Data Processing Addendum

1. Scope

This Data Processing Addendum ("DPA") forms part of the SourceXray Terms of Service between SourceXray ("we", "us", the processor) and the customer ("you", the controller). SourceXray is operated from Australia. It applies when we process personal information on your behalf in providing the Service ("Customer Personal Data"), and it covers the requirements of the GDPR, UK GDPR, Swiss data protection law, the Australian Privacy Act and US state privacy laws, to the extent they apply. If you are an agency using SourceXray for your clients, you act as processor for them and we act as your sub-processor. Words such as controller, processor, personal data and data subject have the meanings given in the GDPR.

2. Details of the processing

• Subject matter and purpose: recording how visitors arrived at your websites and attaching that to the enquiries they submit; showing them in your dashboard; spam filtering; and delivering the alerts and integrations you switch on.
• Duration: while you use the Service, then until deletion as set out in section 9.
• Data subjects: visitors to your websites who submit a form, and your users.
• Types of personal data: name, email address and phone number entered in a form (unless you switch contact details off); attribution details (channel, source, medium, campaign, keyword, ad click identifiers, landing page, referring domain, first and latest visit dates and visit counts); form name and page; device type, browser language and time zone; and IP address and browser details in short-lived server logs.
• Special categories: none intended. You must not use the Service to collect special category or sensitive information.

3. Your instructions

We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA, your settings in the Service, and the integrations and plans you choose. If we believe an instruction breaks data protection law, we will tell you. We will not process Customer Personal Data for our own purposes, sell it, share it for cross-context behavioural advertising, keep or use it outside our direct business relationship with you, or combine it with other information, except as the law allows a service provider to do.

4. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by confidentiality and only accesses it for the reasons set out in section 7 of our Privacy Policy.

5. Security

We maintain appropriate technical and organisational measures, including: encryption in transit (HTTPS) and at rest (by our database provider); database rules that keep every workspace separate; server-side storage of secrets and integration tokens; hashed passwords; access limited to people who need it; rate limits and abuse protection; automatic deletion according to plan retention; and keeping our software and dependencies up to date.

6. Sub-processors

You give us general authorisation to use sub-processors. We impose data protection terms on each that protect Customer Personal Data to the standard of this DPA, and we remain responsible for them. Current sub-processors:

• Supabase, Inc. (United States, on Amazon Web Services): database, authentication and server functions that receive and store leads.
• Hetzner Online GmbH (data centre in the United States): servers that deliver the tracking script, website and app.
• SMTP2GO (New Zealand): delivery of email lead alerts you switch on.
• OpenAI, L.L.C. (United States): AI Tracking Setup answers. It receives tracking configuration, aggregated counts and your messages, never lead contact details.

We will tell you about a new sub-processor at least 14 days before it starts, by email or in the app. If you object on reasonable data protection grounds and we cannot resolve it, you may close your account and receive a pro-rata refund of any fees you prepaid for the period after the change. Destinations you choose for integrations (such as your CRM or ad platform) act for you, not as our sub-processors.

7. Helping you

Taking into account the nature of the processing, we will help you respond to requests from data subjects (you can view, export and delete leads in the app, and we will help with anything else), and give you reasonable information for data protection impact assessments and consultations with regulators.

8. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and give you the information you reasonably need to meet your own notification duties, updating it as we learn more.

9. Deletion and return

You can export your leads at any time. Leads are deleted automatically at the end of your plan's history period. When your account is closed, we delete Customer Personal Data within 30 days, and backups roll off on our provider's schedule, unless the law requires us to keep it.

10. Information and audits

We will make available the information reasonably necessary to show we comply with this DPA. If that is not enough, or a regulator requires it, you may audit our compliance once a year, at your cost, with at least 30 days' notice, in a way that does not disrupt the Service or expose other customers' information.

11. International transfers

Customer Personal Data is stored in the United States and may be accessed from Australia and the countries of the sub-processors listed above. Where the GDPR, UK GDPR or Swiss law requires it, the standard contractual clauses (Module 2 or Module 3, as applicable), with the UK International Data Transfer Addendum and Swiss adjustments, are incorporated into this DPA by reference, with this DPA providing the details their annexes require. If the clauses conflict with this DPA, the clauses prevail.

12. Contact

Email info@sourcexray.com about this DPA or to request a signed copy.