Data Processing Addendum

Last updated 11 November 2026

1. Scope and roles

This addendum applies to personal data that your business ("the Customer") puts into or collects through the hosted Social-Nexus service, such as contacts, WhatsApp conversations, lead form answers, email subscribers and outreach prospects ("Customer Personal Data"). For that data the Customer is the Data Fiduciary (controller) and Radixile Technology Solutions LLP is the Data Processor, as those terms are used in India's Digital Personal Data Protection Act, 2023 and, where it applies, the GDPR.

2. What is processed

3. The Customer's responsibilities

• Have a lawful basis, and where required consent, for the data you put in and the messages you send, and give people the notices the law requires.
• Honour opt-outs and requests from the people whose data you hold. Social-Nexus helps: replies of STOP stop WhatsApp messages, and unsubscribes stop emails.
• Give your team only the roles they need, and remove people who leave.

4. Our commitments

• We process Customer Personal Data only on the Customer's documented instructions, which are given through the settings and actions in Social-Nexus and these terms, and not for our own purposes. We do not sell it or use it to train AI models.
• Everyone at Radixile who can access it is bound by confidentiality and only accesses it to run or support the service.
• We help the Customer answer requests from individuals (access, correction, deletion) and with security and breach duties, as far as the service allows.
• We tell the Customer if we believe an instruction breaks the law.

5. Security

• Encryption in transit (HTTPS) and encryption of saved logins, access tokens, AI keys and mail passwords in the database.
• Separation of each business's data, and role-based access within a business.
• Password hashing, slowing down of repeated wrong passwords, and email confirmation of new accounts.
• Regular backups and restricted administrative access to production systems.

6. Sub-processors

The Customer authorises us to use these sub-processors:

Platforms and providers the Customer chooses to connect (Meta, LinkedIn, X, Pinterest, Bluesky, Google, the Customer's AI provider and mail server) receive data on the Customer's instruction under the Customer's own agreements with them. We will give at least 30 days' notice by email before adding or replacing a sub-processor; the Customer may object and, if we cannot resolve it, cancel with a pro-rata refund.

7. Transfers outside India

Some sub-processors or connected platforms may process data outside India. We only transfer data to countries not restricted by the Government of India and use providers with appropriate safeguards.

8. Personal data breaches

We will notify the Customer without undue delay, and within 72 hours, after becoming aware of a breach affecting Customer Personal Data, with what we know and what we are doing about it, and keep the Customer updated. We will help the Customer inform the Data Protection Board of India and affected people where required.

9. Return and deletion

The Customer can export its data from the app at any time. After the account is closed we delete Customer Personal Data within 30 days, and from backups within a further 35 days, unless the law requires us to keep it.

10. Information and audits

On reasonable request we provide the information needed to show compliance with this addendum, such as answers to security questionnaires. Any audit is at the Customer's cost, with 30 days' notice, during business hours and under confidentiality.

11. Contact