Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (“Controller”) and ASTROX TECHNOLOGIES LTD (“Processor”), and sets out how we process personal data on your behalf in connection with the AstroX platform.

1. Definitions

In this DPA:

• “Controller” means you, the business customer who signs up for and uses the AstroX platform.
• “Processor” means ASTROX TECHNOLOGIES LTD, which processes personal data on behalf of the Controller.
• “Data Subjects” means your end-customers whose personal data is processed through the platform (e.g., shoppers who interact with your AI agent).
• “Personal Data” has the meaning given in UK GDPR.
• “Sub-processor” means any third-party service provider we engage to assist in processing personal data.
• “UK GDPR” means the UK General Data Protection Regulation as retained in UK law by the Data Protection Act 2018. Where personal data of data subjects in the European Economic Area is processed, references to UK GDPR include, where applicable, the EU GDPR.

2. Roles and relationship

You are the data controller for personal data relating to your end-customers. We are the data processor acting on your documented instructions. Each party is separately responsible for its own compliance with UK GDPR in respect of the data it controls.

For personal data we collect about you as a platform user (account data, billing, usage), we are the controller — see our Privacy Policy.

3. Details of processing

The following describes the processing we carry out on your behalf:

4. Our obligations as processor

We will:

• Process personal data only on your documented instructions, including as described in the Terms of Service and this DPA, unless required by law to do otherwise.
• Inform you promptly if, in our opinion, an instruction from you infringes UK GDPR or other applicable data protection law; we are not obliged to review your instructions for legal compliance and may suspend the affected processing until the instruction is confirmed or amended.
• Ensure that our staff who access personal data are bound by appropriate confidentiality obligations.
• Implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction (see Section 7).
• Not engage sub-processors without your prior general authorisation (granted by accepting these Terms) and subject to the requirements in Section 6.
• Provide reasonable assistance to you in responding to data subject requests, data protection impact assessments, and regulatory enquiries.
• Notify you without undue delay after becoming aware of a personal data breach affecting your end-customers' personal data and, where feasible, within 72 hours of becoming aware, with the information reasonably available to us at that time; further details will follow in phases as our investigation progresses. Our notification is not an admission of fault or liability.
• At your request, delete or return all personal data after the end of services, and delete existing copies unless retention is required by law.
• Provide you with information reasonably necessary to demonstrate our compliance with this DPA, including supporting audits conducted by you or an authorised auditor (subject to reasonable advance notice and confidentiality protections).

5. Your obligations as controller

You are responsible for:

• Ensuring you have a lawful basis for processing your end-customers' personal data through the platform.
• Providing your end-customers with appropriate privacy notices describing how their data is processed.
• Ensuring your instructions to us comply with applicable data protection law.
• Notifying us promptly of any data subject requests you receive that we need to assist with.
• Keeping your account credentials secure and restricting platform access to authorised users only.

6. Sub-processors

You give us general authorisation to engage sub-processors to assist in providing the Services. Our current sub-processors, with their purposes, locations, and transfer safeguards, are listed on our Sub-processors page, which forms part of this DPA and is the single authoritative list. The notice and objection process for new sub-processors is set out below.

We require all sub-processors to enter into written agreements with us that impose data protection obligations substantially equivalent to those in this DPA, and we remain responsible to you for their performance of those obligations.

New sub-processors: We will notify you by email to your account address before engaging a new sub-processor that will process your end-customers' personal data — ordinarily at least 30 days in advance, or as soon as practicable where the change is required urgently for security, legal, or service-continuity reasons. If you reasonably object on data-protection grounds within 14 days of our notice, we will discuss the objection in good faith. If we cannot provide the Services without the new sub-processor and the objection cannot be resolved, you may terminate the affected subscription before the change takes effect, and we will refund pro rata any subscription fees prepaid for the period after termination (excluding top-up credits and add-ons already consumed). This is your sole remedy in respect of a sub-processor change.

AI model providers: AI agent responses and inbox translation are generated by third-party AI model providers engaged under business terms that prohibit them from using your end-customers' personal data to train their models. We do not control our providers' internal practices and will update the Sub-processors page if a provider or its terms change materially. Our own use of Your Content and Aggregate Data is governed by Section 11 of the Terms of Service.

