Data Processing Agreement

• Subject and purpose: providing IEXA to you, as described in the Terms: briefs, reminders, summaries and answers built from the tools you connect.
• Duration: as long as you use IEXA, plus the deletion period below.
• Kinds of personal data: what your connected tools contain and IEXA reads, for example order totals, calendar event titles and attendee counts, payment totals, and anything you tell the assistant about other people.
• Whose data: your customers, contacts, meeting attendees and staff.
• No special categories of data (like health data) are needed for IEXA to work; please don't put them in.

We process the data only on your documented instructions, which are these terms and how you set up and use IEXA. We'll tell you if we believe an instruction breaks data protection law. We never use your data for our own purposes, never sell it and never use it to train AI models.

Everyone at IEXA who can access the data is bound to confidentiality. We keep appropriate technical and organisational measures (GDPR article 32), including: encryption in transit (HTTPS) and of tokens and keys at rest (AES-256), read-only connections, access limited to the people who run IEXA, two-step sign-in on production systems, EU database hosting, and backups that expire within 30 days.

You give general authorisation for the subprocessors listed at iexa.si/subprocessors. We bind each of them to data protection terms at least as protective as these. We'll update the list at least 14 days before adding or replacing a subprocessor; if you email us, we'll also tell you by email. You can object on reasonable data protection grounds; if we can't resolve it, you may end the service and we'll refund any prepaid, unused period.

Where a subprocessor processes data outside the EU/EEA, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

We help you answer requests from the people whose data it is (access, deletion and so on), mostly through IEXA's built-in export and delete tools, and help you with security, breach notifications and impact assessments where that's reasonable for the information we have.

If we become aware of a personal data breach affecting your data, we tell you without undue delay and within 48 hours, with what we know and what we're doing about it, so you can meet your own 72-hour duty.

When you delete your account or stop using IEXA, we delete your data straight away, and backups that still contain it expire within 30 days, unless the law requires us to keep it. You can export your data first in Settings.

We make available the information needed to show we meet these obligations. Once a year, with 30 days' notice, you or an independent auditor bound to confidentiality may audit us, at your cost and without disrupting the service.

The liability terms in our Terms of Service apply to this agreement. If this agreement and the Terms disagree about personal data, this agreement wins.