Data Processing Agreement

Last updated: 25 October 2026

This Data Processing Agreement (the "DPA") sets out how Stravax Group LLC processes personal data on behalf of Stravax Engage customers. It forms part of the Terms of Service and applies whenever we act as your processor. You do not need to sign it: by accepting the Terms of Service, you accept this DPA.

1. Parties, scope, and incorporation

This DPA is between Stravax Group LLC, a company registered in the United Arab Emirates (licence 2537844.01), with a registered address at Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE ("Stravax", "we", "us", the processor), and the business that holds the Stravax Engage account ("Customer", "you", the controller).

This DPA is incorporated into, and forms part of, the Terms of Service by reference. It governs the processing of personal data that you route through Stravax Engage, where you are the controller and we act as your processor. It also governs personal data you route through Stravax Engage on behalf of your own clients, for example as an agency operating workspaces for them: for that data, where this DPA describes you as the controller, your client is the controller, you act as its processor, and we act as your subprocessor, and section 10 sets out how the Standard Contractual Clauses apply. No separate signature is required: by accepting the Terms of Service, or by creating an account or using the platform, you accept this DPA on behalf of the business you represent. Where this DPA and the Terms of Service conflict on the processing of personal data, this DPA prevails. A negotiated written agreement signed by both parties prevails over this DPA to the extent of any conflict, except that the Standard Contractual Clauses in section 10 always prevail. This DPA replaces any data processing terms we published earlier for Stravax Engage, including the Data Processing Addendum in our help centre.

2. Definitions

• Controller: the party that determines the purposes and means of processing personal data. For data routed through the platform, this is you.
• Processor: the party that processes personal data on behalf of the controller. This is Stravax.
• Subprocessor: a third party engaged by the processor to process personal data on the controller's behalf.
• Personal data: any information relating to an identified or identifiable natural person that is processed under this DPA.
• Processing: any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
• Data subject: the identified or identifiable natural person to whom the personal data relates.
• Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data processed under this DPA.

3. Roles and scope of processing

For personal data you route through Stravax Engage, you are the controller and Stravax is the processor. The subject matter of the processing is the operation of the Stravax Engage platform for you. The duration of the processing is the term of your account, plus the retained copies and current deletion and export limits described in section 11.

4. Customer instructions

We process personal data only on your documented instructions, including with regard to transfers of personal data to a third country or an international organisation, and including as set out in this DPA, the Terms of Service, and your configuration and use of the platform. We do not use your data for our own purposes and do not sell it. If we believe an instruction breaches applicable data protection law, we will inform you immediately. We process personal data other than on your instructions only where the law that applies to us requires it, and for personal data subject to the GDPR only where Union or Member State law requires it, and for personal data subject to the UK GDPR only where UK law requires it. In that case we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

You warrant that you have a lawful basis and, where required, valid opt-in and consent to message your contacts on the channels you connect and to route their personal data through the Service, and that your instructions comply with applicable law.

5. Confidentiality of personnel

We ensure that personnel authorised to process personal data under this DPA are bound by an appropriate duty of confidentiality and process the data only as needed to deliver the Service.

6. Security measures

We maintain the following technical and organisational measures, which form Annex II of the Standard Contractual Clauses:

• Encryption of data in transit using TLS.
• Encryption at rest by our hosting provider at the platform level for our database, file storage and backups, and additional application-level encryption with AES-256-GCM of the access tokens and API keys we use to reach the accounts you connect, such as your connected e-commerce platform access token.
• Isolation of each customer's data to its own tenant: every record of your data is tied to your organisation identifier, directly or through the record it belongs to, and customer-data reads are scoped to your organisation or to record identifiers already resolved inside it.
• Access control in your workspace: roles, channel-level permissions, optional two-factor authentication, and verification of sign-ins from new devices.
• Verification of the signature on incoming connected e-commerce platform webhooks before they are processed.
• Storage of message media separately from message metadata.
• Management of secrets using our hosting provider's secret storage.
• A daily backup of the database to separate storage, on top of our hosting provider's 30-day point-in-time restore.
• Error monitoring to detect and investigate faults. Mobile reports go to our own servers with the account and workspace and are deleted within 30 days; the mobile app has no third-party crash-reporting code. Server error forwarding sends severity, type, an identifier-only source and workspace identifier, excluding free-text error details and message content. Other runtime logs are separate and can contain personal data echoed in provider errors.
• A log of administrative and compliance actions.

