[Back to Home](/)

# Data Processing Addendum

Contractual safeguards for personal data CraftCX processes on behalf of customers.

Effective Date: October 21, 2026

## 1\. Agreement and scope

This Data Processing Addendum (“DPA”) forms part of the [Terms of Service](/legal/terms-of-service) or other customer agreement that incorporates it (“Agreement”) between CraftCX LLC (“CraftCX”) and the customer identified in that Agreement (“Customer”). It takes effect when the parties accept the Agreement incorporating this DPA. A separately signed DPA continues to apply unless the parties agree to replace it.

“Customer Personal Data” means personal data in Customer Data and customer-specific Results that CraftCX processes on Customer’s behalf. It includes personal data in support conversations, metadata, attachments and generated assessments. “Data Protection Law” means the privacy and data protection laws applicable to that processing, including the EU GDPR, UK GDPR, Swiss Federal Act on Data Protection and applicable US state privacy laws. Other capitalized terms have the meanings in the Agreement.

Customer acts as controller or, where it acts for another controller, as processor with authority to appoint CraftCX as a subprocessor. CraftCX acts as processor or subprocessor accordingly. Account, billing and other data that CraftCX controls for its direct business relationship are described in the [Privacy Policy](/legal/privacy-policy) and are outside this DPA only to the extent CraftCX processes them for those separate purposes. Customer Personal Data does not become controller data merely because it appears in a log or diagnostic record.

This DPA controls conflicts about Customer Personal Data. Mandatory international transfer terms control any conflict with this DPA. Nothing in the Agreement limits data subjects’ rights or a regulator’s powers under Data Protection Law.

## 2\. Documented instructions and Customer responsibilities

CraftCX will process Customer Personal Data only to provide, maintain, secure and support the Services under Customer’s documented instructions. Those instructions consist of the Agreement, this DPA, Customer’s service configuration and other lawful instructions agreed in writing. Annex 1 describes the processing.

If law requires processing outside those instructions, CraftCX will notify Customer before processing unless the law prohibits notice. CraftCX will promptly tell Customer if it believes an instruction infringes Data Protection Law and may suspend the affected processing while the parties resolve the concern.

Customer is responsible for the lawfulness of its instructions, required notices and legal bases, and permission to connect third-party accounts. Customer will limit submitted data to what is needed for the Services. Customer must not submit protected health information requiring a HIPAA business associate agreement, payment-card authentication data, or other data requiring special contractual safeguards unless the parties first agree to those safeguards in writing. Incidental sensitive data remains protected by this DPA and must be handled through lawful instructions, including deletion where appropriate.

## 3\. AI processing and limits on use

CraftCX may use the AI providers described in the [subprocessor list](/legal/subprocessors) to generate Results under Customer’s instructions. Human access is limited to authorized personnel who need it to provide support, investigate errors, maintain reliability or address security and abuse, subject to confidentiality duties.

CraftCX will not use Customer Data or Results to train or fine-tune AI models, or authorize a subprocessor to do so, without Customer’s separate affirmative written agreement specifying the data and purpose. This restriction covers general-purpose and specialized models. Inference, customer-requested evaluation and troubleshooting do not authorize model training. Updating a privacy policy does not supply that agreement.

CraftCX will require subprocessors to process Customer Personal Data only for the contracted services under the protections in Section 5. This DPA does not promise zero retention at every provider. Operational records, security records and backups remain subject to the processing restrictions and deletion requirements below.

CraftCX will not sell Customer Personal Data, share it for cross-context behavioral advertising, or retain, use or disclose it outside the direct business relationship or specified service purposes, except as permitted by Data Protection Law. CraftCX will not combine it with personal data from other customers or its own interactions except as permitted by that law and necessary for the contracted Services. CraftCX certifies that it understands and will comply with these restrictions.

Customer may take reasonable and appropriate steps to verify compliance and stop or remediate unauthorized use. CraftCX will notify Customer if it determines it can no longer meet applicable obligations. Creating anonymized aggregate benchmarks must follow Customer’s documented instructions and the Agreement; data remains protected until it can no longer reasonably identify an individual. Anonymization is not a substitute for a required deletion or return instruction.

## 4\. Confidentiality, security and incidents

CraftCX will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality duties and access only what they need for their work. CraftCX will maintain the technical and organizational measures in Annex 2 and will not materially reduce their overall protection during the Agreement.

A “Personal Data Breach” is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. Unsuccessful attempts that do not compromise Customer Personal Data are not Personal Data Breaches.

