Data Processing Addendum

1. Roles and instructions

For customer workspace data, the customer determines the purposes and means of processing in its business context, and HexSales processes that data to provide and secure the service under documented customer instructions and this addendum.

2. Subject matter and data

Processing covers account operation, business configuration, CRM records, conversations, appointments, AI-assisted responses and supported integrations. Data categories may include account identifiers, business data, customer contacts, communications and technical security data.

3. Confidentiality and security

HexSales personnel and systems should access data only as necessary to provide the service. The technical model uses tenant boundaries, server-side authorisation, database row-level security, access gates and server-side secret handling. Appropriate measures are reviewed as the service changes.

4. Subprocessors and transfers

The customer authorises use of the subprocessors listed in the Subprocessor List for the stated purposes. Providers may process data internationally. A customer may raise a reasonable objection through the privacy category of the HexSales contact form.

5. Assistance, incidents and end of service

HexSales will reasonably assist with authenticated data-subject requests and provide information about a confirmed personal-data incident without undue avoidable delay, taking account of the nature of processing and information available. On end of service, data handling is subject to the product’s deletion/export capability, legal obligations, security needs and backup lifecycle; specific commitments require the applicable signed agreement.

6. Reasonable review

On reasonable written notice and no more often than is proportionate to the risk, a customer may request information needed to assess these processing commitments. Reviews must protect other customers, security controls and confidential information, avoid unnecessary disruption, and first use available policies, technical evidence and written responses before any broader audit is considered.

7. Customer and processor obligations

The customer must provide lawful, documented instructions, maintain a legal basis and notices for its data, configure authorised users, and avoid submitting data beyond what is needed. HexSales processes customer data only for the service, keeps authorised access confidential, applies documented security controls, manages subprocessors, assists with verified requests where reasonably possible, and returns or deletes data according to the reviewed request process, provider backup lifecycle and applicable law.

8. Appendix — processing details

• Subject matter: account operation, business configuration, customer communications, CRM, appointments, AI-assisted replies and optional Telegram integration.
• Duration: while the customer uses the service and for the limited period needed for security, legal obligations, disputes and backup lifecycle.
• Nature and purposes: hosting, organising, transmitting, securing and, when enabled, generating AI-assisted replies from customer instructions.
• Data subjects: customer personnel, prospects, end customers, Web Chat users and Telegram users who contact a connected business.
• Personal data: account identifiers, business contacts, CRM details, message content, appointments, channel identifiers and technical security metadata.
• Actual subprocessors: the current Subprocessor List, which forms part of this appendix.
• International transfers: additional contractual or other transfer mechanisms are used where required and agreed; this DPA does not claim that particular SCCs have already been signed.
• Liability: the relationship with the Terms applies, subject to rights and liabilities that cannot be limited by law.