable Data Protection Law

All data protection and privacy laws that apply to the processing of Customer Personal Data under the Agreement, including the Nigeria Data Protection Act 2023 ("NDPA"); Regulation (EU) 2016/679 ("GDPR"); the GDPR as it forms part of UK law, together with the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); the California Consumer Privacy Act, as amended ("CCPA"); and other laws such as Kenya’s Data Protection Act 2019, South Africa’s Protection of Personal Information Act 2013 and Ghana’s Data Protection Act 2012.

Customer Personal Data

Personal data contained in Customer Content that SendAxion processes on behalf of Customer in providing the Services.

Controller, processor, data subject, personal data, processing and supervisory authority

Have the meanings given in Applicable Data Protection Law. "Controller" includes a "business", and "processor" includes a "service provider" or "contractor", under the CCPA.

Personal Data Breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by SendAxion.

Sub-processor

Any third party that SendAxion engages to process Customer Personal Data.

Standard Contractual Clauses or SCCs

The standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

UK Addendum

The International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

Restricted Transfer

A transfer of Customer Personal Data to a country that Applicable Data Protection Law does not recognize as providing adequate protection, where that law requires safeguards for the transfer.

3. Roles of the parties

• Customer is the controller of Customer Personal Data, or a processor acting for its own clients, in which case SendAxion is Customer’s sub-processor and Customer is responsible for obtaining any authorization its controllers require.
• SendAxion is the processor of Customer Personal Data.
• SendAxion is an independent controller of the personal data it collects to manage its relationship with Customer, such as account, billing, support and website data, as described in the Privacy Policy. This DPA does not apply to that data.
• Annex 1 describes the processing.

4. Processing on documented instructions

• SendAxion will process Customer Personal Data only on Customer’s documented instructions, unless the law requires otherwise. In that case, SendAxion will inform Customer before processing, unless the law prohibits this.
• Customer instructs SendAxion to process Customer Personal Data to: (a) provide the Services in line with the Agreement and the Documentation; (b) carry out processing that Customer and its Users initiate through the dashboard, API, SMTP and other features, such as sending email, tracking engagement when it is turned on, managing contacts and suppressions, and delivering webhooks; (c) keep the Services secure and prevent spam, fraud and other abuse, including by enforcing the Acceptable Use Policy; (d) provide the support Customer asks for; and (e) follow Customer’s other reasonable written instructions that are consistent with the Agreement.
• SendAxion will tell Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
• SendAxion will not sell Customer Personal Data, share it for cross-context behavioral advertising, use it to train artificial intelligence models, or combine it with personal data from other sources except as needed for the purposes above.

5. Customer’s responsibilities

• Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis, giving recipients the notices the law requires, and obtaining consent where needed, for example for marketing email and for open and click tracking.
• Customer is responsible for the accuracy of Customer Personal Data and for deciding what personal data it submits. Customer will not submit special categories of personal data, such as health data, or data about children, unless Applicable Data Protection Law allows it and appropriate safeguards are in place.
• Customer is responsible for configuring the Services appropriately, including User access, two-factor authentication, API key scopes and tracking settings, and for keeping its credentials secure.

6. Confidentiality of personnel

SendAxion will ensure that everyone it authorizes to process Customer Personal Data is bound by an appropriate duty of confidentiality and has access to Customer Personal Data only as needed to provide the Services.

7. Security

SendAxion will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Personal Data Breaches, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to individuals. The measures in place on the date of this DPA are described in Annex 2. SendAxion may update them, provided updates do not materially reduce the overall level of protection.

8. Sub-processors

• Customer gives SendAxion general authorization to engage Sub-processors. The current Sub-processors are listed in Annex 3.
• SendAxion will impose data protection terms on each Sub-processor that require it to protect Customer Personal Data to the standard required by this DPA, and remains responsible for each Sub-processor’s performance of those obligations.
• SendAxion will give notice of any new Sub-processor at least 30 days before it starts processing Customer Personal Data, by updating Annex 3 and notifying Customer by email or in the dashboard.
• Customer may object to a new Sub-processor on reasonable data protection grounds within that period by writing to privacy@sendaxion.com. The parties will discuss the objection in good faith. If SendAxion cannot reasonably accommodate it, Customer may terminate the affected Services by written notice, and SendAxion will refund any prepaid fees for the period after termination.

9. International transfers

SendAxion is established in Nigeria, and SendAxion and its Sub-processors may process Customer Personal Data in other countries. SendAxion will make Restricted Transfers only in compliance with Applicable Data Protection Law.

