Data Processing Addendum

1. Definitions

“Applicable Data Protection Law” means privacy and data-protection law applicable to the processing, including GDPR where applicable. “Customer Personal Data” means personal data contained in Customer Content that Cadvex actually receives and processes on the Customer’s behalf. “Controller”, “processor”, “personal data”, “processing” and “data subject” have the meanings given by applicable law.

2. Roles and scope

For Customer Personal Data submitted to Cadvex Cloud or voluntarily provided to Cadvex for support, the Customer is the controller or equivalent business and Cadvex is the processor/service provider to the extent Cadvex processes that data on the Customer’s behalf.

Cadvex Desktop manufacturing content stays solely on the Customer’s device and is outside this processor scope, because Cadvex never receives or processes it. Cadvex may separately act as controller for account, licensing, device-security, billing and direct-business-relationship data described in the Privacy Policy.

Cadvex will process Customer Personal Data only on documented instructions contained in the agreement, this DPA and the Customer’s lawful use of the Service, unless law requires otherwise. The Customer is responsible for the lawfulness of its instructions, notices, legal bases, data accuracy and rights to submit Customer Personal Data.

3. Processing details

Subject matter

Providing Cadvex Cloud file analysis, optional drawing extraction, quotations, collaboration, storage, support, security and related service functions.

Duration

For the term of the Customer agreement and the retention/deletion periods stated in the agreement and Privacy Policy.

Nature and purpose

Collection, hosting, organization, retrieval, transmission, analysis, extraction, display, deletion, support, security and incident response for Customer Personal Data actually received by Cadvex.

Data subjects

Customer users, administrators, business contacts, suppliers, Customer customers and persons identified in submitted technical/commercial records.

Data categories

Names, business contact information, account identifiers, and personal data incidentally contained in Cloud drawings, RFQs, quotes and correspondence.

Sensitive data

Not intended. Customers must not submit prohibited regulated/sensitive data contrary to the Acceptable Use Policy.

4. Confidentiality and personnel

Cadvex will ensure that persons authorized to process Customer Personal Data are subject to confidentiality obligations and receive access only where reasonably necessary for their functions.

5. Security

Cadvex will implement appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, implementation cost, processing nature and risk. Measures may include provider-supported encryption, access controls, tenant authorization, authentication, restricted privileged credentials, private storage, logging, backup/recovery, vulnerability management and incident response.

6. Subprocessors

The Customer gives general authorization for Cadvex to use the subprocessors listed in the Subprocessor List. Cadvex will impose data-protection obligations appropriate to the services they perform. Where required by law or a written Customer agreement, Cadvex will provide notice of a new subprocessor and permit reasonable data-protection objections.

7. International transfers

Where Customer Personal Data protected by GDPR is transferred to a country without an adequacy decision, Cadvex will use a lawful transfer mechanism, which may include the European Commission Standard Contractual Clauses and supplementary measures where appropriate. To the extent required, applicable SCC modules are incorporated by reference and the parties will complete required annex information based on the actual processing and provider locations.

8. Data-subject requests

Taking into account the nature of processing, Cadvex will provide reasonable assistance to help the Customer respond to privacy-rights requests. Cadvex may direct a requester to the Customer where Cadvex processes the relevant data solely on the Customer’s behalf.

9. Security incidents

Cadvex will notify the Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Personal Data and will provide information reasonably available to support the Customer’s legal obligations. Notification is not an admission of fault.

10. Assessments and compliance assistance

Taking into account the nature of processing and information available to Cadvex, Cadvex will provide reasonable assistance with security, breach notification, data-protection impact assessments and regulator consultations where required. Additional work beyond ordinary Service support may be subject to reasonable fees.

11. Information and audits

Cadvex will make information reasonably necessary to demonstrate compliance available through documentation, policies, questionnaires and provider reports. Where that information is insufficient and law requires an audit, the Customer may request a reasonable audit no more than once per year, subject to confidentiality, security, scope and cost controls. Audits must not compromise another customer’s data, Cadvex security, source code, licensing/security mechanisms or third-party confidentiality.

12. Return and deletion

At termination and on Customer instruction, Cadvex will delete or return Customer Personal Data held by Cadvex in accordance with the agreement and Privacy Policy unless law requires retention. Residual copies may remain temporarily in backups until normal rotation. Cadvex cannot return or delete Desktop manufacturing content that never left the Customer’s local device; the Customer controls that local content and its backups.

13. Conflict and liability

If this DPA conflicts with the Terms regarding processing of Customer Personal Data, this DPA controls for that processing. Liability under this DPA is subject to the limitations/exclusions in the Terms except where applicable law prohibits limitation.

14. Governing law

This DPA is governed by the governing-law and jurisdiction provisions of the Terms except where SCCs or mandatory data-protection law require otherwise.