Measures to assist you. To help you respond to data subject requests, admins in your workspace can view and export contact records and export your organisation's data, and can delete a contact that has no conversations and is not linked to a list, sequence, lead, or connected e-commerce platform checkout or order. For any other contact, send your written deletion instruction to privacy@engage.stravax.ai. We assist with requests under section 8, subject to the current technical limitations described in section 11. There is no complete customer-erasure routine, and receipt of an instruction does not confirm deletion of the contact, its conversations, media or linked records. These limitations do not remove our contractual obligations or rights under the Standard Contractual Clauses. To help you meet your breach obligations, we notify you as set out in section 9. To help you carry out data protection impact assessments and any prior consultation with a supervisory authority, we give you, on request, the information about our processing and these measures that you reasonably need, taking into account the nature of the processing and the information available to us.

No system is perfectly secure, but we maintain measures appropriate to the risk. We may update these measures over time, provided the level of protection is not materially reduced.

7. Subprocessors

You give us general written authorisation to engage subprocessors in the categories below to process personal data in order to deliver the Service. We engage each subprocessor under a written contract that imposes, in substance, the same data protection obligations as this DPA, and we remain fully responsible to you for each subprocessor's performance of those obligations. Our subprocessors fall into these categories:

The following implemented paths include both service providers and customer-connected recipients. Optional integrations receive data when connected or used; not every workspace uses every path. The role distinction below still applies.

We keep a current list of our subprocessors. On request to privacy@engage.stravax.ai, we send it to you, with each subprocessor's name, address and data protection contact, what it does, and the countries where it processes personal data. Section 10 explains international transfers.

We will notify you by email at least 14 days before adding or replacing a subprocessor, so that you can object on reasonable data protection grounds. For personal data governed by Module Three, the 30-day notice in section 10 applies. The notice will name the subprocessor, describe what it will do, and say where it will process personal data. If you object and we cannot resolve your objection before the new subprocessor starts processing your personal data, you may end the affected feature or your account by written notice before then. Termination under this section takes effect on the date in your notice.

Platforms you connect are not our subprocessors. The operators of the messaging channels you connect from your own accounts, your connected store, and the payment, advertising, CRM and ticketing platforms you connect receive personal data on your instruction and act as independent controllers or as your own processors under your agreement with each of them. Data follows your connected features and their implemented paths, including conversion sync and selected audience uploads. These paths do not automatically exclude contacts who withdrew messaging consent or are blocklisted; you must apply those choices to the data you send. Each connected platform handles received data under your agreement with it.

8. Data subject rights

Taking into account the nature of the processing, we assist you by the technical and organisational measures in section 6, so far as possible, in responding to requests from data subjects to exercise their rights under applicable law, including access, correction, deletion, objection, restriction and portability. If a data subject sends us a request about data we process on your behalf, we will promptly pass it to you and will not respond to it ourselves unless you authorise us to.

9. Personal data breach notification

If we become aware of a personal data breach affecting the personal data we process on your behalf, we will notify you without undue delay, and no later than 72 hours after becoming aware of it. Our notice will give a contact point and describe the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures we have taken or propose to take, including to mitigate its effects. Where we cannot give all of this at once, we will give it in phases without further undue delay.

10. International transfers

We are based in, and access personal data from, the United Arab Emirates, which does not have an adequacy decision from the European Commission, the UK or Switzerland. Where you are established in, or transfer personal data from, the European Economic Area, the UK or Switzerland, or the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection otherwise applies to your processing of the personal data you route through the Service, the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor) and, where you act as a processor for your own clients, Module Three (processor to processor), are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum issued under section 119A of the Data Protection Act 2018 for transfers subject to the UK GDPR. Where our processing on your behalf is itself directly subject to the GDPR or the UK GDPR, we also meet the obligations those laws place on us directly, and the Clauses apply as an additional safeguard.

For the Clauses: Clause 7 (docking) applies; under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period set out in section 7; the optional wording in Clause 11(a) does not apply; under Clause 17, Option 1 applies and the Clauses are governed by the law of Ireland; under Clause 18(b), the courts of Ireland are chosen; Annex I is completed by sections 1, 3, 7, 11 and 15 of this DPA, and Annex I.C by the paragraph on the competent supervisory authority below; and Annex II is completed by section 6. Annex III is not required because Option 2 applies; our current subprocessor list is available on request under section 7.

Competent supervisory authority (Clause 13). Where you are established in an EEA member state, the competent supervisory authority is the one responsible for your compliance with the GDPR for the transfer, which for cross-border processing is your lead supervisory authority. Where you are not established in the EEA but the GDPR applies to your processing under its Article 3(2) and you have appointed a representative under Article 27(1), it is the supervisory authority of the member state in which that representative is established. Where you are not established in the EEA, the GDPR applies to your processing under its Article 3(2), and you are not required to appoint a representative under Article 27(2), it is the supervisory authority of the member state in which the data subjects whose personal data is transferred are located or, where they are located in more than one, the member state you tell us in writing, failing which the one in which most of them are located. For transfers subject to the UK GDPR, the competent authority is the UK Information Commissioner's Office.

