Data Processing Agreement

Last updated: 6 August 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", the data controller) and your Scalix contracting entity (the data processor) — Scalix World Pvt Ltd (India) or Energy FW Ltd (UK), as set out in the Terms. It governs Scalix's processing of personal data that you, as controller, submit to Scalix Cloud, and reflects Article 28 of the UK/EU GDPR and the India DPDP Act, 2023. Where it conflicts with the Terms on data processing, this DPA prevails.

1. Roles

You are the controller (or a processor acting for your own customers); Scalix is the processor (or sub-processor). Each party complies with its obligations under applicable data protection law.

2. Scope, Nature & Purpose

Scalix processes personal data only to provide Scalix Cloud (database, AI inference, functions, storage, auth, and related services) and as needed to bill, secure, and support it. Scalix does not use your personal data to train AI models. Processing continues for the term of your account.

3. Types of Data & Data Subjects

These are determined and controlled by you, based on what you choose to store or send through the service (e.g. your end users' account, usage, and application data). You must not send special-category data unless your configuration and lawful basis permit it.

4. Our Obligations (Art. 28)

- Process personal data only on your documented instructions (the Terms, this DPA, and your use of the service), unless required by law. - Ensure persons authorised to process are bound by confidentiality. - Implement appropriate technical & organisational security measures (Art. 32) — see our Security page (encryption in transit, secrets encrypted at rest, tenant isolation, access controls, query firewall, MFA). - Assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your Art. 32–36 obligations (security, breach notification, DPIAs). - Notify you without undue delay after becoming aware of a personal-data breach. - At your choice, delete or return personal data at the end of the service, and delete existing copies unless retention is legally required (residual copies in encrypted backups age out on our rolling backup schedule). - Make available the information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, in line with Art. 28(3)(h).

5. Sub-processors

You authorise Scalix to engage sub-processors. The current list — every sub-processor, what it processes, and where — is published at scalix.world/subprocessors and is incorporated into this DPA: - Hetzner Online GmbH (Germany) — EU infrastructure hosting and encrypted off-site backups - Amazon Web Services, Inc. (US/India) — authoritative DNS secondaries (DNS zone data only; no customer content) - Stripe, Inc. (USA) — payment processing (outside India); EU-US Data Privacy Framework participant - Razorpay Software Pvt Ltd (India) — payment processing (India) - Hostinger — email provider (correspondence and, pending activation of our own mail server, transactional email relay) Scalix AI inference runs on Scalix-operated infrastructure and engages no AI sub-processor. If you supply your own provider key (BYOK), your inputs go to that provider under your own terms with it, not as our sub-processor. Scalix imposes data-protection terms on each sub-processor no less protective than this DPA, and remains liable for their performance. We will give notice of any intended addition or replacement of a sub-processor; you may object on reasonable data-protection grounds within 14 days.

6. International Transfers

Where personal data is transferred outside the UK/EU, the transfer is covered by an appropriate safeguard — the EU Standard Contractual Clauses and/or the UK International Data Transfer Agreement (IDTA), or an adequacy mechanism such as the EU-US Data Privacy Framework — which are incorporated into this DPA by reference.

6A. India (DPDP Act, 2023)

For processing governed by the India DPDP Act, Scalix acts as a Data Processor for you (the Data Fiduciary) under a valid contract, processes only on your instructions, and assists with data-principal requests and breach reporting. Our Grievance Officer is on the Contact page.

7. Liability & Term

This DPA is subject to the limitations of liability in the Terms. It remains in force for as long as Scalix processes personal data on your behalf.

8. Execution

By accepting the Terms, you accept this DPA. Enterprise customers who require a counter-signed copy or their own paper may contact legal@scalix.world.