When this applies. This DPA covers Personal Data in Customer Data (CRM and related app content). It does not cover Account Data, billing identity or marketing-site analytics for which Saleslox acts as an independent controller under the Privacy Policy.
Version: 1.0
Effective date: 24 September 2026
Last updated: 24 September 2026
Processor: Saleslox LLC of Bennett St, Jersey City, NJ 07304, United States (“Saleslox”)
Contact: [email protected]
1. Parties, roles and incorporation
1.1 The “Customer” is the organisation that holds a Saleslox subscription or trial. The Customer is the controller/business/responsible party for Customer Personal Data. Saleslox is the processor/service provider/operator for that data.
1.2 This DPA forms part of the Customer’s Order, online checkout acceptance, trial registration or signed Customer Agreement. If documents conflict on processing of Customer Personal Data, this DPA controls for that subject unless a signed Customer Agreement expressly states otherwise.
1.3 Individual end-user acceptance of the EULA does not create conflicting controller instructions that override the Customer.
2. Definitions
Terms mirror the EULA where used there. “Customer Personal Data” means Personal Data within Customer Data. “Applicable Data Protection Law” includes GDPR, UK GDPR, Australian Privacy Act, CCPA/CPRA and similar laws that apply to the processing.
3. Scope of processing
| Item | Description |
|---|---|
| Subject matter | Hosted Saleslox CRM and licensed apps (timesheet, expense), authentication into the Customer workspace, storage, workflows, audit, support, notifications and Customer-enabled integrations |
| Duration | Subscription/trial term plus export, deletion, backup rotation and legally required retention |
| Nature and purpose | Host, store, retrieve, transmit, back up, secure, support and delete Customer Personal Data to provide the Services on Customer instructions |
| Data subjects | Customer workforce and contractors; Customer’s own customers, prospects, suppliers and other people whose data the Customer chooses to submit |
| Categories of data | Identity and contact details; company and commercial records; pipeline, quote, order and invoice data; support tickets; activities; timesheet/expense fields; custom fields; uploaded logos/attachments the Customer adds |
| Special categories | Only if the Customer lawfully submits them; not required for standard CRM use |
4. Customer instructions
4.1 Documented instructions are: this DPA; the Order/Customer Agreement; Customer configuration in the product; and support requests that do not expand the purpose.
4.2 The Customer warrants instructions are lawful and that notices/legal bases exist for data it submits. Saleslox will inform the Customer if it believes an instruction infringes Applicable Data Protection Law (unless legally prohibited) and may pause the affected processing while the parties resolve it.
4.3 Saleslox will not process Customer Personal Data for its own advertising or for unrelated commercial profiling.
5. Confidentiality and personnel
Persons authorised to process Customer Personal Data are bound by confidentiality and receive appropriate privacy and security training. Access follows least privilege.
6. Security measures
Saleslox maintains measures appropriate to risk, including:
- logical tenant isolation with PostgreSQL row-level security (FORCE RLS on org-scoped tables)
- role-based application permissions and audited mutations
- encryption in transit (TLS); encryption of selected secrets at rest
- argon2id password hashing; rotating refresh tokens; idle session timeout
- CSRF/origin checks, rate limiting, threat-event logging
- private Redis for rate-limit/job keys only (not session storage)
- backup, recovery and incident-response processes
- secure development, dependency scanning and vulnerability management in the release gate
Saleslox may update measures without materially reducing overall protection. Independent certifications are stated only when actually obtained.
7. Personal Data Breach
After becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data, Saleslox will notify the Customer without undue delay, supply available details in phases, and assist the Customer’s notification duties. The Customer remains responsible for notices to individuals and regulators as controller unless law requires Saleslox to notify directly.
8. Subprocessors
8.1 The Customer gives general written authorisation for the subprocessors below and their replacements under this section.
| Name | Service | Location (primary) |
|---|---|---|
| Amazon Web Services, Inc. | Compute, RDS PostgreSQL, object storage / CloudFront for consoles, Secrets Manager | United States (us-east-1) |
| Cloudflare, Inc. | Marketing site hosting/CDN, DNS, Turnstile | Global edge; customer content not stored as CRM data |
| PayFast (Pty) Ltd (payments processor; legal entity name to be confirmed) | Payment processing for Saleslox subscription fees (Account/billing data; not CRM record content) | South Africa |
| Transactional email via Saleslox SMTP mailbox (mail.saleslox.com) | Delivery of product email that may include Customer-configured recipient addresses and message content | As configured for the mailbox host |
8.2 Customer-enabled SSO identity providers and other Customer-chosen integrations are not Saleslox subprocessors; the Customer is responsible for those transfers.
8.3 Saleslox will impose written data-protection obligations no less protective in material effect, remain responsible for subprocessor performance as required by law, and give at least 30 days’ prior notice of a new subprocessor where required. The Customer may object on reasonable data-protection grounds within 15 days; the parties will seek a reasonable alternative, failing which the Customer may terminate the materially affected Service per the Customer Agreement.
9. Assistance with data-subject requests
Taking account of the nature of processing, Saleslox will provide reasonable technical and organisational assistance so the Customer can respond to applicable requests. If Saleslox receives a request about Customer Personal Data, it will forward it to the Customer where lawful and will not respond substantively except on Customer instruction or legal requirement.
10. DPIAs and regulators
Saleslox will provide information reasonably necessary for the Customer’s DPIA or prior consultation concerning the Services. Bespoke consulting beyond standard documentation may be chargeable.
11. Demonstrating compliance and audits
Saleslox will make available information reasonably necessary to demonstrate compliance (security documentation, questionnaires, and independent reports when available). If insufficient for a specific legal requirement, the Customer may conduct one audit per year on reasonable notice, during business hours, under confidentiality, without accessing another customer’s data. Additional audits may follow a material breach or regulator request. No audit right requires source-code disclosure, unsafe testing or production disruption.
12. Return and deletion
On termination or written instruction, Saleslox will make Customer Personal Data available via standard export features and then delete or de-identify it in line with the Privacy Policy retention rules, except where law requires retention. Soft-deleted records follow the product recycle window (~30 days) before purge. Backups rotate out on the normal schedule.
13. International transfers
Where a restricted transfer requires a safeguarding mechanism, the parties incorporate the applicable 2021 EU Standard Contractual Clauses (processor module) and/or UK Addendum/IDTA, completed using this DPA’s annex details and current security documentation. Conflicting SCC/IDTA terms prevail for the restricted transfer only.
14. US state “service provider” terms
Where CCPA/CPRA or similar US state law applies, Saleslox will: process Customer Personal Information only for the limited business purposes of providing the Services; not sell or share it for cross-context behavioural advertising; not retain, use or disclose it outside the direct business relationship except as permitted for a service provider/contractor; provide the level of privacy protection required of the Customer; notify the Customer if it determines it can no longer meet those obligations; and allow reasonable monitoring and remediation required by law.
15. Liability and order of precedence
Liability arising from this DPA is subject to the limitations in the EULA or Customer Agreement, except where Applicable Data Protection Law forbids limitation. Mandatory data-protection obligations are not waived.
16. Contact
Questions about this DPA: [email protected]
Related: Privacy Policy · EULA · Terms of Sale