European Economic Area

Where Customer Personal Data subject to the GDPR is transferred to SendAxion in a Restricted Transfer, the SCCs are incorporated into this DPA as follows:

• Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) where Customer is a processor. Customer is the data exporter and SendAxion is the data importer.
• The optional docking clause in Clause 7 applies.
• In Clause 9(a), Option 2 (general written authorization) applies, with the notice period set out in Sub-processors.
• The optional wording in Clause 11(a) does not apply.
• In Clause 13, the competent supervisory authority is determined in accordance with Clause 13(a).
• In Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland. In Clause 18(b), disputes are resolved by the courts of Ireland.
• Annexes I, II and III of the SCCs are completed by Annex 1, Annex 2 and Annex 3 of this DPA.

United Kingdom

For Restricted Transfers subject to the UK GDPR, the UK Addendum applies and incorporates the SCCs as set out above. Table 1 is completed with the details in Annex 1; Table 2 with the modules and options selected above; Table 3 with Annexes 1 to 3 of this DPA; and in Table 4, both the importer and the exporter may end the UK Addendum as set out in its Section 19.

Switzerland

For transfers subject to the FADP, the SCCs apply as set out above, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; references to the GDPR include the FADP; and the term "Member State" does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

Nigeria and other countries

• Where Customer Personal Data is transferred out of Nigeria, SendAxion will comply with Part VIII of the NDPA. The parties agree that this DPA provides contractual safeguards for that purpose, and SendAxion will put equivalent safeguards in place with Sub-processors that receive such data.
• For other Restricted Transfers, such as from Kenya, South Africa or Ghana, the parties agree that this DPA provides the binding contractual safeguards the applicable law requires, and they will put in place any additional mechanism that law requires.

If a transfer mechanism is invalidated or replaced, the parties will cooperate to put a valid alternative in place. If this DPA conflicts with the SCCs or the UK Addendum, the SCCs or the UK Addendum prevail.

10. Data subject requests and assistance

• The Services include self-service tools Customer can use to respond to data subject requests, such as finding, exporting, updating and deleting contacts; erasing a contact while keeping the address suppressed so it is not emailed again; managing suppressions and unsubscribes; and requesting an export of workspace data.
• If SendAxion receives a request from a data subject about Customer Personal Data, it will refer the data subject to Customer where it can identify Customer, and will not otherwise respond unless the law requires it.
• Taking into account the nature of the processing and the information available to it, SendAxion will give Customer reasonable assistance with data subject requests that Customer cannot handle with the self-service tools, and with data protection impact assessments and prior consultations with supervisory authorities where Applicable Data Protection Law requires them.

11. Personal Data Breaches

• SendAxion will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. Notices are sent to the email addresses of Customer’s account owners.
• The notice will describe, as far as is known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Information that is not available at first will be provided as it becomes available.
• SendAxion will take reasonable steps to contain, investigate and mitigate the breach, and will cooperate reasonably to help Customer meet its own obligations, including notifying supervisory authorities and data subjects.
• Notifying or responding to a Personal Data Breach is not an acknowledgement of fault or liability.

12. Return and deletion

• While the Agreement is in force, Customer can export, correct and delete Customer Personal Data using the Services, and owners and admins can request a full export of workspace data in Settings → Account → Data & privacy.
• Customer can request the closure of its workspace at any time. On closure, sending stops, sign-in, API keys and SMTP credentials are disabled, and SendAxion stops processing Customer Personal Data to provide the Services.
• After closure or termination, SendAxion will delete the remaining Customer Personal Data on Customer’s written request to privacy@sendaxion.com, within a reasonable period, and confirm when it has done so. SendAxion may keep Customer Personal Data where the law requires it or where it is needed to establish, exercise or defend legal claims; any data kept remains protected by this DPA and is processed only for those purposes.

13. Information and audits

• SendAxion will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including by answering reasonable security and privacy questionnaires.
• If that information is not enough to demonstrate compliance, or a supervisory authority requires it, or after a Personal Data Breach, Customer or an independent auditor it appoints (bound by confidentiality and not a competitor of SendAxion) may audit SendAxion’s compliance with this DPA. Customer must give at least 30 days’ written notice; audits take place no more than once in any 12-month period (unless a supervisory authority requires otherwise or after a Personal Data Breach), during normal business hours, and in a way that does not disrupt the Services or compromise the security or confidentiality of other customers’ data. Each party bears its own costs.
• This section is how the audit provisions of the SCCs will be carried out.

14. CCPA terms

To the extent the CCPA applies, SendAxion acts as Customer’s service provider (or contractor) and will: process personal information only for the business purposes set out in the Agreement; not sell or share it; not retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than those business purposes; not combine it with personal information from other sources except as the CCPA allows; comply with the CCPA and provide the same level of privacy protection it requires; and notify Customer if it can no longer meet these obligations. Customer may take reasonable steps to stop and remediate any unauthorized use. SendAxion certifies that it understands and will comply with these restrictions.

