Data Processing Addendum

This page summarizes our Data Processing Addendum (DPA), which applies to business customers who use XWave to process personal data on behalf of their own users. The DPA supplements our Terms of Service and forms part of the agreement between you and XWave. This summary is for convenience only; the signed DPA is the binding document.

Where you use XWave to process personal data of your own users, you act as the data controller and XWave acts as a data processor, processing that data on your documented instructions and to provide the service.

We process personal data only as necessary to provide, maintain, secure, and support the service, and as otherwise instructed by you in writing. The subject matter, duration, nature, and purpose of processing, and the categories of data and data subjects, are described in the DPA.

We maintain appropriate technical and organizational measures designed to protect personal data, and we require our staff to keep it confidential. You can learn more on our Security page.

We may engage subprocessors to help provide the service, subject to the obligations set out in the DPA. See our Subprocessors page for the categories we use and how we notify customers of changes.

We provide reasonable assistance to help you respond to requests from data subjects exercising their rights under applicable data-protection law, taking into account the nature of the processing.

Where personal data is transferred across borders, the DPA sets out the safeguards we rely on to protect it in accordance with applicable law.

If your organization requires a signed DPA, contact us at legal@thexwave.com or through our contact pageand we'll be glad to help.