Loading
Legal
Personal Data processed on a Customer's behalf
1.1 In this DPA: "Agreement" means the Flowence Master Subscription Agreement or the Alayrix Managed Services Terms, as applicable; "Data Protection Law" means all laws applicable to the processing of Customer Personal Data, including the GDPR (Regulation (EU) 2016/679), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), other United States state privacy laws, the Personal Information Protection and Electronic Documents Act (Canada) and provincial equivalents including Quebec Law 25, the Australian Privacy Act 1988, the Singapore PDPA, the Saudi Personal Data Protection Law, the United Arab Emirates Federal Decree-Law No. 45 of 2021 and other laws of the Middle East and South East Asia, each as applicable; "Customer Personal Data" means Personal Data in the Customer Content that Processor processes on behalf of Controller; "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data; "Restricted Transfer" means a transfer of Customer Personal Data to a country that requires a transfer mechanism under Data Protection Law; "SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914; "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018; "Subprocessor" means a third party engaged by Processor to process Customer Personal Data. The terms "controller", "processor", "data subject", "process", "business", "service provider", "sell", "share" and "supervisory authority" have the meanings given in Data Protection Law. Other capitalised terms have the meaning given in the Agreement.
1.2 Where a term used in this DPA has no direct equivalent in a particular Data Protection Law, it is interpreted to give effect to the closest equivalent concept.
2.1 This DPA applies to the processing of Customer Personal Data by Processor on Controller's behalf under the Agreement. Schedule 1 describes the subject matter, nature, purpose and duration of processing, the types of Personal Data and the categories of data subjects.
2.2 As between the Parties, Controller is the controller (or business) and Processor is the processor (or service provider) of Customer Personal Data. Where Controller is itself a processor for a third-party controller, Controller warrants that its instructions and authorisations have been authorised by the relevant controller, and Processor acts as a sub-processor.
2.3 Processor processes Personal Data for its own purposes as an independent controller as described in the Privacy Policy (Part 4), and that processing is outside this DPA.
2.4 In the event of conflict, this DPA prevails over the Agreement as to the processing of Customer Personal Data, and the SCCs and UK Addendum (where they apply) prevail over this DPA.
3.1 Processor will process Customer Personal Data only on documented instructions from Controller, which are the Agreement (including this DPA), Controller's configuration and use of the services, and any further written instructions that are consistent with the Agreement, unless Processor is required by law to process otherwise, in which case it will inform Controller before processing unless prohibited.
3.2 Processor will inform Controller if, in its opinion, an instruction infringes Data Protection Law, and may suspend the relevant processing until the instruction is modified or confirmed. Processor is not required to perform a legal assessment of Controller's instructions.
3.3 Controller's use of AI Features and the sending of Inputs to AI Providers is an instruction to process Customer Personal Data through those providers, as described in clause 14.
Controller is responsible for: (a) the lawfulness of its processing, including having a valid lawful basis and giving all required notices and obtaining all required consents for Customer Personal Data; (b) the accuracy and minimisation of Customer Personal Data; (c) not submitting special-category data, children's data, payment-card data or government identifiers except as Schedule 1 provides or as the parties otherwise agree in writing; (d) responding to data-subject requests as controller, subject to clause 9; (e) configuring the services securely and managing access by its Authorised Users; and (f) its compliance with Data Protection Law in its use of the services.
Processor will ensure that persons authorised to process Customer Personal Data are subject to a duty of confidentiality, receive appropriate training, and process Customer Personal Data only as necessary to perform the Agreement.
6.1 Processor will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against Personal Data Breach, taking into account the state of the art, costs, the nature, scope, context and purposes of processing and the risk to data subjects, including the measures in Schedule 2.
6.2 Processor may update its measures from time to time provided that it does not materially reduce the overall level of protection.
7.1 General authorisation. Controller gives Processor general written authorisation to engage Subprocessors, including the categories in Schedule 3 (cloud hosting by DigitalOcean and Microsoft Azure; AI Providers, which may include OpenAI, Google and DeepSeek; payment, email, analytics and support providers) and Processor's Affiliates.
7.2 List. The current list of Subprocessors is available on written request to services@alayrix.com, and Processor will provide it within ten (10) Business Days of the request.
7.3 Changes and objection. Processor will give Controller at least thirty (30) days' notice of the addition or replacement of a Subprocessor, by email to the Controller's account contact or through the services, to Controllers who have requested to receive notices by sending a request to services@alayrix.com. Controller may object on reasonable data-protection grounds within fifteen (15) days of the notice. The parties will discuss in good faith, and if no resolution is reached within thirty (30) days, Controller may terminate the affected services on written notice and receive a pro-rata refund of prepaid Fees for the unexpired period, as its sole remedy. Where Processor must replace a Subprocessor urgently for security or continuity reasons, it will notify Controller as soon as practicable.