Module Three (when you act for your own clients). Where you process personal data on behalf of your own clients, and the conditions in the first paragraph of this section are met for you or for your client, Module Three applies to that personal data instead of Module Two, and Module Two continues to apply to personal data for which you are the controller. Before you route a client's personal data through the Service, or promptly if you already do, you tell us in writing to privacy@engage.stravax.ai that you act as that client's processor, and give us the client's legal name, the workspaces you operate for it, and a data protection contact for it, and you keep this information up to date. Under Module Three, you are the data exporter, acting as processor; we are the data importer, acting as your subprocessor; and the controller is your client, as identified in that notice. The selections above apply to Module Three in the same way, except for the notice period: Clause 7 (docking) applies; under Clause 9(a), Option 2 (general written authorisation) applies, with a notice period of 30 days; the optional wording in Clause 11(a) does not apply; the competent supervisory authority under Clause 13(a) is identified as set out in the paragraph above, with you as the data exporter; under Clause 17, Option 1 applies and the Clauses are governed by the law of Ireland; under Clause 18(b), the courts of Ireland are chosen; and the Annexes are completed as set out above, except that in Annex I.A you are the data exporter with the role of processor and we are the data importer with the role of subprocessor, and in Annex I.B section 3 describes the personal data you route through the Service for your client, with its references to your contacts, customers, prospects and leads read as references to your client's. The measures in section 6 that assist you are also, for Annex II and Clause 10(b), the measures by which we assist your client, in cooperation with you. Where you are not established in the EEA and the GDPR does not apply to your processing under its Article 3(2), but your client transfers the personal data to you under Standard Contractual Clauses or another safeguard that requires you to impose on us, in substance, the same data protection obligations, Module Three is the contract by which you do so, and the competent supervisory authority is the one competent for your client's transfer of the personal data to you; where your client is subject to the UK GDPR or the FADP, it is the Information Commissioner or the FDPIC respectively. The United Kingdom and Switzerland paragraphs below apply to Module Three as they do to Module Two. For personal data under Module Three, the following also applies:

• Instructions (Clause 8.1). Your notice under the paragraph above is how you inform us that you act as your client's processor. You make your client's instructions available to us before the processing they cover, through your configuration and use of the workspaces you operate for it and, where they go further, in writing to privacy@engage.stravax.ai. We process that data only on your client's documented instructions as you communicate them to us, and on any additional documented instructions from you, which must not conflict with your client's; your client may also give us further documented instructions, and we tell you of any it gives us directly. We may take reasonable steps to confirm that a person who contacts us is authorised to act for your client, including by checking with you or with the contact in your notice. If we are unable to follow an instruction, we inform you immediately, and you notify your client immediately. You warrant that you have imposed on us the same data protection obligations as your contract with your client sets out. If that contract requires more of us than this DPA, you tell us in writing before we process the data it covers, and unless we agree in writing to those further obligations, you do not route that client's personal data through the Service.
• Personal data breaches (Clause 8.6). We notify you as set out in section 9 and, where appropriate and feasible, also notify your client at the data protection contact in your notice. We assist you so that you can notify your client, and your client can in turn notify the competent supervisory authority and the data subjects concerned.
• Subprocessors (Clause 9(a)). You warrant that your client has given its general written authorisation for our engagement as your subprocessor and for the subprocessors on our current list under section 7. We give the notice described in section 7 at least 30 days before adding or replacing a subprocessor, and we send it in writing both to you and to the data protection contact in your notice, so that your client can object before the change. If we have no working contact for your client, we send the notice to you, you warrant that your client has authorised you to receive it on its behalf, and you pass it to your client without undue delay. Your client may object to us directly or through you, and section 7 then applies to its objection as if it were yours, except that you may also end your use of the affected feature, or of the Service, for that client alone. We inform you of each subprocessor we engage.
• Data subject requests (Clause 10). We notify you, and where appropriate your client, of any request we receive from a data subject, and we respond to it only if your client authorises us to, as you communicate to us or as your client tells us directly.
• Information and audits (Clause 8.9). We deal promptly and adequately with enquiries from you or your client about the processing. We make the information described in section 12 available to you, and you provide it to your client. Section 12 applies to audits you request on your client's instructions as it applies to your own audits, with the yearly allowance counted separately for each client; you may combine audits requested by several clients into one, and you make the results of an audit carried out on a client's instructions available to that client. You also forward to your client the notifications and information the Clauses require you, as data exporter, to forward to it, including under Clauses 14(e), 15.1(a) and (c) and 15.2(b), and you inform it as Clause 16(c) requires.

