Data Processing Agreement

FixiWeb.AI - Data Processing Agreement (DPA)

Last Updated: February 2026

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between FixiWeb.AI ("Processor," "we," "us") and you ("Controller," "Customer," "you") and reflects the parties' agreement with regard to the processing of personal data.

This DPA applies when FixiWeb processes personal data on your behalf in connection with providing the Service.

2. Definitions

"Data Protection Laws" means all applicable laws relating to data protection and privacy, including but not limited to: - The General Data Protection Regulation (EU) 2016/679 ("GDPR") - The UK General Data Protection Regulation ("UK GDPR") - The California Consumer Privacy Act ("CCPA") - The Israeli Privacy Protection Law, 5741-1981

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws.

"Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure, or destruction.

"Sub-processor" means any third party engaged by us to process Personal Data on your behalf.

"Data Subject" means the individual to whom Personal Data relates.

"Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

3. Scope and Roles

3.1 Roles of the Parties

For the purposes of this DPA: - You are the Data Controller, determining the purposes and means of processing Personal Data - We are the Data Processor, processing Personal Data on your behalf

3.2 Subject Matter of Processing

We process Personal Data to provide the FixiWeb website intelligence service, including: - Account management and authentication - Website scanning and analysis - Report generation and delivery - Notification services (email, WhatsApp) - Customer support

3.3 Types of Personal Data

The types of Personal Data we may process include: - Contact information (name, email address, phone number) - Account credentials (hashed passwords) - Billing information (payment details processed by Stripe) - Website URLs and configuration data - Usage data (logs, analytics) - Any Personal Data present on websites you submit for scanning

3.4 Categories of Data Subjects

• Your employees and authorized users
• Your customers and website visitors (to the extent their data appears on scanned websites)

3.5 Duration of Processing

We will process Personal Data for the duration of the Agreement, plus any retention period required by law or specified in our Privacy Policy.

4. Obligations of the Processor (FixiWeb)

4.1 Processing Instructions

We will: - Process Personal Data only on your documented instructions - Inform you if we believe an instruction infringes Data Protection Laws - Not process Personal Data for any purpose other than providing the Service unless required by law

4.2 Confidentiality

We will: - Ensure that persons authorized to process Personal Data are bound by confidentiality obligations - Limit access to Personal Data to those who need it to perform their duties

4.3 Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Technical Measures: - Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256) - Secure password hashing (bcrypt) - Automated security testing and vulnerability scanning - A managed database replica set with automatic failover - Access controls and authentication mechanisms

Organizational Measures: - Access limited on a need-to-know basis - Documented incident response and escalation procedures

4.4 Sub-processors

Current Sub-processors: We use the following Sub-processors to provide the Service:

Sub-processor Changes: - We will inform you of any intended changes to Sub-processors - You may object to changes within 14 days of notification - If you object, we will attempt to address your concerns or allow you to terminate the affected services

4.5 Data Subject Rights

We will: - Assist you in responding to Data Subject requests (access, rectification, erasure, portability, etc.) - Implement technical measures to facilitate such requests - Respond to requests within 72 hours of receipt

4.6 Data Breach Notification

In the event of a Data Breach, we will: - Notify you without undue delay, and within 72 hours where feasible - Provide information about the nature of the breach, categories of data affected, and approximate number of Data Subjects involved - Describe the likely consequences and measures taken or proposed to address the breach - Cooperate with you in meeting your notification obligations to supervisory authorities and Data Subjects

4.7 Data Protection Impact Assessments

We will provide reasonable assistance if you need to conduct a Data Protection Impact Assessment (DPIA) or consult with a supervisory authority.