7.4 Flow-down and responsibility. Processor will impose on each Subprocessor data-protection obligations that are no less protective in substance than those in this DPA and remains liable for the Subprocessors' performance of those obligations, subject to the limitations of liability in the Agreement.
8.1 Processor is located in Pakistan and uses Subprocessors in other countries. Controller authorises Restricted Transfers to Processor and its Subprocessors, subject to this clause and Schedule 4.
8.2 EEA and Switzerland. For Restricted Transfers of Customer Personal Data subject to the GDPR or the Swiss Federal Act on Data Protection from Controller to Processor, the SCCs are incorporated and apply as completed in Schedule 4: Module Two (controller to processor) where Controller is a controller, and Module Three (processor to processor) where Controller is a processor.
8.3 United Kingdom. For Restricted Transfers of Customer Personal Data subject to the UK GDPR, the UK Addendum applies, completed as stated in Schedule 4.
8.4 Onward transfers. Processor will ensure that onward transfers to Subprocessors are subject to appropriate safeguards, which may include the SCCs (Module Three), adequacy decisions or other lawful mechanisms. Processor will carry out and document a transfer impact assessment where required and implement supplementary measures where necessary, and will provide a summary on request.
8.5 Other jurisdictions. For Restricted Transfers subject to the laws of Canada, Australia, Singapore, Saudi Arabia, the United Arab Emirates, Qatar, Bahrain, Kuwait, Oman, Malaysia, Indonesia, Thailand, the Philippines, Vietnam or another jurisdiction, the parties will rely on the transfer mechanism that the applicable law requires or recognises, including standard contractual clauses or equivalent model terms, adequacy, consent, or contractual commitments, and Schedule 4 applies. Processor will cooperate to execute the documents that are reasonably required.
8.6 Alternative mechanism. If a transfer mechanism is invalidated or ceases to be available, the parties will cooperate in good faith to adopt an alternative lawful mechanism, and Processor may suspend the transfer meanwhile.
Processor will, taking into account the nature of the processing, promptly forward to Controller any request it receives directly from a data subject relating to Customer Personal Data (and will not respond except to direct the data subject to Controller, unless required by law), and will provide reasonable assistance, including by means of the self-service functions in the services, to enable Controller to respond to requests to exercise data-subject rights. Processor may charge reasonable fees for assistance that goes beyond the standard functionality and requires significant effort.
Processor will provide reasonable assistance to Controller, taking into account the nature of processing and the information available to Processor, in ensuring compliance with obligations on security, breach notification, data protection impact assessments and prior consultation with supervisory authorities. Processor may charge reasonable fees for assistance beyond the standard functionality that requires significant resources.
11.1 Processor will notify Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, by email to the Controller's account contact.
11.2 The notice will, to the extent known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, and Processor will provide further information as it becomes available. Processor will take reasonable steps to contain and remediate the breach and cooperate with Controller's reasonable requests.
11.3 Controller is responsible for notifying supervisory authorities and data subjects where required. Notification of or response to a breach by Processor is not an acknowledgement of fault or liability.
12.1 Processor will make available to Controller the information reasonably necessary to demonstrate compliance with this DPA, including, on request, a summary of its security measures, relevant policies and third-party certifications or audit reports if it holds them (which are Processor's Confidential Information).
12.2 Where that information is insufficient to satisfy Controller's obligations under Data Protection Law or a supervisory authority's requirement, Controller (or an independent auditor bound by confidentiality and not a competitor of Processor) may audit Processor's relevant controls, not more than once in any twelve (12) month period (except after a Personal Data Breach or where required by a supervisory authority), on at least thirty (30) days' written notice, during business hours, without unreasonable disruption, under a scope agreed in advance, and at Controller's cost. Audits may not give access to data of other customers or to information that would compromise security or privilege. The parties will agree that a remote questionnaire or document review will be used first.
12.3 Nothing in this clause varies the audit rights that a supervisory authority or the SCCs give directly.
On termination or expiry of the Agreement, Processor will, at Controller's choice, return or delete Customer Personal Data in accordance with the Agreement and, in any event, within the periods stated there (export available for thirty (30) days; deletion from active systems and encrypted backups within thirty (30) days after the subscription ends), unless law requires retention, in which case Processor will isolate the data, protect it and process it only as the law requires. On request, Processor will certify deletion in writing.
14.1 Processor uses AI Providers as Subprocessors for the AI Features. Inputs and relevant Customer Personal Data are transmitted to those providers only to generate the AI Output requested by Controller.