United Kingdom. The UK Addendum referred to above is version B1.0, issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018. Its Part 1 tables are completed as follows: Table 1 by sections 1 and 15 of this DPA, with the start date being the date you accept the Terms of Service; Table 2 by the Module Two selections above and, where Module Three applies, by the Module Three selections above; Table 3 by the Annex mapping above, including, for Module Three, the roles and descriptions set out for it; and in Table 4, the importer may end the Addendum as set out in its Section 19. Under the Addendum, the Clauses are governed by the law of England and Wales and disputes go to its courts.

Switzerland. For transfers subject to the Swiss Federal Act on Data Protection (FADP), the Clauses apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner (FDPIC). References in the Clauses to the GDPR are read as references to the FADP so far as the transfer is governed by the FADP. The competent supervisory authority in Annex I.C is the FDPIC, and where a transfer is governed by both the FADP and the GDPR, the FDPIC for the Swiss part and the authority identified above for the EEA part. The term "member state" is not read so as to prevent data subjects in Switzerland from bringing proceedings in their place of habitual residence, and Clause 18(c) applies accordingly.

Personal data is stored on our hosting provider's infrastructure, which may be located outside the UAE, and our subprocessors may process it in other countries where they operate. Where that happens, we rely on the safeguards in those providers' data processing terms, such as Standard Contractual Clauses. On request, we give you a copy of the safeguards that cover a transfer.

11. Deletion and return on termination

When your account ends, contact privacy@engage.stravax.ai about export or deletion. There is currently no complete automatic data-return or customer, account or populated-workspace erasure routine. Account profiles, conversations, contacts, leads, campaigns and message media currently have no automatic expiry. Removing access, deactivating an account or uninstalling the store integration does not erase all of them. We cannot promise complete deletion within 30 days or confirm complete deletion merely because a request was received or logged.

For connected e-commerce platform, a successful daily job deletes abandoned-checkout rows at least 90 days old. Customer redaction deletes the store's checkout rows only when their stored phone matches the request; missing or unmatched phones delete no rows. Store redaction deletes checkout rows for an eligible uninstalled store; a reconnected store is protected. Data-access requests are logged for an operator, not automatically returned. These paths leave separate contacts, messages, order-notification records, administrative audit copies and existing backups. Those live copies have no automatic expiry.

The documented backup retention window is 90 days from backup creation. Deleting live data does not erase existing backups, and a restore can bring deleted data back because deletions are not automatically reapplied. This is not a promise of complete erasure at 90 days. We continue to protect retained data. If applicable law requires retention, we process the retained data only as that law permits; for personal data subject to the GDPR or UK GDPR, the relevant Union, Member State or UK law applies as in section 4. Account and billing data and request handling are described in our Privacy Policy. This text discloses current limitations and does not erase earlier contractual commitments or limit rights under the Standard Contractual Clauses.

12. Audit and information rights

We make available to you all information necessary to demonstrate our compliance with this DPA, and we allow for and contribute to audits, including inspections, by you or an independent auditor you appoint: once a year, and in addition where a supervisory authority requires it, after a personal data breach, or where there are indications of non-compliance. You will give us at least 30 days' written notice, unless a supervisory authority or the breach or non-compliance concerned requires a shorter period. In deciding on an audit, you may take into account relevant certifications we hold. Audits are at your cost, are subject to reasonable confidentiality and security conditions, and must not disrupt the Service or expose the data of our other customers.

13. Liability

Each party's liability under this DPA is subject to the limitation of liability set out in the Terms of Service. That limitation does not apply to liability under the Standard Contractual Clauses in section 10, or to either party's liability to data subjects.

14. Governing law

This DPA is governed by the laws of the United Arab Emirates, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and any dispute is subject to the exclusive jurisdiction of the competent courts of the United Arab Emirates.

This section does not apply to the Standard Contractual Clauses in section 10. The Clauses are governed by the law and subject to the courts they themselves select, as set out in that section. If the Clauses conflict with this DPA or any other agreement between us, the Clauses prevail.

15. Contact

Questions or data protection requests under this DPA: privacy@engage.stravax.ai, Stravax Group LLC, Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE. For Annex I.A, our contact for data protection is the Stravax privacy team at the address above, and yours is the account owner named in your account, together with any data protection officer or EU representative you tell us about. Your acceptance of the Terms of Service is your signature of Annex I.A, dated the day you accept it. Our publication of this DPA is our signature of Annex I.A, dated the date shown at the top of this page.

The current provider list is available on request at privacy@engage.stravax.ai, including names, addresses, contacts, functions and processing countries. You can object using the procedure in section 7. These corrections are not retroactive notice or authorisation. The separate store-link merchant agreement is at merchant terms; it does not replace this general DPA for other business customers.