4.8 Audit Rights

You have the right to audit our compliance with this DPA: - We will provide information requested to demonstrate compliance - We will allow and contribute to audits conducted by you or your appointed auditor - Audits require 30 days' notice and will be conducted during business hours - You bear the costs of any audit unless a material breach is discovered

4.9 Deletion and Return of Data

Upon termination of the Agreement or upon your request: - We will delete or return all Personal Data within 30 days - We will provide certification of deletion upon request - We may retain data as required by law, in which case we will continue to protect it under this DPA

5. Obligations of the Controller (You)

5.1 Lawful Processing

You warrant that: - You have a lawful basis for processing Personal Data through the Service - You have provided necessary notices and obtained necessary consents from Data Subjects - Your instructions to us comply with Data Protection Laws

5.2 Accuracy of Data

You are responsible for: - Ensuring the accuracy and quality of Personal Data provided to us - Informing us of any corrections needed

5.3 Security

You are responsible for: - Implementing appropriate security measures for your account - Managing access credentials securely - Promptly reporting any security incidents

6. International Data Transfers

6.1 Transfer Mechanisms

For transfers of Personal Data from the EEA, UK, or Switzerland to countries without adequate data protection: - We rely on Standard Contractual Clauses (SCCs) approved by the European Commission - We maintain Data Processing Agreements with all Sub-processors

6.2 Standard Contractual Clauses

By entering into this DPA, you enter into the Standard Contractual Clauses (Module Two: Controller to Processor) with us for any transfers requiring such clauses.

6.3 Additional Safeguards

We implement additional safeguards including: - Encryption in transit and at rest - Access controls and authentication - Regular security assessments - Contractual protections with Sub-processors

7. Liability and Indemnification

7.1 Liability Cap

Our liability under this DPA is subject to the liability limitations in the Agreement.

7.2 Indemnification

Each party shall indemnify the other for any losses arising from breaches of this DPA caused by that party's actions or omissions.

8. Term and Termination

8.1 Term

This DPA begins on the date you accept the Agreement and continues until the Agreement is terminated.

8.2 Survival

Sections of this DPA that by their nature should survive termination will survive, including obligations regarding data deletion, confidentiality, and liability.

9. Governing Law and Jurisdiction

9.1 Governing Law

This DPA is governed by the same laws that govern the Agreement.

9.2 GDPR-Specific Provisions

For processing subject to GDPR: - The competent supervisory authority shall be determined in accordance with GDPR Article 55 - Disputes shall be resolved by the courts with jurisdiction under the Agreement

10. Amendments

We may update this DPA to reflect changes in Data Protection Laws or our practices. Significant changes will be communicated via email. Your continued use of the Service after changes constitutes acceptance.

11. Contact Information

For questions or concerns about this DPA:

Data Protection Officer: dpo@fixiweb.ai
Privacy Team: privacy@fixiweb.ai
Legal: legal@fixiweb.ai

Annex A: Description of Processing

Annex B: Technical and Organizational Measures

B.1 Access Control

• Role-based access control (RBAC)
• Unique user credentials
• Automatic session timeout
• Access logging and monitoring

B.2 Encryption

• TLS 1.2+ for data in transit
• AES-256 for data at rest
• Secure key management

B.3 Availability and Resilience

• Customer data is stored in a managed MongoDB Atlas database running as a three-node replica set, which fails over automatically if a node is lost
• Application services run on managed cloud hosting (Render)
• Uptime commitments as set out in our Service Level Agreement (Enterprise plans)

B.4 Incident Response

• Automated, continuous monitoring of the service and error reporting
• Documented incident classification and escalation procedures
• Notification of a personal-data breach without undue delay, as set out in this agreement

B.5 Employee Security

• Access to customer data on a need-to-know basis

B.6 Vendor Management

• Security assessment of Sub-processors
• Contractual data protection requirements
• Regular vendor reviews

Annex C: Standard Contractual Clauses

By entering into this DPA, the parties are deemed to have signed the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor), which are incorporated by reference.

Clause 7 (Optional Docking Clause): Not used
Clause 9(a) (Use of Sub-processors): Option 2 (General written authorization)
Clause 11 (Redress): Optional language not used
Clause 17 (Governing Law): Laws of the Republic of Ireland
Clause 18 (Choice of Forum and Jurisdiction): Courts of the Republic of Ireland

This Data Processing Agreement is part of and should be read in conjunction with our Terms of Service and Privacy Policy.