Data Processing Addendum

Roles

For content you submit, you are the controller and Plexa AI is the processor. For account, billing and security data we are an independent controller.

Processing instructions

We process personal data only on your documented instructions, being your use of the Services, unless required otherwise by law, in which case we will inform you where permitted.

Subject matter: provision of AI assistant, automation and compute services. Duration: the term of your account. Data subjects: your users, staff and any individuals referenced in your content. Data types: identifiers, contact data, content you submit.

Confidentiality and security

Personnel with access are bound by confidentiality. We maintain technical and organisational measures appropriate to the risk, as described in the Security page.

Subprocessors

You authorise the subprocessors listed on our Subprocessors page. We will give notice before adding new ones and remain responsible for their performance.

Assistance, breach notice and deletion

We assist you with data-subject requests, impact assessments and regulator engagement, taking into account the nature of processing. We notify you without undue delay after becoming aware of a personal data breach affecting your data. On termination we delete or return personal data, subject to legal retention.

Transfers and audits

International transfers rely on Standard Contractual Clauses or another lawful mechanism. We make available the information reasonably necessary to demonstrate compliance and will support audits on reasonable notice, no more than once per year unless required by a regulator.

To execute a countersigned copy, write to legal@plexaai.app.