Data Processing Agreement (DPA)
Last updated: April 2026
Purpose of This DPA
This Data Processing Agreement ("DPA") forms part of the contract between AIQorex and the Customer (as defined below) and governs AIQorex's processing of personal data on behalf of the Customer in connection with the Services.
Where AIQorex processes personal data as a Data Processor (i.e. on the Customer's instructions, for the purpose of delivering the Services), this DPA sets out the obligations of each party regarding data protection.
Where AIQorex determines the purposes and means of processing (i.e. controls the data), AIQorex acts as a Data Controller and its Privacy Policy applies.
This DPA is incorporated into and forms part of the AIQorex Terms of Service.
Definitions
| Term | Definition |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person (Article 4(1) GDPR) |
| Special Category Data | Personal data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic/biometric data, health data, sex life, or sexual orientation (Article 9 GDPR) |
| Processing | Any operation performed on personal data, including collection, storage, use, disclosure, erasure (Article 4(2) GDPR) |
| Data Subject | The identified or identifiable living individual whose personal data is processed |
| Customer | The entity that has entered into an agreement with AIQorex for Services |
| AIQorex | AIQorex, acting as Data Processor |
| GDPR | Regulation (EU) 2016/679 of the European Parliament and of the Council |
| Services | The AIQorex Services purchased or engaged by the Customer as described on the Platform |
1. Scope and Purpose of Processing
1.1 Subject Matter
AIQorex processes personal data solely for the purpose of delivering the agreed Services to the Customer, as defined in the applicable order form, Proposal, or Statement of Work.
1.2 Nature of Processing
AIQorex performs the following types of processing on behalf of the Customer:
- Collection and storage of personal data provided by the Customer
- Use of personal data to deliver and improve Services
- Disclosure to subprocessors as listed in Schedule A (below)
- Erasure or return of personal data upon termination of the agreement
1.3 Categories of Data Subjects
The personal data processed relates to the following categories of data subjects, to the extent provided by the Customer:
- Customers and clients of the Customer
- Employees and contractors of the Customer
- Prospective customers and leads
- Any other individuals whose data the Customer submits through the Platform
1.4 Categories of Personal Data
The Customer may submit the following categories of personal data:
- Identity data (name, company, role)
- Contact data (email, phone, address)
- Financial data (billing information, payment history)
- Technical data (IP address, device information)
- Usage data (interaction with the Customer's systems)
- Any other personal data the Customer chooses to submit
Special Category Data: the Customer should not submit Special Category Data without AIQorex's prior written consent and execution of additional safeguards.
1.5 Duration
Processing under this DPA continues for the duration of the applicable Services agreement. Upon termination, AIQorex will, at the Customer's election:
- Return all personal data to the Customer (in a machine-readable format), or
- Erase all personal data in accordance with Section 6.3 below
2. Customer's Obligations as Data Controller
2.1 Controller Responsibility
The Customer, acting as Data Controller, is responsible for determining the purposes and means of processing personal data in connection with the Services. The Customer warrants that:
- It has all necessary rights, consents, and legal bases required to authorise AIQorex to process personal data as described in this DPA
- It has obtained all necessary data subject notices and consents (where required by applicable law)
- Its submission of personal data to the Services complies with all applicable data protection laws
- AIQorex's processing of such data in accordance with this DPA will not violate any applicable law
2.2 Security
The Customer is responsible for maintaining appropriate security measures for its own systems and for the credentials used to access the Services.
3. AIQorex's Obligations as Data Processor
3.1 Processing Instructions
AIQorex will only process personal data on the documented instructions of the Customer, unless required to do otherwise by applicable EU or Member State law. AIQorex will notify the Customer if it believes that any instruction infringes the GDPR.
3.2 Confidentiality
AIQorex will ensure that personnel authorised to process personal data are subject to binding confidentiality obligations (either by statutory duty or contract).
3.3 Security Measures
AIQorex implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Pseudonymisation and encryption of personal data
- Ability to ensure ongoing confidentiality, integrity, availability, and resilience
- Ability to restore availability and access to personal data in a timely manner after a physical or technical incident
- Regular testing, assessment, and evaluation of security measures
A summary of current security measures is available on request at [email protected].