15. Liability, precedence and governing law

• Each party’s liability under this DPA is subject to the limitations of liability in the Agreement, except where Applicable Data Protection Law or the SCCs do not allow them.
• If there is a conflict, the SCCs and the UK Addendum prevail over this DPA, and this DPA prevails over the rest of the Agreement for matters relating to Customer Personal Data.
• This DPA is governed by the law that governs the Agreement, except where the SCCs or Applicable Data Protection Law require otherwise.
• SendAxion may update this DPA to reflect changes in the law or in the Services. Updates will not reduce the level of protection for Customer Personal Data, and material changes will be notified as described in the Terms of Service.

16. Annex 1: Details of processing

Data exporter

Customer, as identified in its SendAxion account. Contact: the account owner’s email address. Role: controller, or processor on behalf of its own clients. Activities: use of the Services.

Data importer

Walexbiz Group Ltd (SendAxion), Abuja, Federal Capital Territory, Nigeria. Contact: privacy@sendaxion.com. Role: processor, or sub-processor. Activities: provision of the Services.

Signature and date

Each party is treated as having signed this DPA, including the SCCs and the UK Addendum where they apply, on the date Customer accepts the Agreement.

Subject matter

The provision of SendAxion email infrastructure services under the Agreement.

Duration

The term of the Agreement, and afterwards until Customer Personal Data is deleted in accordance with this DPA.

Nature and purpose

Hosting, storing, organizing, transmitting, delivering and receiving email; tracking delivery and, where Customer turns it on, opens and clicks; managing contacts, lists, segments, signup forms, campaigns, journeys, templates, suppressions, unsubscribes and preferences; parsing inbound email; reporting and analytics; delivering webhooks; securing the Services and preventing abuse; and providing support.

Categories of data subjects

Customer’s recipients, contacts and subscribers; people who submit Customer’s signup forms or use its preference pages; people who send email to Customer’s inbound addresses; and any other individuals whose personal data is included in Customer Content.

Categories of personal data

Email addresses, names and other contact attributes and custom fields Customer stores; message content and headers, including subject lines and attachments; message metadata, such as message IDs, timestamps, sending IP addresses and receiving servers’ responses; delivery events, bounces and spam complaints; engagement data when tracking is turned on, such as the time of opens and clicks, IP address, user agent, approximate location derived from the IP address, and the links clicked; list membership, consent, unsubscribe and preference records; suppression entries; and the content and metadata of inbound email, including authentication results.

Special categories of data

None are intended. Customer must not submit special categories of personal data except as allowed in Customer’s responsibilities. Any such data is protected by the measures in Annex 2.

Frequency of transfer

Continuous, for as long as Customer uses the Services.

Retention

As set out in Return and deletion.

Transfers to Sub-processors

As set out in Annex 3, for the purposes stated there, for the duration of the Agreement.

Competent supervisory authority

Determined in accordance with Clause 13 of the SCCs.

17. Annex 2: Technical and organizational measures

Access control

• Two-factor authentication available to every account, using an authenticator app or an email code, and required for SendAxion staff.
• Passwords stored only as salted hashes.
• Role-based access for SendAxion staff, limited to what each role needs, with an audit log of staff actions.
• Support access to a workspace only through least-privilege support sessions that are time-limited and logged.
• Workspace roles that let Customer limit what each User can do; only owners and admins can change plans or make data requests.

Encryption

• TLS encryption in transit for the website, dashboard, API and SMTP submission.
• Encryption of stored secrets, such as credentials and access tokens.

Credentials and integrations

• API keys with limited scopes, which Customer can revoke at any time.
• Signed webhooks with endpoint secrets that can be rotated, so Customer can verify that events came from SendAxion.
• DNS changes on Customer’s domains made only with Customer’s own Cloudflare authorization.

Sending protection

• Sending only from verified domains, authenticated with SPF, DKIM and DMARC.
• Automatic suppression after hard bounces and spam complaints, and signed one-click unsubscribe links.
• Automated monitoring of bounce, complaint and other abuse signals, with the ability to pause sending.

Logging and organizational measures

• Activity and audit logs of significant actions in workspaces and in staff tools.
• Access to Customer Personal Data limited to personnel who need it and who are bound by confidentiality.
• Written data protection terms with every Sub-processor.
• A Personal Data Breach response process, as described in Personal Data Breaches.

18. Annex 3: Sub-processors

Several of these providers mainly process data for which SendAxion is the controller, such as billing, sign-in and support data. They are listed here so Customer has a complete picture of the third parties involved in providing the Services.