1. About this DPA
This Data Processing Addendum (“DPA”) forms part of the Master Subscription Agreement (“MSA”) between ContX.ai, Inc. (“ContX”) and the customer identified in an Order (“Customer”). It applies whenever ContX processes Customer Personal Data in providing the Services, and is incorporated into the Agreement without a signature. Customers that need a countersigned copy can request one from privacy@contx.ai.
This DPA works with the Data Protection and Security Statement (“DPS”) at https://contx.ai/legal/data-protection-security, which describes ContX’s security measures, subprocessors, incident handling and data retention in more detail. If this DPA conflicts with the MSA or the DPS on the processing of personal data, this DPA prevails. Capitalized terms not defined here have the meanings in the MSA.
2. Definitions
“Data Protection Laws” means all laws on data protection and privacy that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), and the California Consumer Privacy Act as amended (“CCPA”) and other U.S. state privacy laws.
“Customer Personal Data” means personal data within Customer Data that ContX processes on Customer’s behalf. “Subprocessor” means a third party ContX engages to process Customer Personal Data. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. “Controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in Data Protection Laws, and include “business”, “service provider” and “consumer” under the CCPA where relevant.
“SCCs” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914. “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).
3. Roles and scope
Customer is the controller of Customer Personal Data, or a processor acting for its own clients, and ContX is its processor, or subprocessor. A Channel Partner that processes its End Clients’ personal data in ContX is responsible for having the agreements with those End Clients that Data Protection Laws require.
ContX is a controller only for account, billing and usage information it needs to run its business. It handles that information under its Privacy Policy at https://contx.ai/privacy-policy, and this DPA does not apply to it.
The subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects, are described in section 14.
4. Customer instructions
ContX will process Customer Personal Data only on Customer’s documented instructions, unless the law requires otherwise; in that case ContX will tell Customer first unless the law prohibits it. Customer’s instructions are the Agreement, Customer’s use and configuration of the Services, and any other written instructions the parties agree.
ContX will tell Customer if, in its opinion, an instruction infringes Data Protection Laws. Customer is responsible for the lawfulness of its instructions and of the data it submits, including having a lawful basis and giving any notices and obtaining any consents required.
5. Confidentiality
ContX will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and process it only as needed to provide, secure and support the Services.
6. Security
ContX will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, as described in sections 7 and 8 of the DPS. ContX may update these measures over time, but will not reduce the overall level of protection during the term of the Agreement.
7. Subprocessors
Customer gives ContX general authorization to engage Subprocessors. The current list is in section 9 of the DPS and in the Privacy Policy. ContX will give notice of a new Subprocessor, and Customer may object, as described in section 9 of the DPS.
ContX will impose data protection obligations on each Subprocessor by written contract that are at least as protective as this DPA, and remains responsible to Customer for each Subprocessor’s performance of those obligations.
8. Personal Data Breaches
ContX will notify Customer of a Personal Data Breach without undue delay and within the time set out in section 11 of the DPS. The notice will include the information Customer reasonably needs to meet its own obligations, as it becomes available. ContX will take reasonable steps to contain and remedy the breach and will cooperate with Customer. Notification is not an admission of fault or liability.
9. Assistance
Taking into account the nature of the processing, ContX will provide reasonable assistance to Customer with: responding to requests from data subjects to exercise their rights, as described in section 13 of the DPS; data protection impact assessments and prior consultations with supervisory authorities relating to the Services; and Customer’s security obligations.
Customer will first use the self-service tools in the Services. ContX may charge reasonable costs for assistance that goes beyond those tools and is not required by Data Protection Laws.
10. International transfers
ContX may process Customer Personal Data in the United States and other countries where ContX or its Subprocessors operate, as described in section 10 of the DPS, provided the transfer complies with Data Protection Laws.
