Noxivo legal

GDPR Data Processing Addendum

This DPA applies when Noxivo processes Personal Data subject to GDPR, UK GDPR, or equivalent EU or EEA data-protection law on behalf of a customer in connection with the Services.

Public legal route

https://noxivo.pro/gdpr-data-processing-addendum

Regulatory focus

GDPR, UK GDPR, EU or EEA processor obligations

Processing scope

Messaging, CRM context, analytics, storage, support

Transfer posture

SCCs, UK addendum, or similar lawful safeguards

Launch-draft assumption note: This DPA combines repo-grounded processor and security evidence with user-requested launch assumptions. Any listed subprocessor or service provider that is not directly evidenced in the repository should be validated against Noxivo’s operational vendor register before external execution.

This DPA forms part of the agreement between the Noxivo contracting entity identified in the applicable Order Form or service terms and the customer entity or person receiving the Services.

1. Roles of the Parties

Customer acts as controller, or where applicable a processor acting on behalf of another controller, with respect to Personal Data Customer submits to the Services.

1.2 Noxivo as Processor

Noxivo acts as processor for Personal Data processed on behalf of Customer in connection with the Services.

1.3 Customer Instructions

This DPA and the underlying agreement constitute Customer’s documented instructions to Noxivo to process Personal Data only as necessary to provide, secure, support, improve, and lawfully operate the Services.

2.1 Subject Matter

Noxivo provides a hosted multi-tenant SaaS platform for messaging operations, workflow automation, CRM-linked contact handling, analytics, storage integrations, and related support.

2.2 Nature of Processing

Processing may include collection, recording, organization, storage, retrieval, consultation, transmission, pseudonymization, deletion, export, analytics, and support access.

2.3 Purpose of Processing

Processing is performed to:

host and operate Customer workspaces and tenant environments;
route and process messaging and workflow events;
manage contact records, CRM-linked summaries, and support diagnostics;
provide storage, billing, and integration functionality; and
secure, monitor, back up, and improve the Services.

3.1 Categories of Personal Data

Depending on Customer’s configuration and use, Personal Data may include:

contact names;
phone numbers and contact identifiers;
message content and message metadata;
attachments, including image, video, audio, and document files;
CRM notes, tags, owners, summaries, and workflow-linked profile metadata;
user account information, such as names, emails, and login identifiers;
billing and subscription identifiers;
technical logs, IP addresses, timestamps, device or browser information; and
integration-related metadata.

3.2 Categories of Data Subjects

Data subjects may include:

Customer personnel and Authorized Users;
Customer's end customers, leads, contacts, or prospects;
Customer's tenant or client personnel;
website visitors or support requestors; and
other persons whose Personal Data Customer intentionally submits to the Services.

4. Processor Obligations

Noxivo will:

process Personal Data only on documented instructions from Customer unless otherwise required by Union or Member State law;
ensure persons authorized to process Personal Data are bound by confidentiality obligations;
implement appropriate technical and organizational measures under Article 32 GDPR;
assist Customer, taking into account the nature of processing and available information, in responding to data-subject requests;
assist Customer with security, breach-notification, DPIA, and prior-consultation obligations where required and reasonably requested;
notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Personal Data processed under this DPA; and
delete or return Personal Data at the end of the Services, subject to retention obligations, backup cycles, and legal preservation duties.

5. Security Measures

Noxivo will maintain commercially reasonable technical and organizational measures appropriate to the risk, which may include access controls and role-based permissions, authentication protections and internal service trust controls, encryption or comparable protection for data in transit and where applicable at rest, protected credential storage for tenant integration secrets, logging and incident-response processes, backup and recovery procedures, and vendor or infrastructure controls appropriate to a cloud-hosted SaaS environment.

5.1 Repo-Grounded Privacy Hooks

As reflected in the repository evidence available at drafting time, Noxivo stores conversation records, message content, attachments, contact profile data, CRM notes and summaries, and usage records.

Noxivo uses encrypted tenant credential storage for integration providers such as Google Sheets, Airtable, Slack, HubSpot, Shopify, WooCommerce, and OneSignal, and relies on environment variables and internal service keys for messaging, webhooks, internal API trust, and cloud integrations.

Customer remains responsible for supplying only lawfully collected Personal Data and for managing its own credential hygiene, lawful basis, and outbound messaging compliance.

6. Subprocessors

Customer authorizes Noxivo to engage subprocessors that are reasonably necessary to provide the Services. Noxivo remains responsible for its subprocessors’ performance of relevant data-protection obligations.

