Data Processing Addendum.

Effective date: 2026-10-27.

Background

This Data Processing Addendum (the "DPA") forms part of the agreement between wrxstack ("wrxstack") and the customer ("Customer") for the provision of the wrxstack AI work platform (the "Services"). It reflects the parties' agreement on the processing of Personal Data in connection with the Services. To the extent of conflict between this DPA and the underlying agreement, this DPA controls with respect to Personal Data processing, except that the disclaimers and the limitation of liability in the Terms of Service apply to this DPA as set out in Section 15. This DPA sets out the processor commitments that Data Protection Laws require; it does not add obligations beyond them except where it says so expressly.

1. Definitions

Terms used in this DPA have the meanings given to them in the GDPR, UK GDPR, CCPA, FADP, or LGPD, as applicable. In addition:

• Customer Personal Data means Personal Data processed by wrxstack on behalf of Customer in connection with the Services.
• Data Protection Laws means all data-protection and privacy laws applicable to the processing of Customer Personal Data, including the EU GDPR, the UK GDPR, the Swiss FADP, the CCPA (as amended by the CPRA), and other US state privacy laws.
• EU SCCs means the Standard Contractual Clauses approved by the European Commission in Decision 2021/914 of 4 June 2021.
• UK IDTA means the UK International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner's Office in 2022.
• Sub-processor means a third party engaged by wrxstack to process Customer Personal Data.

2. Roles & subject matter

With respect to Customer Personal Data, Customer is the controller (or processor on behalf of a third-party controller) and wrxstack is the processor (or sub-processor). Where wrxstack processes personal data of Customer's account contacts and billing contacts for its own corporate purposes, it acts as an independent controller and the Privacy Policy governs.

3. Duration, nature & purpose

The duration of processing is the term of the underlying subscription plus the deletion/return period in Section 11. The nature of processing is the provision of the Services (storage, retrieval, hosting, transmission, search, indexing, AI inference, backup, security monitoring, support). The purpose is to enable Customer to use the Services for its internal business operations.

4. Categories of data subjects

Customer Personal Data may relate to the following categories of data subjects, as determined by Customer: Customer's employees, contractors, and agents; Customer's customers, prospects, and business contacts; meeting participants; senders and recipients of email handled by Customer through the Services; and form respondents.

5. Categories of personal data

Customer determines the categories of Personal Data it processes through the Services. They may include: name, email address, phone number, postal address, employer, job title, profile photo, IP address, device and browser identifiers, login records, content of communications and documents, meeting recordings and transcripts, contract content, signature blocks, CRM records, billing identifiers, and any other information Customer chooses to upload. Customer is responsible for not submitting categories of Personal Data that the Services are not designed to receive without first contacting wrxstack.

6. Sub-processing

Customer authorizes wrxstack to engage Sub-processors to process Customer Personal Data, subject to this DPA. wrxstack publishes a list of Sub-processors at /legal/subprocessors and informs Customer of an intended addition or replacement by updating that page before the change takes effect, as Data Protection Laws require. Customer may object on reasonable data-protection grounds by writing to contact@wrxstack.com; if the parties cannot agree on a resolution, Customer's remedy is to stop using and terminate the affected Services. wrxstack will impose on each Sub-processor, by contract, the data-protection obligations that Article 28(4) GDPR requires, and remains responsible to Customer for each Sub-processor's performance of those obligations to the extent Data Protection Laws require, subject to Section 15.

7. Security measures

wrxstack takes the technical and organizational measures described in Annex II, which are designed to provide a level of security appropriate to the risk, as Article 32 GDPR requires. wrxstack reviews those measures from time to time as appropriate to the risk. No method of transmission or storage is completely secure, and wrxstack does not guarantee that Customer Personal Data will never be accessed without authorization.

8. International transfers

For transfers of Customer Personal Data from the EEA, the UK, or Switzerland to a country that the European Commission, UK government, or Swiss Federal Council has not deemed adequate, the parties incorporate by reference:

• For controller-to-processor transfers, the EU SCCs Module 2;
• For processor-to-processor transfers, the EU SCCs Module 3;
• For UK transfers, the UK IDTA with the EU SCCs;
• For Swiss transfers, the EU SCCs as modified by the Swiss FDPIC guidance (references to the GDPR replaced with the FADP; the FDPIC as supervisory authority; "Member State" interpreted to include Switzerland).

The parties select Option 2 for Clause 9 (general written authorization for Sub-processors). Annexes I and II to the SCCs are completed as set out in Annex I and Annex II of this DPA.