CraftCX will notify Customer without undue delay after becoming aware of a Personal Data Breach. The initial notice will not wait for completion of the investigation. CraftCX will provide available information about the affected data and individuals, likely consequences, mitigation and a contact for follow-up, with further information as it becomes available. CraftCX will investigate, contain and remedy the breach and reasonably assist Customer with legally required notifications. Notice is not an admission of liability. Customer remains responsible for notifications to individuals and authorities unless law requires CraftCX to notify them directly.

## 5\. Subprocessors and change notices

Customer gives general authorization to use the subprocessors identified for customer-data processing in the [subprocessor list](/legal/subprocessors). Before granting a subprocessor access, CraftCX will enter into a written agreement imposing data protection duties substantially equivalent to this DPA for the services it provides. CraftCX remains responsible for its subprocessors’ performance of those duties.

CraftCX will email Customer’s designated notice contact or account administrator at least **30 days** before a new or replacement subprocessor begins processing Customer Personal Data. The notice will identify the provider, processing purpose and relevant processing locations. Updating the public list alone is not notice.

Customer may object during that notice period by emailing **[privacy@craftcx.com](mailto:privacy@craftcx.com)** with reasonable data protection grounds. The parties will work in good faith to resolve the objection, including considering an alternative or a change to the affected Services. CraftCX will not send the affected Customer Personal Data to that provider while the objection remains unresolved. If the parties cannot resolve it before the proposed change, either may terminate the affected Services before the provider receives that data. CraftCX will refund unused prepaid fees for those Services. Fees already accrued remain payable, subject to the Agreement’s refund rights.

## 6\. Requests and assistance

CraftCX will promptly inform Customer of requests it receives from individuals concerning Customer Personal Data and direct the requester to Customer. CraftCX will not independently decide such requests except on Customer’s instructions or as required by law.

Taking account of the nature of processing and information available to it, CraftCX will assist Customer with rights requests, security obligations, breach notifications, data protection impact assessments and consultations with regulators. Any fee for exceptional assistance must be agreed in advance and must not prevent assistance required by law. CraftCX will not charge for remedying its own breach of this DPA.

## 7\. Compliance information and audits

CraftCX will provide information reasonably needed to demonstrate compliance with this DPA. Where existing documentation does not reasonably answer the request, CraftCX will permit and contribute to an audit or inspection by Customer or its independent auditor.

The parties will agree reasonable notice, scope, confidentiality and security arrangements to protect other customers and avoid unnecessary disruption. Routine audits will normally be limited to once a year. This limit does not apply after a Personal Data Breach, where there is reasonable evidence of non-compliance, or where law or a regulator requires an audit. These arrangements must not prevent an audit required by Data Protection Law or applicable transfer clauses. Neither this DPA nor an audit implies that CraftCX holds a particular certification.

## 8\. Return, deletion and retention

During the Agreement, CraftCX will follow Customer’s lawful return or deletion instructions. Customer may request an export of Customer Data and Results for **30 days after termination**, through the Services where available or by emailing **[support@craftcx.com](mailto:support@craftcx.com)**. CraftCX will verify the requester’s authority and provide the export through an appropriate secure method. An export request made within that period will be fulfilled before the relevant data is deleted and no later than the active-system deletion deadline below.

Unless Customer instructs earlier deletion, CraftCX will delete Customer Data and Results from active systems within **60 days after termination**. This does not require a separate deletion request. Copies in backups will be deleted or overwritten within **90 days after termination**. Until removal, backup copies will be isolated from ordinary use and accessed only for recovery or legal obligations. If restored, deletion instructions will be reapplied. CraftCX will require its subprocessors to meet these requirements for data processed on its behalf.

An earlier deletion instruction may make a later export impossible; CraftCX will make that consequence clear before acting on the instruction. CraftCX will confirm completion of deletion on Customer’s written request.

Where law requires retention beyond these periods, CraftCX will retain only the required data for the required period, restrict its use to that legal purpose, and delete it when the requirement ends. CraftCX will explain the requirement to Customer unless legally prohibited. A general desire to improve the service or retain useful records is not an exception.

Separate account, contract and billing records that CraftCX controls are governed by the Privacy Policy. Their retention does not authorize retaining conversation content or identifiable Results. The obligations in this DPA continue for all retained Customer Personal Data.

## 9\. International transfers

CraftCX processes Customer Personal Data in the United States. Customer authorizes that processing, subject to Data Protection Law and the transfer requirements below. This authorization does not replace any transfer safeguard required by law. A provider’s headquarters is not a promise of data residency. CraftCX will provide the processing and access locations relevant to Customer’s configuration on request and before a restricted transfer requiring that information.

