Data Processing Agreement

Background and purpose

You, the Data Controller, have entered into a subscription or license agreement with YLÄUXI for access to the YLÄUXI operating system (the Service) under the Terms of Service (Principal Agreement).

In providing the Service, YLÄUXI may process personal data on your behalf. This Data Processing Agreement (DPA) governs that processing and supplements the Principal Agreement.

If this DPA and the Principal Agreement conflict on data protection, this DPA prevails for that subject matter.

Definitions

Data Protection Laws

All applicable laws on personal data processing, including the EU GDPR (2016/679), UK GDPR, California Consumer Privacy Act (CCPA), and national implementing legislation.

Personal Data

As defined in applicable Data Protection Laws.

Processing

Any operation performed on personal data, as defined in applicable Data Protection Laws.

Data Subject

The individual to whom personal data relates.

Sub-Processor

A third party engaged by YLÄUXI to process personal data on your behalf.

Standard Contractual Clauses (SCCs)

European Commission approved standard contractual clauses for transfers of personal data to third countries.

Roles of the parties

You determine the purposes and means of processing personal data uploaded to or generated within the Service.

YLÄUXI acts as Data Processor for that personal data. We process it only on your documented instructions as set out in this DPA and the Principal Agreement.

When you use YLÄUXI to process data belonging to your own customers (End-Customer Data), you remain the data controller for that data and bear all legal obligations toward those individuals.

Processing details

Subject matter

Processing of personal data by YLÄUXI in connection with providing the Service to you.

Duration

For the term of the Principal Agreement and as required by applicable law after termination.

Nature and purpose

• Storing and managing personal data you upload via CRM, email, contract, and other Service modules
• Processing personal data to deliver AI agent outputs, reports, and operational features
• Transmitting email communications on your behalf through the email module
• Storing assets and documents in VAULT on your behalf

Categories of personal data

Depending on your use of the Service, this may include:

• Contact information: name, email address, phone number
• Business information: company name, role, purchase history
• Communications data: email content, message history
• Transactional data: order records, payment references (not payment card data)
• Any other personal data you choose to upload or process within the Service

Categories of data subjects

• Your customers and end users
• Your business contacts, vendors, and partners
• Your team members with access to the Service

YLÄUXI obligations

As Data Processor, YLÄUXI agrees to:

• Process personal data only on your documented instructions, including transfers to third countries, unless required by applicable law
• Ensure persons authorized to process personal data are bound by confidentiality or an equivalent statutory obligation
• Implement technical and organizational measures appropriate to the risk, including encryption in transit and at rest, confidentiality and integrity of systems, timely restoration after incidents, and regular evaluation of security measures
• Not engage any Sub-Processor without your prior written authorization, except as listed in Schedule A
• Assist you in responding to Data Subject requests for access, rectification, erasure, restriction, and portability, given the nature of the processing
• Notify you without undue delay, and in any event within 72 hours, upon becoming aware of a personal data breach affecting your data
• On termination, at your election, delete or return all personal data and delete existing copies unless law requires retention
• Make available information necessary to demonstrate compliance and contribute to audits you conduct, subject to reasonable notice and confidentiality
• Not use personal data processed under this DPA to train, develop, or improve any AI model

Data Controller obligations

You warrant and represent that:

• You have a lawful basis for processing personal data you upload or process within the Service
• You have provided required notices and obtained required consents from Data Subjects
• Your instructions to YLÄUXI comply with applicable Data Protection Laws
• You will not instruct YLÄUXI to process personal data in a way that would cause YLÄUXI to violate applicable Data Protection Laws

Sub-processors

You grant YLÄUXI general written authorization to engage the Sub-Processors listed in Schedule A.

YLÄUXI will notify you of intended additions or replacements at least 30 days in advance. You may object within 14 days of notice on reasonable data protection grounds.

YLÄUXI ensures Sub-Processors are bound by data protection obligations equivalent to those in this DPA.

International transfers

Where personal data is transferred outside the EEA, UK, or Switzerland to a country without an adequacy decision, transfers are governed by the Standard Contractual Clauses (Controller to Processor), incorporated by reference into this DPA.

The parties will execute the SCCs as a separate annex where required by applicable law.

Liability

Each party's liability under this DPA is subject to the limitations in the Principal Agreement.

Where both parties are liable for the same damage to a Data Subject, liability is apportioned according to each party's degree of responsibility.

Term and termination

This DPA takes effect on the date of the Principal Agreement and remains in force for its duration.

On termination, YLÄUXI will, within 30 days and at your written election, either delete all personal data or return it in a machine-readable format and delete all copies.

Schedule A: Authorized sub-processors

The following Sub-Processors are authorized as of the effective date. YLÄUXI may update this schedule per the Sub-processors section above.

Self hosted deployments process personal data on infrastructure you control. Sub-Processors above apply to YLÄUXI operated services such as billing, platform email, and managed hosting where included in your tier.

Contact

DPA and data protection inquiries: privacy@ylauxi.com. Public list: Sub-processors.

User Service Agreement · AI Disclosure · MUSE Terms · Privacy Policy · Data Processing Agreement · Cookie Policy · Terms of Service · Acceptable Use · Refund Policy · Service Level Agreement · Accessibility · Sub-processors