Data Processing Agreement

This Data Processing Agreement ("DPA") applies where Falahx processes Personal Data on behalf of a customer in connection with the customer's use of Falahx products or services.

This DPA forms part of the applicable agreement between Falahx and the customer governing the customer's use of the relevant Falahx services ("Agreement").

This DPA applies only to processing activities where Falahx acts as a processor, service provider, or similar role on behalf of the customer under applicable data protection law.

Where Falahx processes Personal Data for its own independent purposes, including account management, billing, security, legal compliance, or service administration, such processing is governed by the Falahx Privacy Policy and applicable law rather than this DPA.

For purposes of this DPA, the following terms have the meanings described below.

Customer

"Customer" means the individual or legal entity that has entered into an Agreement with Falahx for the use of applicable Falahx products or services.

Personal Data

"Personal Data" means information relating to an identified or identifiable individual, or any equivalent term defined under applicable data protection law.

Processing

"Processing" means any operation performed on Personal Data, including collection, storage, organization, retrieval, use, disclosure, transfer, modification, or deletion.

Data Subject

"Data Subject" means an identified or identifiable individual to whom Personal Data relates.

Subprocessor

"Subprocessor" means a third party engaged by Falahx to process Personal Data on behalf of the Customer.

Falahx will process Personal Data only to provide, maintain, secure, support, and improve the applicable Falahx services, in accordance with the Customer's documented instructions and the Agreement.

The categories of Personal Data processed will depend on the products, features, integrations, and configurations selected by the Customer.

Personal Data may include information contained in customer conversations, support requests, contact information, lead information, documents, knowledge bases, website content, workflow data, integration data, and other information submitted or transmitted through the services.

The categories of Data Subjects may include the Customer's employees, representatives, customers, website visitors, users, prospects, leads, and other individuals whose information is submitted to the services by or on behalf of the Customer.

The Customer determines the purposes and means of processing Personal Data submitted to Falahx and instructs Falahx to process such Personal Data as necessary to provide the applicable services.

The Agreement, this DPA, product configuration, documented support requests, and the Customer's use of the services constitute the Customer's instructions for processing.

Falahx will notify the Customer if it becomes aware that an instruction appears to violate applicable data protection law, unless prohibited by law from providing such notice.

Falahx will ensure that persons authorized to process Personal Data are subject to appropriate confidentiality obligations.

Falahx personnel will access Personal Data only to the extent reasonably necessary to provide, secure, maintain, support, or improve the applicable services, or as otherwise required by law.

Falahx will maintain appropriate controls designed to prevent unauthorized access to Personal Data by its personnel.

Falahx will maintain reasonable technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, or disclosure.

Depending on the nature of the services, these measures may include access controls, authentication, encryption or secure communications, infrastructure protections, monitoring, logging, backups, vulnerability management, and security procedures.

Security measures may evolve over time as technology, industry practices, and the Falahx services change, provided that Falahx does not materially reduce the overall level of protection applicable to the services.

The Customer is responsible for configuring the services appropriately, protecting account credentials and access keys, and maintaining security controls within systems that it controls.

Falahx may engage third-party service providers to process Personal Data where necessary to provide the services.

Subprocessors may provide services such as cloud infrastructure, databases, artificial intelligence, analytics, communications, email delivery, authentication, monitoring, security, payment processing, or other technical infrastructure.

Falahx will require relevant Subprocessors to maintain appropriate data protection and confidentiality obligations consistent with the nature of the services they provide.

Falahx remains responsible for its Subprocessors' processing of Personal Data to the extent required by applicable law and the Agreement.

Falahx and its Subprocessors may process Personal Data in countries other than the country where the Customer or Data Subject is located.

Where applicable law requires specific safeguards for international transfers, Falahx will take reasonable steps to implement an appropriate transfer mechanism recognized under the applicable law.

The Customer acknowledges that global cloud infrastructure and third-party services may involve processing across multiple jurisdictions.

Taking into account the nature of the processing, Falahx will provide reasonable assistance to the Customer in responding to requests from Data Subjects exercising rights under applicable data protection laws.

Where Falahx receives a request directly from a Data Subject concerning Personal Data processed on behalf of a Customer, Falahx may direct the Data Subject to the Customer where appropriate.

