Data Processing Agreement

1. Parties and roles

This Data Processing Agreement (“DPA”) is between the customer identified in the Wexlyn account (“Customer”, the controller) and CQ Marketing LLC, 15209 East Pinnacle LN, Veradale, WA 99037, United States, operating Wexlyn (“Wexlyn”, the processor). Where the Customer is itself a processor for its own clients, Wexlyn acts as a sub-processor and the Customer warrants that its clients' instructions are reflected in its own.

2. Subject matter, duration, nature and purpose

Wexlyn processes personal data to provide the services described in the Terms: recording visits and clicks on the Customer's websites, matching them to leads, sales, calls and subscriptions received from the Customer's connected tools, attributing revenue to advertising sources, sending conversions to advertising platforms the Customer enables, and reporting on the result. Processing lasts for the term of the Customer's account plus the deletion period in section 9.

3. Categories of data and data subjects

• Data subjects: visitors to the Customer's websites, the Customer's leads and customers, participants in the Customer's recorded sales calls, and the Customer's own users.
• Personal data: first-party visitor identifiers, IP address (or a salted hash of it when the Customer enables hashing), approximate location derived from the IP, pages visited, URL parameters, device and browser type; name, email address and phone number given in forms or received from the Customer's tools; order and subscription details and amounts; call recordings, transcripts and the analysis Wexlyn produces from them when the Customer connects a call recorder; account and billing details of the Customer's users.
• Special categories: none are required by the service. The Customer agrees not to send them to Wexlyn.

4. Instructions

Wexlyn processes personal data only on the Customer's documented instructions: this DPA, the Terms, the settings the Customer chooses in the product (including the privacy settings in Tracking Configuration) and any further written instruction. Wexlyn informs the Customer if, in its opinion, an instruction infringes data protection law, and processes without instructions only where required by law applicable to Wexlyn, in which case it informs the Customer beforehand unless that law prohibits it.

5. Confidentiality

Persons authorised by Wexlyn to process personal data are bound by confidentiality obligations and receive access only as needed to operate and support the service. Staff access to a Customer workspace is recorded in the Customer's audit log.

6. Security

Wexlyn implements the technical and organisational measures described in Annex II, including encryption in transit and at rest, encryption of integration credentials with a key held outside the database, row-level security, role-based access, API keys stored as hashes, rate limits on public endpoints, audit logging, encrypted off-site backups and point-in-time recovery, and a documented incident response plan.

7. Subprocessors

The Customer authorises the subprocessors listed at wexlyn.ai/subprocessors. Wexlyn imposes data protection obligations on each subprocessor no less protective than this DPA and remains liable for their performance. Wexlyn gives at least 30 days' notice of additions or replacements; the Customer may object on reasonable data-protection grounds, and if no resolution is found may terminate the affected service.

8. Assistance and data subject requests

Wexlyn provides the tools for the Customer to answer access, portability and erasure requests directly: export of a person's data as a machine-readable file and deletion of a person by email or from the CRM, both covering tracked events, identities, sales, calls and subscriptions. Where a request reaches Wexlyn directly, Wexlyn forwards it to the Customer without undue delay. Wexlyn assists with data protection impact assessments and prior consultations as reasonably required, taking into account the nature of the processing and the information available to it.

9. Deletion and return

The Customer can export its data at any time during the term. Tracked events are kept for the retention period the Customer sets (25 months by default). On termination, Wexlyn deletes the Customer's personal data within 30 days, except where retention is required by law, and deletes it from backups within the backup rotation period of 90 days.

10. Personal data breaches

Wexlyn notifies the Customer without undue delay, and at the latest within 72 hours of becoming aware of a personal data breach affecting the Customer's data, with the information needed for the Customer to meet its own notification duties, and keeps the Customer informed as the investigation proceeds.

11. Audits

Wexlyn makes available the information needed to demonstrate compliance with this DPA, including its security documentation and subprocessor agreements summaries. Once a year, or after a breach, the Customer or an independent auditor bound by confidentiality may audit Wexlyn's compliance on 30 days' notice, during business hours, without disrupting the service.

12. International transfers

Wexlyn processes personal data in the United States. For transfers from the EEA, Wexlyn relies on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) and, where the Customer is a processor, Module Three (processor to processor), which are incorporated into this DPA by reference with the Customer as data exporter and Wexlyn as data importer; Clause 7 (docking) applies, option 2 of Clause 9 applies with the notice period in section 7, Clause 11 optional language does not apply, Clause 13 is completed with the supervisory authority of the Customer's establishment, Irish law governs under Clause 17 and the courts of Ireland are chosen under Clause 18. For transfers from the UK, the UK International Data Transfer Addendum to the EU SCCs applies; for Switzerland, the clauses are read with the adaptations required by the Swiss FDPIC. Annex I is completed by sections 1 to 3 of this DPA and Annex II by section 6.

13. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, except where data protection law does not permit it. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data; the Standard Contractual Clauses prevail over both where they apply.

Annex II: technical and organisational measures

• TLS for every connection; AES-256-GCM for stored integration tokens, key held outside the database.
• Row-level security on every tenant table; roles and per-area permissions within a workspace.
• API keys stored as salted hashes; public endpoints rate-limited; webhook signatures verified.
• Per-account privacy controls: EU/UK consent-first or do-not-track, IP hashing, retention window.
• Audit log of administrative and data-affecting actions, readable by the customer.
• Nightly encrypted backups to two providers, 7-day point-in-time recovery, documented restore drills.
• Incident response plan with severity levels, 72-hour customer notification, post-incident review.
• Least-privilege staff access; access to a customer workspace logged with the staff member's name.

Contact

Data protection enquiries: austin@cqmarketing.net. Wexlyn is in the process of appointing a representative in the European Union under Article 27; the representative's details will be published here.