Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement governing the customer’s use of Saliox.com (the “Agreement”) and is entered into between the customer identified in the Agreement (“Customer”) and the operator of Saliox.com (“Saliox”).

This DPA applies where Saliox processes personal data on behalf of Customer as a processor in connection with the services.

This Data Processing Addendum is entered into between the customer acting as controller (or processor, as applicable) and Saliox Ltd, a company registered in England and Wales with company number 17138398 and registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ acting as processor (or subprocessor, as applicable).

In this DPA, “Applicable Data Protection Law” means all laws and regulations applicable to the processing of personal data under the Agreement, including, where applicable, the UK GDPR, the Data Protection Act 2018, the EU GDPR, and laws implementing or supplementing them.

“Controller”, “processor”, “data subject”, “personal data”, “processing”, “personal data breach”, and “supervisory authority” have the meanings given in Applicable Data Protection Law.

Saliox will process personal data solely for the purpose of providing the services described in the Agreement, including document generation, file delivery, template rendering, storage options, support, security, and related service operations.

The subject matter, duration, nature, and purpose of the processing, the types of personal data processed, and the categories of data subjects are described in Annex 1 to this DPA.

This DPA remains in force for as long as Saliox processes personal data on behalf of Customer under the Agreement.

Saliox will process personal data only on documented instructions from Customer, including as set out in the Agreement, this DPA, and Customer’s use and configuration of the services.

Saliox will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, unless prohibited from doing so by law.

Customer is responsible for ensuring that it has a valid legal basis for the processing of personal data, that it has provided any required notices to data subjects, and that its instructions to Saliox comply with Applicable Data Protection Law.

Customer remains responsible for the accuracy, quality, and legality of the personal data it submits to the services and for determining whether the services are suitable for Customer’s specific compliance requirements.

Saliox will ensure that persons authorised to process personal data are subject to a duty of confidentiality or are under an appropriate statutory obligation of confidentiality.

Access to personal data will be limited to those personnel and subprocessors who need such access to provide, secure, support, or improve the services.

Saliox will implement appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of processing, and the risks to natural persons.

Such measures may include, as appropriate, pseudonymisation, encryption in transit where supported, confidentiality controls, access management, logging and monitoring, resilience measures, vulnerability management, and procedures for regularly testing and evaluating security controls.

Customer grants Saliox general written authorisation to appoint subprocessors to assist in providing the services.

Saliox will impose data protection obligations on subprocessors that are no less protective than those set out in this DPA, to the extent applicable to the services provided by the subprocessor.

Saliox remains responsible for the performance of its subprocessors’ obligations where required by Applicable Data Protection Law.

You should publish a separate subprocessors page and reference it here once live.

Saliox may transfer personal data to countries outside the United Kingdom or the European Economic Area where required to provide the services.

Where such transfers are made to a country that is not subject to an adequacy regulation or adequacy decision, Saliox will implement appropriate safeguards in accordance with Applicable Data Protection Law, including the UK International Data Transfer Addendum, the UK International Data Transfer Agreement, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism.

Taking into account the nature of the processing, Saliox will provide reasonable assistance to Customer, insofar as possible, to enable Customer to respond to requests from data subjects exercising their rights under Applicable Data Protection Law.

Saliox will also provide reasonable assistance to Customer, taking into account the nature of processing and the information available to Saliox, with Customer’s obligations relating to security, breach notifications, data protection impact assessments, and prior consultation with supervisory authorities where required.

Saliox will notify Customer without undue delay after becoming aware of a confirmed personal data breach affecting personal data processed on behalf of Customer.

To the extent reasonably available, the notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach.

Saliox will make available to Customer such information as is reasonably necessary to demonstrate compliance with this DPA.

Where required by Applicable Data Protection Law, Saliox will allow and contribute to audits, including inspections, by Customer or an independent auditor mandated by Customer, provided that such audit rights are exercised on reasonable prior written notice, during normal business hours, no more than once in any twelve-month period unless required by law or following a confirmed security incident, and in a manner that does not unreasonably interfere with Saliox’s business, security, confidentiality obligations, or obligations to other customers.

Saliox may satisfy audit obligations by providing recent independent audit reports, security summaries, policies, certifications, or other documentation where appropriate.

On termination or expiry of the Agreement, Saliox will, at Customer’s choice and subject to the functionality of the services, delete or return personal data processed on behalf of Customer, unless retention is required by law or reasonably necessary for security, backup, dispute resolution, abuse prevention, or enforcement of legal rights.

Residual copies in secure backups may remain until overwritten in the ordinary course, provided they remain protected and are not actively processed except as required for backup or recovery purposes.

The liability of each party under this DPA is subject to the exclusions and limitations of liability set out in the Agreement, unless Applicable Data Protection Law requires otherwise.

In the event of any conflict between this DPA and the Agreement on matters relating specifically to the processing of personal data, this DPA prevails.

This DPA is governed by the governing law and jurisdiction provisions set out in the Agreement, unless Applicable Data Protection Law requires otherwise.

Subject matter: provision of the Saliox.com services, including rendering, template processing, file generation, file delivery, storage options, support, and service security.

Duration: for the term of the Agreement and any period during which personal data remains in Saliox’s possession or control in connection with the services.

Nature and purpose: receipt, storage, organisation, structuring, rendering, transmission, generation, delivery, support, deletion, and other processing necessary to provide the services.

Categories of data subjects: Customer’s employees, contractors, end users, clients, prospects, invoice recipients, suppliers, and any other individuals whose personal data is included in Customer Data.

Types of personal data: names, contact details, postal addresses, invoice data, transaction references, identifiers, document content, account data, support data, and any other personal data included by Customer in source materials or generated outputs.