Data Processing Addendum

This addendum is entered into between the customer (controller) and Authex Labs Ltd (processor). It forms part of the Terms of Service and governs any processing of personal data carried out by Authex on the customer's behalf.

The subject matter is the personal data processed by Authex to provide the service to the customer. Processing continues for as long as the customer maintains an active account and for any retention period required by law.

Authex processes personal data to scan domains, manage email-authentication protocols, ingest DMARC and TLS reports, send service notifications, and support the customer.

Data: account holder name, work email, organization, domain configurations, aggregate report content (which may incidentally contain mailbox identifiers).

Data subjects: the customer's staff and the customer's mail senders and recipients to the extent they appear in DMARC or TLS reports.

Authex uses subprocessors to operate the service (cloud hosting, transactional email, payment processing, customer support). The current list is available at privacy@authexlabs.com. We will give the customer reasonable notice of any new subprocessor and an opportunity to object.

Authex implements appropriate technical and organisational measures: encryption in transit and at rest, least-privilege access control, mandatory MFA for staff, regular vulnerability scanning, and incident response procedures.

Authex will assist the customer in responding to requests from data subjects exercising rights under applicable data protection laws, including access, correction, deletion, restriction, and portability.

Where data is transferred outside the UK or the EEA, transfers are made under appropriate safeguards, including Standard Contractual Clauses, supplemented as necessary.

On reasonable notice and no more than once per year, the customer may audit Authex's compliance with this addendum. Authex will notify the customer of any personal data breach without undue delay and provide the information needed for the customer to meet its own notification obligations.