3.4 Subprocessors
AIQorex uses the following approved subprocessors:
Schedule A — Approved Subprocessors
| Subprocessor | Purpose | Country | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication, storage | EU / US | SCCs, GDPR-compliant |
| Stripe | Payment processing | US | SCCs, PCI DSS Level 1 |
| Google Analytics (with consent) | Website analytics | US | SCCs, IP anonymisation enabled |
| Calendly | Consultation booking | US | SCCs |
| n8n (self-hosted) | Workflow automation | EU (where self-hosted) | No personal data stored outside EU |
AIQorex will notify the Customer of any intended changes to its subprocessors at least 14 days in advance. The Customer may object to such changes within 14 days; if the Customer objects and AIQorex cannot find an acceptable alternative, the Customer may terminate the affected Services.
3.5 Data Subject Assistance
AIQorex will, taking into account the nature of processing, reasonably assist the Customer in fulfilling obligations to respond to requests from data subjects exercising their rights under Chapter III of the GDPR (access, rectification, erasure, restriction, data portability, objection).
3.6 DPA on Request
This DPA is provided to all Customers as a standard document. If your organisation requires a signed version or a specific DPA format, request one from [email protected].
3.7 Data Protection Impact Assessment
Where a Data Protection Impact Assessment (DPIA) is required under Article 35 GDPR for the Customer's use of the Services, AIQorex will provide reasonable assistance by supplying information about the technical and organisational measures implemented.
3.8 International Transfers
AIQorex does not transfer personal data outside the EU/EEA except as described in the table above and in our Privacy Policy. Where personal data is transferred to the US, appropriate safeguards (Standard Contractual Clauses or equivalent) are in place.
4. Audit Rights
4.1 Audit Documentation
AIQorex maintains records of processing activities as required by Article 30 GDPR. These records are available to the Customer upon reasonable written request.
4.2 On-Site Audits
The Customer may request an audit of AIQorex's data processing facilities and practices once per calendar year, at the Customer's expense, with at least 30 days' written notice. The audit must be conducted during Business Hours without disrupting AIQorex's operations.
Alternatively, AIQorex will provide the Customer with a completed questionnaire covering the areas of audit interest.
4.3 Certification
AIQorex may satisfy its audit obligations by providing evidence of certifications or third-party audit reports (e.g. ISO 27001, SOC 2) where these are available.
5. Breach Notification
5.1 Notification
AIQorex will notify the Customer without undue delay (and in any event within 48 hours) after becoming aware of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects.
5.2 Contents
The notification will include:
- A description of the nature of the breach, including categories and approximate number of data subjects and personal data records affected
- The likely consequences of the breach
- The measures taken or proposed to address the breach and mitigate its effects
5.3 Third-Party Notification
Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, AIQorex will assist the Customer in ensuring required notifications to the supervisory authority and affected data subjects are made without undue delay.
6. Erasure and Return of Data
6.1 During the Agreement
Upon the Customer's reasonable written request during the term of the agreement, AIQorex will return or securely erase the Customer's personal data as directed.
6.2 Upon Termination
Upon termination or expiry of the Services agreement, the Customer may elect one of the following within 30 days:
- Return: AIQorex returns all personal data to the Customer in a machine-readable format (CSV or JSON), after which AIQorex erases its copy.
- Erasure: AIQorex securely erases all personal data within 30 days of termination.
If the Customer makes no election within 30 days, AIQorex will securely erase all personal data.
6.3 Exceptions
AIQorex may retain personal data beyond termination if required by applicable law (e.g. financial record retention for tax purposes for 7 years). Such retention is limited to what is legally required and subject to the security measures in Section 3.3.
7. Liability
The liability of AIQorex under this DPA and the GDPR is governed by the limitation of liability provisions in the Terms of Service, with the understanding that nothing in this DPA limits AIQorex's obligations under applicable data protection law.
8. Governing Law
This DPA is governed by the laws of India, without regard to its conflict-of-law principles. The courts in Fatehpur, Uttar Pradesh, India have exclusive jurisdiction over disputes arising from this DPA. Nothing in this clause limits the rights of EU or UK data subjects to seek remedies under applicable data protection law in their own jurisdiction.
9. Contact
Data Protection Officer / Privacy Lead: [email protected]
Security incidents: [email protected]
General enquiries: [email protected]
For information about how we process personal data, see our Privacy Policy. To exercise your GDPR rights, visit our GDPR Rights page.