9. Data subject requests

Taking into account the nature of the processing, wrxstack will assist Customer, insofar as this is possible and through appropriate technical and organizational measures, in responding to requests from data subjects exercising their rights under Data Protection Laws. Assistance is primarily provided through the features of the Services that let Customer access, export, correct, and delete Customer Personal Data itself. Any further assistance is limited to information reasonably available to wrxstack and is at Customer's cost where the law allows. If wrxstack receives a data-subject request directly that relates to Customer Personal Data, wrxstack will, where reasonably practicable, forward it to Customer or direct the requester to Customer, and will not respond to it except on Customer's documented instructions or as required by law.

10. Personal data breach

wrxstack will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, as Article 33(2) GDPR requires. The notification will include the information described in Article 33(3) GDPR to the extent it is then known and reasonably available to wrxstack, and further information may be provided in phases as it becomes available. Taking into account the nature of the processing and the information available to wrxstack, wrxstack will assist Customer in meeting Customer's own notification obligations, at Customer's cost where the law allows. Notification of a Personal Data Breach is not an acknowledgement of fault or liability by wrxstack.

11. Deletion & return

On termination or expiration of the underlying agreement, or earlier on Customer's written request, wrxstack will, at Customer's election, delete or return the Customer Personal Data in its possession, as Data Protection Laws require. Return is provided by making Customer Personal Data available for export through the export features of the Services before deletion; Customer is responsible for exporting what it wants to keep. Deletion from the live database is carried out within a reasonable period; copies held in our hosting provider's backups age out on that provider's ordinary backup rotation and are then removed. wrxstack may retain Customer Personal Data to the extent and for the period required by applicable law, subject to the confidentiality obligations of this DPA.

12. Audit rights

wrxstack will make available to Customer the information reasonably available to it that is necessary to demonstrate compliance with Article 28 GDPR, and will allow for and contribute to audits as that Article requires, on the terms in this Section. wrxstack does not hold any audit report or security certification. Customer's audit right is satisfied first by written answers and documentation: wrxstack will answer Customer's reasonable written questions about its data-protection practices within a reasonable time, no more than once in any 12-month period. Only if Customer reasonably shows that those answers and documents are not sufficient to demonstrate compliance with Article 28 GDPR, or if a supervisory authority requires it, may Customer conduct a further audit, no more than once in any 12-month period unless a supervisory authority requires otherwise, on at least 30 days' prior written notice, by an independent auditor reasonably acceptable to wrxstack and bound by confidentiality, conducted remotely where possible, during business hours, and in a manner that does not unreasonably disrupt wrxstack's operations. Every audit, including wrxstack's reasonable time spent on it, is at Customer's cost where the law allows. Customer will share audit results with wrxstack on a confidential basis.

13. CCPA / CPRA, service provider terms

With respect to Personal Information of California residents, wrxstack acts as a "Service Provider" or "Processor" as those terms are defined in the CCPA. wrxstack will not (a) sell or share Personal Information; (b) retain, use, or disclose Personal Information for any purpose other than the specific business purpose of providing the Services; (c) retain, use, or disclose Personal Information outside the direct business relationship with Customer; or (d) combine Personal Information received from Customer with Personal Information from another source, except as permitted by the CCPA. wrxstack understands these restrictions and will comply with them as the CCPA requires.

14. Order of precedence

In the event of a conflict between this DPA and any other agreement between the parties, this DPA controls with respect to the processing of Personal Data. In the event of a conflict between this DPA and the SCCs, the SCCs control.

15. Limitation of liability

The disclaimers and the limitation of liability in the Terms of Service, including the exclusions, the cap, and the protection of the operator of wrxstack, apply to all claims arising out of or relating to this DPA, on any legal theory, and the cap in the Terms is the total, combined liability of wrxstack under the Terms and this DPA together. This Section applies to the maximum extent permitted by law and does not limit (a) any right of a data subject under Data Protection Laws or under the SCCs, or (b) any liability that cannot be limited under Data Protection Laws or the SCCs. Nothing in this DPA commits wrxstack to any payment, credit, or compensation to Customer beyond what a court or supervisory authority with jurisdiction orders under a law that applies.

Annex I, List of parties & processing

A. List of parties

B. Description of transfer

C. Competent supervisory authority

The Irish Data Protection Commission (for EEA exporters), the UK Information Commissioner's Office (for UK exporters), or the Swiss FDPIC (for Swiss exporters).

Annex II, Technical & organizational measures

These are the technical and organizational measures wrxstack applies. We list only what is actually in place. wrxstack holds no security or compliance certification and has not undergone a third-party audit or penetration test.

Annex III, Sub-processors

The current Sub-processor list is published at /legal/subprocessors and is updated as required by Section 6 of this DPA.