Data Processing Agreement

Background and purpose

You, the Data Controller, have entered into a subscription or license agreement with YLAÜXI for access to the YLAÜXI operating system (the Service) under the Terms of Service (Principal Agreement).

In providing the Service, YLAÜXI may process personal data on your behalf. This Data Processing Agreement (DPA) governs that processing and supplements the Principal Agreement.

If this DPA and the Principal Agreement conflict on data protection, this DPA prevails for that subject matter.

Definitions

Data Protection Laws

All applicable laws on personal data processing, including the EU GDPR (2016/679), UK GDPR, California Consumer Privacy Act (CCPA), and national implementing legislation.

Personal Data

As defined in applicable Data Protection Laws.

Processing

Any operation performed on personal data, as defined in applicable Data Protection Laws.

Data Subject

The individual to whom personal data relates.

Sub-Processor

A third party engaged by YLAÜXI to process personal data on your behalf.

Standard Contractual Clauses (SCCs)

European Commission approved standard contractual clauses for transfers of personal data to third countries.

Roles of the parties

You determine the purposes and means of processing personal data uploaded to or generated within the Service.

YLAÜXI acts as Data Processor for that personal data. We process it only on your documented instructions as set out in this DPA and the Principal Agreement.

When you use YLAÜXI to process data belonging to your own customers (End-Customer Data), you remain the data controller for that data and bear all legal obligations toward those individuals.

Processing details

Subject matter

Processing of personal data by YLAÜXI in connection with providing the Service to you.

Duration

For the term of the Principal Agreement and as required by applicable law after termination.

Nature and purpose

• Storing and managing personal data you upload via CRM, email, contract, and other Service modules
• Processing personal data to deliver AI agent outputs, reports, and operational features
• Transmitting email communications on your behalf through the email module
• Storing assets and documents in VAULT on your behalf

Categories of personal data

Depending on your use of the Service, this may include:

• Contact information: name, email address, phone number
• Business information: company name, role, purchase history
• Communications data: email content, message history
• Transactional data: order records, payment references (not payment card data)
• Any other personal data you choose to upload or process within the Service

Categories of data subjects

• Your customers and end users
• Your business contacts, vendors, and partners
• Your team members with access to the Service

YLAÜXI obligations

As Data Processor, YLAÜXI agrees to:

• Process personal data only on your documented instructions, including transfers to third countries, unless required by applicable law
• Ensure persons authorized to process personal data are bound by confidentiality or an equivalent statutory obligation
• Implement technical and organizational measures appropriate to the risk, including encryption in transit and at rest, confidentiality and integrity of systems, timely restoration after incidents, and regular evaluation of security measures
• Not engage any Sub-Processor without your prior written authorization, except as listed in Schedule A
• Assist you in responding to Data Subject requests for access, rectification, erasure, restriction, and portability, given the nature of the processing
• Notify you without undue delay, and in any event within 72 hours, upon becoming aware of a personal data breach affecting your data
• On termination, at your election, delete or return all personal data and delete existing copies unless law requires retention
• Make available information necessary to demonstrate compliance and contribute to audits you conduct, subject to reasonable notice and confidentiality
• Not use personal data processed under this DPA to train, develop, or improve any AI model

Data Controller obligations

You warrant and represent that:

• You have a lawful basis for processing personal data you upload or process within the Service
• You have provided required notices and obtained required consents from Data Subjects
• Your instructions to YLAÜXI comply with applicable Data Protection Laws
• You will not instruct YLAÜXI to process personal data in a way that would cause YLAÜXI to violate applicable Data Protection Laws

Sub-processors

You grant YLAÜXI general written authorization to engage the Sub-Processors listed in Schedule A.

YLAÜXI will notify you of intended additions or replacements at least 30 days in advance. You may object within 14 days of notice on reasonable data protection grounds.

YLAÜXI ensures Sub-Processors are bound by data protection obligations equivalent to those in this DPA.

International transfers

Where personal data is transferred outside the EEA, UK, or Switzerland to a country without an adequacy decision, transfers are governed by the Standard Contractual Clauses (Controller to Processor), incorporated by reference into this DPA.

The parties will execute the SCCs as a separate annex where required by applicable law.

Liability

Each party's liability under this DPA is subject to the limitations in the Principal Agreement.

Where both parties are liable for the same damage to a Data Subject, liability is apportioned according to each party's degree of responsibility.

Term and termination

This DPA takes effect on the date of the Principal Agreement and remains in force for its duration.

On termination, YLAÜXI will, within 30 days and at your written election, either delete all personal data or return it in a machine-readable format and delete all copies.

Schedule A: Authorized sub-processors

The following Sub-Processors are authorized as of the effective date. YLAÜXI may update this schedule per the Sub-processors section above.

Self hosted deployments process personal data on infrastructure you control. Sub-Processors above apply to YLAÜXI operated services such as billing, platform email, and managed hosting where included in your tier.

Contact

DPA and data protection inquiries: privacy@ylauxi.com. Public list: Sub-processors.

User Service Agreement · AI Disclosure · MUSE Terms · Privacy Policy · Data Processing Agreement · Cookie Policy · Terms of Service · Acceptable Use · Refund Policy · Service Level Agreement · Accessibility · Sub-processors