This Data Processing Agreement (“DPA”) forms part of the Terms of Service (or any other agreement for Odexy) between Odexy LLC (“we”, “Processor”) and the customer (“you”, “Controller”). It applies automatically when you accept the Terms; you do not need to sign it. If your procurement process needs a countersigned copy, write to support@odexy.app with your organization’s legal name and address.
Where this DPA conflicts with the Terms on the processing of personal data, this DPA prevails. Where the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.
1. Definitions
Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject”, “personal data breach” and “supervisory authority” have the meanings in the GDPR. “Data Protection Laws” means all laws on privacy and personal data that apply to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law (“UK GDPR”) and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, US state privacy laws such as the California Consumer Privacy Act (“CCPA”), Brazil’s LGPD and India’s Digital Personal Data Protection Act. “Customer Personal Data” means personal data in Customer Data (as defined in the Terms) that we process on your behalf.
2. Roles and scope
2.1. You are the controller (or, for US state laws, the “business”) of Customer Personal Data, and we are your processor (or “service provider”). Where you are yourself a processor for another controller, we are your sub-processor, and you confirm that your instructions are authorized by that controller.
2.2. Annex I describes the processing. We are the controller of the personal data we process to run our relationship with you (accounts, billing, security and support), as described in our Privacy Policy; this DPA does not apply to that data.
2.3. You are responsible for the lawfulness of the processing you instruct, including having a lawful basis, giving notices and obtaining any consents — especially for special category data, data about children and data used in employment decisions.
3. Instructions
3.1. We process Customer Personal Data only on your documented instructions, including with regard to international transfers, unless the law requires otherwise; in that case we will tell you before processing unless the law prohibits it. Your instructions are the Terms, this DPA, and your use and configuration of the Service by you and your users.
3.2. We will tell you if, in our opinion, an instruction infringes Data Protection Laws.
3.3. We do not use Customer Personal Data to train AI models, sell it, share it for cross-context behavioral advertising, or combine it with personal data from other sources except as needed to provide the Service to you.
4. Confidentiality
We ensure that everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality, and that they access it only as needed to provide, support and secure the Service or to comply with law. Staff access to a workspace for support requires a stated reason, expires automatically and is recorded in your audit trail.
5. Security
5.1. We implement the technical and organizational measures in Annex II, which are appropriate to the risk. We may update them, provided the overall level of protection does not decrease.
5.2. You are responsible for the security of your accounts and for using the security features the Service provides, such as two-factor authentication, single sign-on and role-based permissions.
6. Sub-processors
6.1. You give us general authorization to engage sub-processors. The current list is on our sub-processors page, which forms Annex III.
6.2. We will give at least 30 days’ notice before adding or replacing a sub-processor, by updating that page and announcing the change in our changelog, and by email if you have asked for it at support@odexy.app.
6.3. You may object on reasonable data protection grounds within the notice period. We will discuss your objection in good faith and look for an alternative. If we cannot resolve it, you may terminate the affected part of the Service by written notice, and we will refund any fees you prepaid for the period after termination.
6.4. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible to you for their performance.
7. Requests from data subjects
We will, taking into account the nature of the processing, help you respond to requests from data subjects to exercise their rights. Most requests can be handled by you directly in the Service, for example by viewing, correcting, exporting or deleting records. If we receive a request about Customer Personal Data directly, we will not respond to it ourselves except to direct the person to you, and we will forward it to you promptly.
8. Personal data breaches
8.1. We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We send notice to your workspace owners’ email addresses.
8.2. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available, take reasonable steps to contain and remedy the breach, and help you meet your own notification obligations.
8.3. Our notification is not an acknowledgment of fault.
9. Impact assessments and consultation
We will give you reasonable help, using information available to us, with data protection impact assessments and prior consultations with supervisory authorities that relate to your use of the Service.
10. International transfers
10.1. Our production systems are hosted in the European Union. Customer Personal Data may be accessed from or transferred to other countries, including the United States, by us and our sub-processors.
10.2. EEA. Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated into this DPA by reference: Module 2 (controller to processor) where you are a controller, and Module 3 (processor to processor) where you are a processor. For the SCCs: the optional docking clause in Clause 7 applies; under Clause 9 option 2 (general written authorization) applies, with the notice period in section 6.2; the optional wording in Clause 11 does not apply; under Clause 13 the competent supervisory authority is the one determined by the GDPR for you; Clauses 17 and 18 are governed by the law and courts of Ireland; and Annexes I, II and III of this DPA complete the corresponding annexes of the SCCs.
10.3. United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies, completed with the information in this DPA; either party may end it as set out in its Section 19.
10.4. Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and “Member State” including Switzerland.
10.5. Where a recipient is certified under the EU-US Data Privacy Framework (or its UK or Swiss extension), we may rely on that framework instead.
11. Information and audits
11.1. We will make available the information reasonably necessary to demonstrate our compliance with this DPA, including answering security questionnaires once a year.