The Customer remains responsible for determining how to respond to Data Subject requests and for ensuring that such responses comply with applicable law.

If Falahx becomes aware of a confirmed Personal Data Breach affecting Personal Data processed on behalf of the Customer, Falahx will take reasonable steps to investigate, contain, and mitigate the incident.

Where required by applicable law, Falahx will notify the Customer without undue delay after becoming aware of the relevant breach.

To the extent reasonably available and legally permissible, such notification may include information regarding the nature of the incident, affected data, potential consequences, and measures taken or proposed to address the incident.

The Customer is responsible for determining whether notification to Data Subjects, regulators, or other third parties is required.

Taking into account the nature of the processing and information reasonably available to Falahx, Falahx will provide reasonable assistance to the Customer with obligations relating to security, Data Subject requests, Personal Data Breaches, and other processor obligations required by applicable data protection law.

The Customer acknowledges that Falahx's ability to provide assistance may depend on the features and capabilities of the applicable services.

Where additional assistance requires substantial effort outside Falahx's ordinary service operations, Falahx may charge reasonable fees where permitted by the Agreement and applicable law.

Falahx will retain Personal Data for the period reasonably necessary to provide the applicable services and in accordance with the Customer's configuration, the Agreement, and applicable law.

Following termination or expiration of the applicable services, Falahx will delete or return Customer Personal Data in accordance with the Agreement, subject to applicable legal requirements and legitimate backup, security, and operational retention practices.

Backup copies may remain for a limited period while they are securely isolated and scheduled for deletion in accordance with Falahx's ordinary backup practices.

Falahx will make available information reasonably necessary to demonstrate compliance with its processor obligations under applicable data protection law.

Where legally required and subject to reasonable confidentiality and security requirements, Falahx may provide relevant documentation describing its security and data protection practices.

Any audit or assessment requested by the Customer must be reasonable in scope, conducted during normal business hours, and designed to avoid unreasonable disruption to Falahx's operations or other customers.

The Customer is responsible for costs associated with audits requested by the Customer unless otherwise required by applicable law or agreed in writing.

The Customer is responsible for:

• Determining the purposes and lawful basis for processing Personal Data.
• Providing appropriate privacy notices to Data Subjects where required.
• Obtaining required consents and permissions where applicable.
• Ensuring that instructions provided to Falahx are lawful.
• Ensuring that Personal Data submitted to Falahx is relevant and appropriate for the intended use.
• Configuring and using Falahx services in compliance with applicable privacy and data protection laws.
• Protecting account credentials, API keys, integrations, and access to Customer systems.
• Responding to Data Subject requests and regulatory requirements where the Customer is responsible for doing so.

The liability of each party arising from or relating to this DPA is subject to the limitations, exclusions, and other liability provisions contained in the applicable Agreement.

Nothing in this DPA is intended to create liability beyond that provided for in the applicable Agreement, except where such limitation is prohibited by applicable law.

This DPA remains effective for as long as Falahx processes Personal Data on behalf of the Customer under the applicable Agreement.

The obligations relating to confidentiality, security, deletion, and any other provisions that by their nature should survive termination will continue for the period required by applicable law or the Agreement.

This DPA supplements the applicable Agreement between Falahx and the Customer.

If there is a conflict between this DPA and the applicable Agreement regarding the processing of Personal Data, this DPA will control solely to the extent necessary to resolve that conflict, unless the Agreement expressly states otherwise.

If applicable data protection law requires terms that are more protective of Personal Data than those contained in this DPA, the parties will interpret and apply this DPA to satisfy those requirements to the extent legally required.

Falahx may update this DPA from time to time to reflect changes to its services, security practices, Subprocessors, technology, or applicable legal requirements.

Where changes materially affect the Customer's obligations or Falahx's processing of Personal Data, Falahx will provide reasonable notice where required by applicable law or the Agreement.

If a legally required change cannot reasonably be implemented through an update to this DPA, the parties will cooperate in good faith to address the applicable requirement.

If you have questions regarding this DPA, data processing, security practices, or privacy requirements applicable to your use of Falahx, please contact our legal team.