6.1 Current and Customer-Enabled Subprocessors / Service Providers

Based on the current repository evidence and the launch configuration assumptions used for this draft, Noxivo may use or permit the use of the following subprocessors or service-provider categories, subject to Customer’s enabled features and deployment model:

Cloud hosting and infrastructure providers — Status: Core platform category — Purpose: Compute, networking, runtime services, backups, and logging
Google APIs / Google Drive — Status: If enabled — Purpose: Identity, document, or storage integrations
AWS S3 — Status: If enabled — Purpose: Object and media storage
Cloudflare R2 — Status: If enabled — Purpose: Object and media storage
Bunny — Status: If enabled — Purpose: Object delivery or media/storage support
Cloudinary — Status: If enabled — Purpose: Media storage, transformation, and delivery
ImageKit — Status: If enabled — Purpose: Media storage, transformation, and delivery
HubSpot — Status: If enabled by Customer — Purpose: CRM integration and data sync
Shopify — Status: If enabled by Customer — Purpose: Commerce integration and data sync
WooCommerce — Status: If enabled by Customer — Purpose: Commerce integration and data sync
Airtable — Status: If enabled by Customer — Purpose: Workflow-linked record sync
Slack — Status: If enabled by Customer — Purpose: Notification or workflow integration
Google Sheets — Status: If enabled by Customer — Purpose: Workflow-linked record sync
OneSignal — Status: If enabled by Customer — Purpose: Push-notification and messaging support
Stripe — Status: If billing integration is enabled — Purpose: Subscription, billing, and payment-processing metadata
n8n — Status: If enabled; customer-requested pending operational confirmation — Purpose: Workflow orchestration, event routing, and automation processing
Postiz — Status: If enabled; customer-requested pending operational confirmation — Purpose: Social/content workflow processing and related connected-platform operations

6.2 Customer Notice

Noxivo may update subprocessors from time to time. Where legally required or commercially reasonable, Noxivo will provide notice through documentation, the dashboard, or another reasonable channel.

6.3 Regulatory Scope Note

This DPA is drafted to support GDPR and EU-UK processor obligations for Customer Personal Data, a Vietnam-governed primary contract stack for the broader commercial relationship, and operational support for U.S.-facing business SaaS, billing, and messaging use cases where applicable.

Nothing in this DPA should be read as a guarantee that every Customer use case is compliant without the Customer’s own legal review, notices, lawful bases, and channel-specific compliance controls.

7. International Transfers

If Noxivo transfers Personal Data outside the EEA, Switzerland, or the United Kingdom, Noxivo will use an appropriate lawful transfer mechanism, which may include the European Commission’s Standard Contractual Clauses, the UK addendum, or another legally recognized transfer safeguard.

8. Audit and Information Rights

Upon reasonable written request and no more than once annually, Noxivo will make available information reasonably necessary to demonstrate compliance with this DPA. If that information is insufficient and the GDPR requires further review, the parties will cooperate in good faith on a reasonable audit method that protects Noxivo’s security and confidentiality obligations, avoids disruption to other customers, and may be satisfied by certifications, summaries, third-party reports, or controlled review rather than unrestricted onsite inspection.

9. Data Subject Requests

If Noxivo receives a data-subject request directly relating to Personal Data processed under this DPA, Noxivo will, unless legally prohibited, direct the requester to the Customer or notify the Customer so that the Customer can respond through its own channels.

10. Deletion and Return

Upon termination or expiration of the Services, Customer may request return or deletion of Personal Data within a reasonable post-termination export window. Thereafter, Noxivo may delete or anonymize remaining Personal Data, except where retention is required by law, needed for legal claims, embedded in secure backups, or technically impracticable to remove immediately.

11. Liability

The liability limitations and exclusions in the underlying agreement apply to this DPA unless prohibited by applicable law.

12. Order of Precedence

If there is a conflict between this DPA and the underlying agreement concerning Personal Data processing, this DPA controls to the extent of that conflict.

Annex 1 — Processing Details

Subject matter: hosted SaaS delivery for messaging, CRM context, workflow automation, analytics, and integrations. Duration: for the subscription term and any applicable export, retention, or support period. Nature: collection, storage, retrieval, transmission, analytics, support access, deletion.

Purpose: provide, secure, support, and improve the Services. Data subjects: Customer users, Customer clients, Customer contacts, leads, prospects, and tenant personnel. Personal Data: names, phone numbers, message content, attachments, contact and CRM metadata, account and billing identifiers, and technical logs.

Data-protection contact path

If Noxivo receives a data-subject request directly relating to Personal Data processed under this DPA, Noxivo will, unless legally prohibited, direct the requester to the customer or notify the customer so the request can be handled through the customer’s own channels.

Contact Noxivo Review Terms of Service