11.2. If that information is not sufficient, or a supervisory authority requires it, you may audit our compliance, no more than once a year unless a breach has occurred, on at least 30 days’ written notice, during business hours, at your cost, and under confidentiality. The audit must not access other customers’ data or compromise the security of the Service. We will agree the scope with you in advance.
12. Return and deletion
12.1. During the term, you can export Customer Personal Data using the Service’s export features. After your subscription ends, your workspace remains available read-only so that you can export it.
12.2. On your written instruction, or when you delete your workspace, we will delete Customer Personal Data from our active systems within 30 days, and it will leave our backups as they expire, within a further 30 days. We will confirm deletion in writing on request. We may keep data the law requires us to keep, and will protect it and process it only for that purpose.
13. United States state privacy laws
Where the CCPA or a similar US state law applies, we act as your service provider or processor, and we:
- process Customer Personal Data only for the limited and specified business purpose of providing the Service described in the Terms;
- do not sell or share it, or retain, use or disclose it for any purpose other than that business purpose, or outside our direct business relationship with you, except as the law permits;
- do not combine it with personal information we receive from other sources, except as the law permits;
- comply with the law’s obligations for service providers and provide the same level of privacy protection it requires;
- notify you if we can no longer meet those obligations, and allow you to take reasonable steps to stop and remedy unauthorized use.
We certify that we understand and will comply with these restrictions.
14. Other laws
Where Brazil’s LGPD applies, we act as your operator (operador) and follow your lawful instructions. Where India’s Digital Personal Data Protection Act applies, we act as your data processor and process personal data only under this DPA; you remain responsible as data fiduciary, including for any verifiable consent required for children under 18.
15. Liability and term
15.1. Each party’s liability under this DPA is subject to the limitations of liability in the Terms, except where Data Protection Laws or the SCCs do not allow them to be limited.
15.2. This DPA lasts as long as we process Customer Personal Data for you.
Annex I — Description of the processing
| Data exporter | The Controller, as identified in its workspace and billing details. Contact: its workspace owners. Role: controller (or processor). |
|---|---|
| Data importer | Odexy LLC, New York, NY, United States. Contact: support@odexy.app. Role: processor (or sub-processor). |
| Categories of data subjects | Determined by the Controller. Typically: the Controller’s users, employees, contractors and their dependents and emergency contacts; job candidates; clients, customers, leads and business contacts; people who correspond by email or chat; people who submit forms or sign documents; visitors to websites and help centers the Controller publishes; and people who contact the Controller’s support. |
| Categories of personal data | Determined by the Controller. Typically: identification and contact details; professional and employment details; compensation, bank and tax details; time, attendance and leave records, which may include clock-in location; recruitment records, including CVs and evaluations; communications, files and recordings; e-signature evidence (time, IP address, approximate location, browser); form answers; and activity records. |
| Special categories and sensitive data | Only where the Controller chooses to collect them — for example health information, ethnicity, religion, disability, sexual orientation, voluntary equal-opportunity data, government identifiers and precise location. Measures in Annex II apply. |
| Frequency | Continuous, for the term of the agreement. |
| Nature and purpose | Hosting, storage, organization, retrieval, transmission, analysis (including by AI features the Controller’s users invoke), and deletion, in order to provide the Service under the Terms. |
| Retention | For the term, then as set out in section 12 and in the Privacy Policy. |
| Transfers to sub-processors | As listed in Annex III, for the purposes stated there. |
| Competent supervisory authority | As determined by Clause 13 of the SCCs. |
Annex II — Technical and organizational measures
Encryption. Data in transit is encrypted with TLS 1.2 or 1.3, with HTTP Strict Transport Security. Sensitive credentials held for the Controller — connected-account tokens and passwords, and email, AI and payment provider keys — and performance-review narratives are additionally encrypted in the database with AES-256-GCM. User passwords are stored only as salted scrypt hashes.
Access control. Every request is checked against the Controller’s role-based permissions, and every database query is scoped to the Controller’s workspace. The Service offers two-factor authentication (authenticator apps, backup codes, email codes), passkeys, and single sign-on by OpenID Connect. Staff access to a workspace for support requires a stated reason, expires automatically and is recorded in the audit trail. Production secrets are held on the servers with access restricted to administrators.
Logging. Actions taken in the Service — by people, by the AI assistant and by integrations — are recorded in an audit trail that workspace administrators can review, retained as described in the Privacy Policy.
AI safeguards. The AI assistant acts only within the permissions of the user who invokes it and cannot perform actions classified as dangerous or irreversible.
Abuse protection. Sign-in, sign-up and password reset are rate-limited; bot checks and a breached-password check are available.
Availability and recovery. The database is backed up before each deployment and backups are retained for 30 days. Service status is published on our status page.
Vulnerability management. We operate a vulnerability disclosure process, described on our Security page, and fix reported issues according to their severity.
Personnel. Access is limited to people who need it to operate the Service, who are bound by confidentiality.
Incidents. We investigate security events and notify the Controller of personal data breaches as set out in section 8.
Annex III — Sub-processors
The sub-processors authorized under section 6 are those listed on our sub-processors page, as updated under that section.