Data Processing Agreement

This agreement applies where you keep records about your own clients in CADVIX. It forms part of the Terms of Service and takes effect automatically. If your business needs a signed copy, write to support@cadvix.com. It is made under Article 28 of the UK GDPR and, where it applies, Article 28 of the EU GDPR.

1. Roles

You are the controller of the information about your own clients. Cadvix is your processor. We are a controller only for your own account details and for the uses section 5 lets us make on our own account, which our Privacy Policy covers.

2. What we process for you

Records about your clients are held in an encrypted database on your own computer, and what travels between your computers is sealed on your computer first. Our relay holds sealed parcels it cannot open.

Personal data about your clients can still reach us readable, where someone at your business typed it into:

• a problem report or an idea sent from the designer or from CADVIX, or a crash report;
• a session package from the designer, which carries the design, the session log and the session's Cadvix AI conversation;
• a Cadvix AI request, which carries the conversation and a picture of the design, and the learning record kept of it.

3. Subject matter and duration

Item	Detail
Subject matter	Providing CADVIX: moving sealed data between your computers, answering Cadvix AI's requests, and receiving reports and session packages
Duration	For as long as your subscription runs, and until the retention periods in the Privacy Policy end
Nature and purpose	Storage and transmission of sealed material; processing of what reports, session packages and Cadvix AI requests carry, to provide CADVIX, to find and fix problems, and to improve CADVIX
Types of personal data	As your business records them: names, telephone numbers, email addresses, installation addresses, dates, notes and design files, and whatever someone types into a design, a report or a conversation
Categories of data subject	Your clients and their named contacts

4. Our obligations

• Instructions. We process only on your documented instructions, including about transfers outside the UK and the EEA. Using CADVIX, and the settings your managers choose in it, are your instructions. We will tell you if we believe an instruction breaks data protection law.
• Confidentiality. Everyone with access is bound to keep it confidential.
• Security. Measures appropriate to the risk, as section 9 sets out.
• Sub-processors. As section 6 sets out.
• Data subject requests. We will help you answer them. If one of your clients comes to us directly, we will tell you promptly and will not answer them ourselves, unless you tell us to or the law requires it.
• Breach notification. Without undue delay, and in any event within 48 hours of becoming aware.
• Assistance. With security, breach notification, impact assessments and consultations with a supervisory authority, so far as they concern our processing.
• Deletion or return. As section 10 sets out.
• Audits. We will make available the information you need to show compliance with this agreement, and allow for and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a supervisory authority requires otherwise, and at your cost unless the audit finds a material breach by us.

5. What you authorise us to do on our own account

You authorise us to de-identify the information described in section 2, and to use the resulting de-identified data as section 6 of the Privacy Policy sets out: to operate, maintain, secure and improve CADVIX, to develop new features, products and services, and for research and statistics. Once de-identified so that no one can reasonably be identified from it, the data is no longer personal data and this agreement no longer applies to it.

6. Sub-processors

You give general authorisation for the sub-processors on our Sub-processor List. We will update that list, and email the owner of your business, at least 30 days before a new sub-processor begins processing personal data, and you may object on reasonable data protection grounds. If we cannot resolve an objection, you may cancel without penalty. Where a provider stops its service, suffers a security incident, or must be replaced to keep CADVIX running or to meet the law, we may make the change sooner and will tell you as soon as we reasonably can.

Every sub-processor is bound by written terms no weaker than these, and we remain responsible to you for their performance.

7. International transfers

We are established in Israel, which holds adequacy decisions from the United Kingdom and the European Commission. Sealed parcels and our own services are in London. Cadvix AI's requests, and the reports and session packages we read with our AI provider's model, are processed in the United States. Where personal data goes outside the UK and the EEA, we rely on an adequacy decision where one exists, on the EU-US Data Privacy Framework and its UK Extension where the provider is certified, or on the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum.

8. Your obligations

You need a lawful basis for the client records you keep, and you tell your clients how they are handled, including that what your staff type into reports, session packages and Cadvix AI can reach us. We can give you wording for that. You ask your staff to keep clients' details out of reports and conversations.

9. Security measures

• Client records encrypted at rest on your computer, with a key wrapped by your operating system's secure store.
• Sealing on your computer of anything transmitted between your computers, and transport encryption of TLS 1.2 or higher on everything that travels to us.
• Separation by key between businesses, not only by permission.
• Passwords stored only as salted hashes, and session tokens only as hashes.
• Telephone numbers and email addresses removed by pattern from Cadvix AI conversations before they are kept, and your client's name as CADVIX knows it removed from learning records.
• Access to reports, session packages and learning records limited to the people who work on CADVIX for us, and learning records readable only through a read-only door.
• Updates signed with our own key and checked before they are installed.

10. Deletion and return

Your client records are on your computer throughout, so ending this agreement does not remove them and does not require us to return them. Sealed parcels are removed once collected, and anything left within 90 days of the subscription ending. Reports, session packages and learning records are deleted at the end of the periods the Privacy Policy sets, or sooner at your request, except where the law requires us to keep something longer.

11. Liability

The limits in section 13 of the Terms of Service apply, except where data protection law does not permit them to.

12. Force majeure

The force majeure clause in section 17 of the Terms of Service applies, and does not reduce our obligations under data protection law.

13. Law

This agreement is governed by the laws of the State of Israel. Where the UK GDPR or the EU GDPR requires specific terms, those terms apply and prevail over anything inconsistent here.

14. Changes and transfer

We may update this agreement to reflect a change in data protection law or in how we process. Where a change matters to you, we will tell you at least 30 days before it takes effect. This agreement transfers with the Terms of Service under their section 20.

15. Contact

Data protection contact: Itay Zilberschmidt, support@cadvix.com. Cadvix, Edar 35, Modi'in 7177072, Israel.