Data Processing Addendum

This Addendum forms part of the Terms of Service between you (the "Customer", acting as controller) and Sublex Digital (the "Processor", "we", "us") for Sublex Chat. It applies where you use the service to process personal data of your own customers or contacts.

Where this Addendum and the Terms conflict on data protection, this Addendum wins.

1. Roles

• You are the controller of the personal data your assistant handles — your

customers' messages, the leads they leave, and their WhatsApp numbers. You decide why and how it is collected.

• We are your processor. We process that data only to provide the service, and

only on your instructions. Using the service as documented — running an assistant, capturing leads you configured, showing you transcripts — is your documented instruction to us.

We remain an independent controller for the limited data we hold about you as our customer (account, billing, security), which is governed by our Privacy Policy, not this Addendum.

2. Our obligations as processor

We will:

1. Process only on your instructions, and only for the purpose of providing

the service, unless the law requires otherwise (in which case we will tell you, unless the law forbids it).

1. Ensure the people who process the data are bound by confidentiality.
2. Apply appropriate technical and organisational security measures — set out

in Annex B.

1. Not engage another subprocessor without the general authorisation in Annex A,

and give you notice of an intended change so you can object.

1. Assist you — taking into account the nature of the processing — in

responding to your customers' data-subject requests, and in meeting your own obligations around security, breach notification, and impact assessments.

1. Notify you without undue delay after becoming aware of a personal data

breach affecting your data. We aim to notify you within 72 hours of becoming aware.

1. On the end of the service, delete or return your data at your choice,

except where the law requires us to keep it. Deleting your organisation removes the data attached to it, and your retention settings apply while the service is live. A usage record outlives a deleted conversation: that it happened, when, on which channel and whether it was answered, with no content and no link to the data subject. It exists so that billed usage cannot be altered by deletion.

1. Make available the information reasonably needed to demonstrate compliance, and

allow for audits as described in section 5.

3. Your obligations as controller

You will: have a lawful basis to collect the data and to instruct us to process it; give your own customers the privacy information they are owed; and not use the service to process special-category data beyond what the service is designed for, or in a way that would put us in breach of the law.

4. Subprocessors

You give general authorisation to the subprocessors listed in Annex A. We remain responsible for their processing. Before adding or replacing one, we will give reasonable notice — by updating the list in this Addendum and, for a material change, by email to your account address at least 14 days before it takes effect. If you reasonably object to a new subprocessor on data-protection grounds, you may raise it with us and, if we cannot resolve it, terminate the affected part of the service.

5. Audits

We will provide, on reasonable request and no more than once in any twelve-month period except where a regulator or a breach requires otherwise, the information needed to show we meet this Addendum. Where an on-site audit is genuinely required, it will be at reasonable notice, during business hours, subject to confidentiality, and without giving the auditor access to another customer's data.

6. International transfers

Some processing takes place outside the region where your data is primarily hosted — in particular, the AI and embedding providers in Annex A that generate answers and search vectors. We will ensure such transfers have an appropriate safeguard where the law requires one. Where the law requires one, we rely on the subprocessor's standard contractual clauses and data-processing terms.

7. Liability and term

This Addendum lasts as long as we process your data. Liability under it is subject to the limits in the Terms of Service.

Annex A — Details of processing and subprocessors

Subject matter: provision of the Sublex Chat assistant service. Duration: the term of the account, plus deletion as in section 2. Nature and purpose: answering customer enquiries from the Customer's own knowledge, capturing leads the Customer configured, and presenting transcripts and analytics to the Customer.

Categories of data subjects: the Customer's own customers, website visitors, and enquirers.

Types of personal data:

• message content in a conversation (which may contain whatever a visitor types);
• contact details left as a lead: name, phone number, email, and answers to a

pre-chat form the Customer configured;

• a WhatsApp number, where the WhatsApp channel is used;
• a one-way hash of a visitor's network address, used only to rate-limit abuse.

Special-category data: not intended. The Customer must not use the service to deliberately collect special-category data, though a visitor may type anything into a message.

Subprocessors:

Each subprocessor's own data-processing terms: Supabase, Vercel, OpenRouter, DeepInfra, Resend, Paddle, Meta and Sentry.

Annex B — Technical and organisational measures

We apply, at least:

• Tenant isolation enforced in the database by row-level security, so one

customer's data cannot be read by another — the primary protection in a multi-tenant service.

• A support/administration boundary that cannot read conversation content: the

tables holding messages, leads and private notes are never exposed to our staff through a support view; this is enforced by database policy, not convention.

• Least-data-out: conversation content is never placed in outbound email or in

error reports; network addresses are stored only as one-way hashes; card data is never received or stored.

• Access controls and authentication on the platform, with administrative

actions written to an append-only audit log.

• Encryption in transit. At-rest protection is provided by the hosting

provider. Our database and file-storage provider encrypts data at rest (AES-256).

• Automated deletion on the Customer's retention schedule, and of abandoned

accounts.

• Error monitoring to detect faults, configured to exclude personal data from

reports.

Contact for data-protection matters: info@sublexdigital.com — Sublex Digital, Lamin, The Gambia.