14.2 Processor will configure commercial AI interfaces so that Customer Personal Data is not used by the AI Provider to train its general-purpose models, where that option is available, and will contractually restrict AI Providers to processing for the purpose of providing the service, subject to limited retention for abuse monitoring and legal compliance. Processor will not itself use Customer Personal Data to train a general-purpose AI model.
14.3 Controller will not submit special-category data, children's data or other Personal Data that is not suitable for third-party AI processing as Inputs unless Schedule 1 so provides. Controller is responsible for human review of AI Output, for transparency to data subjects and for decisions made with AI Output.
14.4 Controller acknowledges that Inputs sent to a DeepSeek-backed feature may be processed on infrastructure located in or subject to the laws of the People's Republic of China, that this is a Restricted Transfer to a country that has not been recognised as providing adequate protection by the European Commission, and that Controller may ask Processor in writing to disable that provider for its Account. Controller will not use that provider for Customer Personal Data of data subjects in the European Economic Area, the United Kingdom or any jurisdiction that restricts such transfers unless Controller has satisfied itself that the transfer is lawful.
15.1 Processor is a "service provider" and "processor" and will: (a) process Customer Personal Data only for the business purposes specified in the Agreement and this DPA; (b) not "sell" or "share" Customer Personal Data; (c) not retain, use or disclose Customer Personal Data for any purpose other than the specified business purposes, or outside the direct business relationship, or combine it with Personal Data from other sources, except as permitted by law; (d) comply with applicable obligations and provide the same level of privacy protection as the law requires; (e) notify Controller if it can no longer meet its obligations; (f) permit Controller, on reasonable notice, to take reasonable steps to ensure that Processor uses the data consistently with Controller's obligations and to stop and remediate unauthorised use; and (g) flow down equivalent obligations to Subprocessors.
15.2 Processor certifies that it understands and will comply with these restrictions. Controller's disclosure of Customer Personal Data to Processor is for valid business purposes and not for monetary or other valuable consideration.
Where Data Protection Law of Canada, Australia, Singapore, the Middle East or South East Asia imposes requirements that are not addressed in this DPA, the parties will cooperate in good faith to implement them, and Processor will, on request, enter into the additional terms that those laws require of a processor, to the extent they do not conflict with this DPA.
Each party's liability arising out of or in connection with this DPA, including the SCCs and UK Addendum, is subject to the exclusions and limitations of liability in the Agreement, to the extent permitted by Data Protection Law, and without limiting the liability of either party to data subjects or to supervisory authorities under the SCCs or Data Protection Law that cannot be limited.
This DPA takes effect on the effective date of the Agreement (or, if later, the first processing of Customer Personal Data) and continues for as long as Processor processes Customer Personal Data, including during the return and deletion periods in clause 13.
19.1 This DPA is governed by the governing law and jurisdiction clauses of the Agreement, being the laws of the Islamic Republic of Pakistan and the courts of Karachi, except that: (a) the SCCs are governed by the law of the Member State specified in Schedule 4 (Ireland) and disputes under them are resolved by the courts of that Member State; (b) the UK Addendum is governed by the laws of England and Wales and the courts of England and Wales have jurisdiction; and (c) where the law of a Controller's country requires a different governing law for data-processing terms, that law applies to those terms to the extent of the requirement.
20.1 If a provision of this DPA is invalid, the remainder continues in force. The parties may agree reasonable amendments needed to comply with changes in Data Protection Law, and Processor may update this DPA on at least thirty (30) days' notice where required to reflect a change in law or a regulator's guidance, without reducing the level of protection.
20.2 Notices under this DPA are given as set out in the Agreement. Data-protection contact for Processor: services@alayrix.com, subject Privacy Request. Where required by Article 27 of the GDPR and the UK GDPR, the Processor will appoint EU and UK representatives and publish their details in this DPA. Until then, contact services@alayrix.com.
Data exporter: Controller, as identified in the Agreement, acting as controller (or as processor for a third-party controller). Data importer: BnR360, H#C-40, Karachi University Staff Town, Karachi, Pakistan, acting as processor. Contact for data protection matters: services@alayrix.com. Role: processor.
Provision of the Flowence platform and Alayrix managed services under the Agreement, including hosting, storage, retrieval, organisation, adaptation, translation, summarisation, analysis, scheduling, publication through connected Third-Party Platforms, transmission to AI Providers for generating AI Output, support, backup, security monitoring and deletion.
To provide, maintain, support and secure the services and perform Controller's documented instructions.
The term of the Agreement and the return and deletion period in clause 13 of the DPA.