7. Security measures

We implement and maintain technical and organisational measures appropriate to the risk of the processing, which currently include:

• Encryption: Data encrypted in transit using TLS 1.2 or higher, and at rest using the storage encryption of our cloud providers where supported.
• Access control: Role-based access control; staff access limited to what is necessary for their role.
• Authentication: Multi-factor authentication for our internal administrative access where supported by the relevant system.
• Incident response: Procedures for detecting, containing, and reporting data breaches, including the notification commitments in Section 10.
• Vendor security: Due diligence on sub-processors' security practices before engagement.

We may update these measures over time provided the overall level of security is not materially reduced.

8. International transfers

Where personal data is transferred to sub-processors outside the UK or EEA (for example, AI model providers in the USA), we rely on appropriate transfer mechanisms, including the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses, or adequacy decisions as applicable.

9. Data subject rights

If a data subject (your end-customer) contacts you to exercise their rights under UK GDPR (access, rectification, erasure, portability, etc.), we will provide reasonable assistance to help you fulfil those requests. Contact us at support@astroxtech.com. If a data subject contacts us directly about data we process on your behalf, we will redirect the request to you and will not respond to the data subject on the substance of the request unless you instruct us to or the law requires it.

10. Data breaches

If we become aware of a personal data breach affecting data we process on your behalf, we will:

• Notify you without undue delay after becoming aware and, where feasible, within 72 hours of becoming aware, with the information reasonably available to us at that time; further details will follow in phases as our investigation progresses. Our notification is not an admission of fault or liability.
• Provide details of the nature of the breach, the data and data subjects involved (where known), and the likely consequences.
• Describe the measures taken or proposed to address the breach.

You remain responsible for notifying the ICO and affected data subjects where required.

11. Audit rights

You may request information to verify our compliance with this DPA, subject to the following conditions:

• Frequency: Audit rights may be exercised no more than once per 12-month period, except where a material data breach or confirmed compliance failure has occurred.
• Questionnaire first: We will first respond to written compliance questionnaires, provide relevant certifications, security documentation, or third-party audit summaries. An on-site or system audit is only required if our documentary response is materially insufficient to address a specific confirmed compliance concern.
• Notice: You must give at least 30 days' written notice before commencing any audit.
• Scope restrictions: Any audit must not: (a) access, inspect, or expose data belonging to other customers; (b) involve direct access to production systems or databases; (c) involve penetration testing or vulnerability scanning without separate written agreement.
• Confidentiality: All audit findings and information obtained must be treated as confidential and used only to verify compliance with this DPA.
• Costs: Costs of audits are borne by you unless the audit reveals a material breach on our part.

12. Liability

Each party's liability arising under or in connection with this DPA, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, is subject to the exclusions and limitations of liability set out in Section 14 of the Terms of Service. Any amount payable by us under this DPA counts towards, and does not add to, the aggregate cap in that Section.

You will indemnify us against claims by data subjects, supervisory authorities, or other third parties, including fines, penalties, damages, and reasonable costs, to the extent arising from your instructions, from your failure to have a lawful basis or to provide the notices required of a controller, from personal data you or your end-customers submit in breach of the Terms of Service or the Acceptable Use Policy, or otherwise from your breach of this DPA or applicable data protection law, except to the extent a court of competent jurisdiction finally determines that the claim arose solely from our breach of this DPA.

Nothing in this Section limits any liability that cannot be limited under applicable data protection law.

13. Term and termination

This DPA remains in effect for as long as we process personal data on your behalf under the Terms of Service. On termination of the Terms, we will delete or return your data as described in Section 3 (Retention) and our standard data deletion procedures.

14. Governing law

This DPA is governed by the laws of England and Wales. Any disputes will be subject to the exclusive jurisdiction of the courts of England and Wales.

15. Contact

For data protection enquiries under this DPA: support@astroxtech.com
ASTROX TECHNOLOGIES LTD (Company No. 16584933), registered in England and Wales; registered office address as recorded at Companies House.

Language: This DPA is drafted in English, and the English text is the sole binding version; any translation or summary is for convenience only.

Document History