The following transfer requirements apply only where required by Data Protection Law. Before a transfer that requires safeguards under EU, UK or Swiss law, the parties must put a valid transfer mechanism in place. Where they rely on the European Commission’s [Standard Contractual Clauses under Decision 2021/914](https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) (“SCCs”), they will complete and accept a transfer schedule identifying the parties, their addresses and contacts, the applicable modules, processing details, security measures and competent supervisory authority. Annexes 1 and 2 below supply the service processing details and security measures for that schedule.

For a controller-to-processor transfer, Module Two applies; for a processor-to-processor transfer, Module Three applies. The schedule must select the applicable options, governing law and courts. The general subprocessor authorization and 30-day notice period in Section 5 apply where Clause 9 Option 2 is selected. For UK transfers, the parties will also complete and accept the ICO’s applicable International Data Transfer Addendum. For Swiss transfers, the schedule must include the adaptations required under Swiss law.

Publication or acceptance of this DPA alone does not constitute completion or execution of the SCCs or UK Addendum. CraftCX will not make a restricted transfer until the necessary mechanism and details are in place. The parties will assess the transfer and implement supplementary safeguards where required. Customer may request a copy of the applicable safeguards at **[privacy@craftcx.com](mailto:privacy@craftcx.com)**, subject to redaction of unrelated confidential information without obscuring the protections that apply.

If the mechanism no longer permits the transfer, the parties will implement a lawful alternative or suspend the affected transfer. If no lawful alternative is available, Customer may terminate the affected Services and request return or deletion of the affected data.

## Annex 1. Processing details

| Item | Description |
| --- | --- |
| Subject matter | Analysis and monitoring of customer-support interactions and related reporting. |
| Purpose and nature | Receive and store connected support data; analyze it with AI systems; generate scores, classifications, summaries and reports; provide customer-requested exports, support, reliability and security functions. |
| Duration | The Agreement’s duration and the limited export, deletion and retention periods in Section 8. |
| Frequency | Ongoing as Customer submits data or enables integrations and scheduled processing. |
| Individuals | Customer’s support end users, employees, contractors and other individuals whose information appears in submitted support interactions. |
| Data types | Names, contact details, identifiers, conversation content, internal notes, timestamps, ticket metadata, submitted attachments, integration payloads, and personal data in generated Results and associated operational records. |
| Sensitive data | Not required for ordinary use. Support content may incidentally contain sensitive data; Section 2 limits intentional submission, and access and deletion controls still apply to incidental data. |
| Customer identity and contact | The contracting entity and designated data protection contact identified in the Agreement or a separately completed processing schedule. |
| CraftCX identity and contact | CraftCX LLC, California, USA; privacy@craftcx.com. Postal addresses required for a transfer mechanism must be recorded in the completed transfer schedule before the transfer. |
| Subprocessing | The functions and providers identified in the subprocessor list, limited to the Services Customer uses and governed by Section 5. |

## Annex 2. Security measures

CraftCX will maintain measures appropriate to the nature of Customer Personal Data and the risks of processing, including:

-   **Access controls.** Limit personnel and service access according to assigned duties, use individual credentials where available, protect privileged access, and remove access when no longer needed.
-   **Data separation.** Restrict access to customer workspaces and data through authorization controls and organization-scoped processing.
-   **Encryption.** Use encrypted transport for Customer Personal Data sent over public networks and encryption at rest for stored Customer Personal Data, including managed databases, file storage and backups.
-   **Operational security.** Review changes, restrict production access, maintain supported systems and apply security updates according to risk.
-   **Monitoring and response.** Maintain security and reliability logging, restrict access to diagnostic records, investigate incidents and follow the notification process in Section 4.
-   **Recovery and deletion.** Maintain backup and recovery procedures and apply Section 8 to active data, exports, restored data and backup copies.
-   **Provider controls.** Assess subprocessors for their assigned processing, impose written data protection duties, and restrict data sent to what the service requires.

These measures describe contractual obligations. They do not represent a certification or an independent audit report. CraftCX will provide further information under Section 7 where needed to assess compliance or complete transfer documentation.

## Contact

Send DPA questions, subprocessor objections and transfer-document requests to **[privacy@craftcx.com](mailto:privacy@craftcx.com)**. Send export requests to **[support@craftcx.com](mailto:support@craftcx.com)**.

This DPA draws on the [General Legal Global DPA template](https://github.com/General-Legal/legal-templates/blob/main/templates/dpa-global/template.md), released under CC0. CraftCX has adapted it; General Legal has not reviewed or endorsed these terms.