Continuous, for the duration of the Agreement.
Controller's Authorised Users, employees and contractors; Controller's customers, prospects, leads and subscribers; followers, commenters and audience members of connected social-media accounts; individuals named in or appearing in Customer Content; and other individuals whose Personal Data Controller or its Authorised Users submit to the services.
Identification and contact data (name, email, phone, job title, employer, social-media handle); account and credential identifiers; content and communications (posts, comments, messages, images, video, audio, documents); connected-account data and analytics; audience engagement data; device, log and usage data; IP address and approximate location; and any other Personal Data in Customer Content or Inputs.
None is intended. Controller must not submit special-category data, children's data, payment-card data, government identifiers or biometric data unless the parties record an exception in a signed Order Form that specifies the data, the purpose and any additional safeguards. If sensitive data is submitted without that agreement, Processor applies the security measures in Schedule 2, and Controller is responsible for the consequences.
As stated in clause 13 of the DPA and in the Agreement.
Subject matter, nature and duration are the same as above and as described in Schedule 3.
For the SCCs: the supervisory authority of the Member State in which Controller is established or, if Controller is not established in the European Union, the Member State of its representative under Article 27 of the GDPR or, failing that, the Irish Data Protection Commission. For the UK Addendum: the UK Information Commissioner's Office.
Processor maintains the following measures, which are updated as the state of the art evolves.
Processor engages Subprocessors in the following categories. The current list, identifying each Subprocessor by name, processing location and function, is available on written request to services@alayrix.com, and changes are notified under clause 7 of the DPA.
The parties agree that: (1) Module Two applies where Controller is a controller and Module Three applies where Controller is a processor; (2) Clause 7 (docking clause) applies; (3) in Clause 9(a), Option 2 (general written authorisation) applies, with notice as stated in clause 7.3 of the DPA; (4) in Clause 11(a), the optional independent dispute-resolution language does not apply; (5) in Clause 13(a) the competent supervisory authority is stated in Schedule 1, Part K; (6) in Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; (7) in Clause 18(b), disputes will be resolved by the courts of Ireland; (8) Annex I.A, I.B and I.C are completed by Schedule 1; Annex II by Schedule 2; and Annex III by Schedule 3 and the list available on request. For transfers subject to the Swiss Federal Act on Data Protection, references to the GDPR are to that Act, references to a Member State are to Switzerland, the competent authority is the Swiss Federal Data Protection and Information Commissioner, and the term "Member State" does not exclude data subjects in Switzerland from suing in Switzerland. Where the SCCs are executed by reference, the parties' acceptance of the Agreement constitutes signature of the SCCs.
Table 1 (parties): as in Schedule 1, Part A. Table 2 (selected SCCs, modules and clauses): the SCCs as described in Part A of this Schedule, appended to the UK Addendum. Table 3 (appendix information): Annex I as Schedule 1, Annex II as Schedule 2 and Annex III as Schedule 3. Table 4 (ending the addendum when the approved addendum changes): neither party may end the UK Addendum solely because of a change, unless required by the Information Commissioner. The Mandatory Clauses of the approved UK Addendum are incorporated by reference.
Where a Restricted Transfer is subject to the law of another jurisdiction, then to the extent that law recognises or requires standard contractual clauses or equivalent model terms (including those of Canada, Australia, Singapore, the United Arab Emirates, Saudi Arabia, Qatar and other countries identified in clause 8.5 of the DPA), the SCCs (modified as necessary so that references to GDPR concepts are read as references to the equivalent concepts of the applicable law and the competent authority is the authority of that jurisdiction) are deemed incorporated, or the parties will execute the model terms prescribed by that jurisdiction.
Processor will: (a) notify Controller of any legally binding request from a public authority for disclosure of Customer Personal Data unless prohibited by law; (b) review the legality of the request and challenge it where there are reasonable grounds to consider it unlawful; (c) disclose only the minimum amount of Customer Personal Data permissible; and (d) document its assessment. Processor represents that, as of the effective date, it has not received any order or request from a public authority to disclose Customer Personal Data in connection with the services, and will update Controller if that changes in a way that materially affects its ability to comply.
Processor has assessed, and will keep under review, the laws and practices of the destination countries (including Pakistan, the United States and any country where an AI Provider processes data) as they apply to the transfer, and has concluded that, together with the safeguards in the DPA, SCCs and supplementary measures (including encryption, access controls and the government-access commitments above), the transfers can be made with a level of protection that is essentially equivalent to that in the originating jurisdiction, except for transfers to an AI Provider on infrastructure in the People's Republic of China, as to which clause 14.4 of the DPA applies. A summary is available on request.