EEA transfers. For transfers of Customer Personal Data from the European Economic Area to ContX in a country without an adequacy decision, the SCCs are incorporated into this DPA: Module 2 where Customer is a controller and Module 3 where Customer is a processor. For the SCCs: Clause 7 (docking) applies; under Clause 9(a), Option 2 (general authorization) applies, with the notice period in section 7; the optional language in Clause 11 does not apply; under Clause 13, the competent supervisory authority is determined as set out in that clause; under Clauses 17 and 18, the SCCs are governed by the laws of Ireland and disputes are resolved by the courts of Ireland. Annex I is completed by section 14, Annex II by sections 7 and 8 of the DPS, and Annex III by the Subprocessor list referenced in section 7.
UK transfers. For transfers from the United Kingdom, the UK Addendum applies to the SCCs as completed above. Table 1 is completed with the parties’ details in the Order and section 14, Tables 2 and 3 by the paragraph above and this DPA, and for Table 4 either party may end the UK Addendum as set out in its Section 19.
Swiss transfers. For transfers from Switzerland, the SCCs apply as completed above, with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; references to the GDPR are read as references to the FADP; and the term “Member State” is read so that data subjects in Switzerland can bring claims in their place of habitual residence.
If the SCCs or the UK Addendum conflict with this DPA, they prevail. If a transfer mechanism is invalidated or replaced, the parties will work in good faith to adopt a valid alternative.
11. U.S. state privacy laws
Where the CCPA or another U.S. state privacy law applies, ContX acts as Customer’s service provider or processor and will: (a) not sell or share Customer Personal Data, as those terms are defined in the CCPA; (b) not retain, use or disclose it for any purpose other than the business purposes set out in the Agreement, or outside the direct business relationship with Customer; (c) not combine it with personal data ContX receives from other sources, except as those laws permit; (d) comply with those laws and provide the same level of privacy protection they require; and (e) notify Customer if it can no longer meet these obligations.
Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data. ContX certifies that it understands and will comply with the restrictions in this section.
12. Audits
ContX will make available the information reasonably needed to demonstrate compliance with this DPA, as described in section 14 of the DPS. Where Data Protection Laws or the SCCs require it and that information is not enough, Customer may conduct an audit on the terms set out in section 14 of the DPS. Audit information is ContX’s Confidential Information.
13. Return and deletion
Customer can export Customer Personal Data at any time using the export tools in the Services. After the Agreement ends, ContX will delete Customer Personal Data as described in section 12 of the DPS, unless the law requires ContX to keep it. Any data ContX must keep remains protected by this DPA for as long as it is kept.
14. Details of the processing
Parties: the data exporter is Customer, as identified in the Order, acting as controller or processor. The data importer is ContX.ai, Inc., acting as processor or subprocessor; contact privacy@contx.ai.
| Item | Description |
|---|---|
| Subject matter and purpose | Providing the Services under the Agreement: brand and content creation with AI, publishing to connected channels, CRM, lead capture and enrichment, chat bots, analytics, AI visibility and customer support. |
| Nature of processing | Collection, storage, organization, structuring, analysis, generation of AI Outputs, transmission to connected platforms at Customer’s direction, retrieval, and deletion. |
| Duration and frequency | Continuous, for the term of the Agreement and the deletion period in section 12 of the DPS. |
| Data subjects | Customer’s employees and contractors; Customer’s clients and their staff; prospects, leads and end customers; website visitors who use forms or chat bots. |
| Types of personal data | Contact and company details (such as name, email, phone, job title and company); business relationship records (leads, deals, contracts and invoices); messages and approvals; content, images and video that may include individuals; website and campaign interaction data; and connected account identifiers. |
| Special categories | None. The Services are not designed for special categories of personal data, and Customer must not submit them unless ContX agrees in writing. |
| Retention | As described in section 12 of the DPS. |
| Subprocessor transfers | To the Subprocessors listed in section 9 of the DPS, for the same subject matter and duration. |
15. Liability, term and changes
Each party’s liability under this DPA is subject to the limitations of liability in the MSA, except where Data Protection Laws or the SCCs do not allow those limitations. Nothing in this DPA limits the rights of data subjects under the SCCs.
This DPA applies for as long as ContX processes Customer Personal Data. ContX may update it to reflect changes in Data Protection Laws or the Services, but an update will not reduce the protection of Customer Personal Data during a paid subscription term.
Version history: 1.0, October 1, 2026, first version.