What this addendum does
This Data Processing Addendum ("DPA") forms part of the master service agreement ("MSA") between Apex and the customer where the customer's use of Apex services involves the processing of personal data. It governs the rights and obligations of both parties under applicable data protection laws including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA / CPRA), and the Brazilian LGPD.
How to execute
Enterprise customers receive a counter-signable PDF on contract. Self-service customers are bound to the standard form below by accepting the MSA. To request a redline or to ask a specific question, email privacy@apexworldlabs.com.
Roles
Customer is the controller of customer content; Apex is the processor. Where Apex processes personal data for its own purposes (e.g., billing, account administration), Apex acts as an independent controller for that limited processing only.
Subject matter, duration, nature and purpose
- Subject matter — the processing of customer content submitted to the Aether platform for the purpose of providing the contracted services.
- Duration — for the term of the MSA and the retention period thereafter set out in the MSA or the customer's data-retention configuration, whichever is shorter.
- Nature and purpose — to provide, secure and improve the Aether platform per the MSA.
- Categories of personal data — those submitted by the customer; Apex does not require special-category data and recommends customers avoid submitting it.
- Categories of data subjects — those determined by the customer.
Processor obligations
- Process personal data only on documented instructions from the controller.
- Ensure persons authorised to process the personal data have committed themselves to confidentiality.
- Take all measures required pursuant to Article 32 GDPR.
- Assist the controller in responding to data-subject requests.
- Notify the controller without undue delay after becoming aware of a personal-data breach.
- Delete or return all personal data after the end of the provision of services, at the choice of the controller.
- Make available all information necessary to demonstrate compliance.
Sub-processors
Apex's current sub-processor list is published at apexworldlabs.com/legal/sub-processors. The customer pre-authorises Apex to engage the sub-processors listed there; Apex will provide at least 30 days' notice of any new sub-processor or change affecting data category or region.
International transfers
Where personal data is transferred from the EEA, the UK or Switzerland to a third country that does not benefit from an adequacy decision, the parties agree to incorporate Standard Contractual Clauses ('SCCs') Module 2 (controller-to-processor) as approved by the European Commission and the UK ICO addendum where applicable. The SCCs take precedence over this DPA in case of conflict.
Audit rights
Apex makes available a current SOC 2 Type II report and equivalent assurance documentation on request. Enterprise customers may request a customer-specific audit once per twelve-month period subject to reasonable notice, NDA, and not unduly disrupting Apex operations.
Liability
Each party's liability under this DPA is governed by the limitation-of-liability provisions in the MSA. Nothing in the MSA limits or excludes liability for breaches of applicable data-protection laws.
Governing law
This DPA is governed by the same law as the MSA. For data subjects in the EEA, the SCCs are governed by their stated law (Ireland by default).
Contact
For data-subject requests, breach notifications or DPA execution, write to privacy@apexworldlabs.com. For trust and compliance evidence (SOC 2 reports, etc.), write to trust@apexworldlabs.com.