Data Processing Addendum

1. What this is

This addendum is part of the Terms of Service between your business ("you") and Wexron Infotech LLP ("we"). It applies to personal data of your customers, contacts, shoppers, callers and chat visitors that we process when running Commstate for you ("customer personal data"), wherever those people are.

For customer personal data, you are the controller and we are your processor. The same roles apply under each law that uses other words: under India's Digital Personal Data Protection Act, 2023, you are the data fiduciary and we are your data processor; under the California Consumer Privacy Act, you are the business and we are your service provider.

This addendum is meant to meet Article 28 of the EU General Data Protection Regulation and of the UK GDPR, section 8 of the DPDP Act, and the service provider terms of the CCPA. Section 13 describes the processing.

2. Your instructions

• We process customer personal data only to provide Commstate as you use and configure it, and as you otherwise instruct us in writing. Your use of Commstate's features and settings is your instruction.
• We do not use customer personal data for our own purposes, do not sell or share it (as the CCPA defines those words), do not combine it with data from other sources except as Commstate's features you use do, and do not use it to train AI models.
• If we believe an instruction breaks the law, we tell you, and may decline to follow it.
• If the law requires us to process it otherwise (for example a court order), we tell you first unless the law forbids it.

3. Your responsibilities

• You have a lawful basis for what you collect and for the messages and calls you make through Commstate, including consent where needed, and you give your customers the notice the law requires (your shop's privacy policy page is there for this).
• You handle your customers' requests to use their rights. Commstate gives you tools to view, correct, export and delete customer records.
• You configure Commstate appropriately, for example roles and permissions for your staff, and call-recording announcements.

4. Our people

Only staff who need access to run or support Commstate can reach customer personal data. They are bound by confidentiality. When our support staff open your account to help you, the access is time-limited and recorded in your account's activity log.

5. Security

We keep appropriate technical and organisational measures, including: encrypted connections; separation of each business's data; role-based access for your staff; encryption of stored secrets and credentials; hashed passwords and two-step verification for accounts; limits on repeated sign-in attempts; audit logs; and database backups every six hours, kept for about 14 days. The Privacy Policy describes these further. {{SECURITY_ANNEX}}

6. Sub-processors

• You give general authorisation for us to use the sub-processors on our Sub-processors page. We bind each to data protection terms at least as protective as this addendum.
• We give at least {{SUBPROCESSOR_NOTICE_DAYS}} days' notice of a new sub-processor, by updating that page and telling account owners. If you object on reasonable data protection grounds and we cannot resolve it, you may end the affected service and receive a pro-rata refund of prepaid fees for it.
• Services you connect yourself (your own Shopify, Razorpay, WhatsApp, Plivo, courier or AI provider accounts) are not our sub-processors; your agreement with each of them governs.
• We remain responsible to you for our sub-processors' work.

7. International transfers

Customer personal data is processed in the countries listed for each sub-processor, including the United States (for example file storage and backups).

• From the EEA: where the data goes to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 apply and are incorporated by reference: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are yourself a processor. {{SCC_ELECTIONS}}
• From the UK: the International Data Transfer Addendum to those clauses, issued by the UK Information Commissioner, applies. {{UK_ADDENDUM_DETAILS}}
• From Switzerland: the clauses apply with the changes the Swiss Federal Act on Data Protection requires. {{SWISS_DETAILS}}
• From India: transfers follow the DPDP Act, including any country restrictions the Government of India notifies.
• From elsewhere: we follow the transfer rules of that country's law.

Where a sub-processor is certified under the EU-US Data Privacy Framework (or its UK and Swiss extensions), we may rely on that instead.

8. Breaches

If we become aware of a breach affecting customer personal data, we will tell you without undue delay and within {{BREACH_NOTICE_HOURS}} hours, with what we know: what happened, what data and how many people are affected, the likely consequences, what we have done, and who you can contact. We will help you meet your own duties to inform supervisory authorities and the people affected.

9. Help with requests and assessments

We will help you, as far as reasonable and taking into account what we can do, to respond to people's requests to use their rights, to carry out data protection impact assessments, and to consult supervisory authorities, where you cannot do it yourself with Commstate's tools.

10. Audits

We will give you the information reasonably needed to show we meet this addendum, and allow audits as the GDPR requires. {{AUDIT_TERMS}}

11. When the service ends

You can export your data at any time while your account is active. When the agreement ends, we delete customer personal data within {{DELETION_DAYS}} days of your written request or of the end of the export window in the Terms of Service, unless the law requires us to keep it. Copies in backups are overwritten within about 14 days.

12. Liability and order of precedence

Each party's liability under this addendum is subject to the limits in the Terms of Service, except where the law does not allow it. If this addendum and the Terms of Service disagree about customer personal data, this addendum wins; if the Standard Contractual Clauses apply and disagree with either, the clauses win.

13. Description of the processing

• Subject matter and duration: providing Commstate to you, for as long as you use it, and until deletion under section 11.
• Nature and purpose: storing, organising, displaying, sending and analysing data as Commstate's features do: orders, customers, messages, calls, shop, shipping, AI assistance.
• People concerned: your customers and prospective customers, shoppers and visitors to your shop, people who message, call or chat with you, your suppliers and their contacts.
• Types of data: names and contact details, addresses, order and payment records (not card numbers), messages and chat transcripts, call recordings and transcripts, shop account and visit data, delivery records, and anything else you choose to store.
• Special categories: none are intended. You should not store sensitive data (such as health data) in Commstate unless you need to and have a lawful basis.