CX-SignalsData Processing Addendum
Last updated: 2 November 2026 · Version: 2026-11-02
1. About this addendum
1.1 This Data Processing Addendum ("DPA") forms part of the Terms & Conditions between the customer ("Customer", "you") and CX-Signals ("we", "us"). It applies automatically when we process Customer Personal Data. You don't need to sign anything. If you would like a signed copy, email support@cx-signals.com.
1.2 If this DPA and the Terms & Conditions conflict, this DPA prevails on the processing of personal data. If you have a separate data processing agreement with us signed by both sides, that agreement prevails.
2. Definitions
Words defined in the Terms & Conditions have the same meaning here. In addition:
- "Data Protection Laws" means the laws on personal data that apply to the processing, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, Israel's Protection of Privacy Law, 1981 and its regulations, and the California Consumer Privacy Act ("CCPA").
- "Customer Personal Data" means personal data in Your Content that we process on your behalf when we provide the Service.
- "Sub-processor" means a third party we engage that may process Customer Personal Data.
- "Personal Data Breach" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- "Controller", "processor", "data subject" and "processing" have the meanings given in the GDPR. Under Israeli law, a controller is the database owner and a processor is the holder.
3. Roles and scope
3.1 You are the controller and we are your processor for Customer Personal Data. That is the personal data contained in what you put into the Service: the organizations you track and their settings, alternative names and websites, your product description, competitor and industry context, notes and ratings.
3.2 CX-Signals is built to track organizations, so Your Content normally contains little or no personal data. It may contain some, for example a contact's name in a note.
3.3 We are a controller, not your processor, for other personal data described in our Privacy Policy. That includes the account and sign-in data of your users, billing records, and information about people mentioned in the public news the Service finds. This DPA does not cover that processing. The Privacy Policy does.
3.4 Annex 1 describes the processing.
4. Your responsibilities
4.1 You are responsible for having a lawful basis for the Customer Personal Data you put into the Service, and for giving any notices and obtaining any consents the law requires.
4.2 Do not put sensitive personal data into the Service. This includes special categories of personal data under the GDPR, data of special sensitivity under Israeli law, and data about criminal offences. The Service is not built for it. As the Terms & Conditions say, do not use the Service to track individuals.
5. Our obligations as processor
5.1 Instructions. We process Customer Personal Data only on your documented instructions. Those are the Terms & Conditions, this DPA, and how you or your users set up and use the Service. If the law requires us to process it otherwise, we will tell you first, unless the law forbids that. We will tell you if we think an instruction breaks Data Protection Laws.
5.2 Confidentiality. Everyone we authorise to process Customer Personal Data is bound to keep it confidential.
5.3 Security. We maintain the technical and organisational measures described in Annex 2. We may update them, but we will not reduce the overall level of protection.
5.4 Staff access. As set out in section 10 of the Terms & Conditions, our staff look at Your Content only when you ask for help, or to keep the Service running, check the quality of results that your users rate as not useful, handle billing and payment disputes, protect security, or where the law requires it.
6. Sub-processors
6.1 You authorise us to use the sub-processors listed at cx-signals.com/subprocessors (Annex 3).
6.2 Changes. We will update that list and email the administrator of every workspace at least 30 days before we add or replace a sub-processor.
6.3 Objections. If you have a reasonable data protection objection, email support@cx-signals.com within 14 days of our notice. We will work with you in good faith to resolve it. If we cannot, you may stop using the Service before the change takes effect.
6.4 Our responsibility. Each sub-processor processes Customer Personal Data under a written agreement with data protection obligations that are no less protective than this DPA. We remain responsible to you for our sub-processors' performance of those obligations.
6.5 Our search provider. Our web search sub-processor, Exa, states that on its standard plans it uses anonymised data to improve its models. By design, the search queries we send are built from organization names, industry terms and general topic words, not from Customer Personal Data. We also send it public website addresses: those of the organizations you track, and the one you enter when describing your product. We do not send it your users' names, email addresses or account details, or your product description.
7. Requests from individuals
7.1 If we receive a request from an individual about Customer Personal Data, we will pass it to you, and will not answer it ourselves unless you ask us to.
7.2 Your workspace administrator can view, correct, export and delete Your Content in the Service. Where you need more help to respond to a request, we will help as far as we reasonably can.
8. Personal Data Breaches
8.1 We will tell you without undue delay, and where feasible within 48 hours, after becoming aware of a Personal Data Breach affecting your Customer Personal Data. We will not wait for our investigation to finish before giving the first notice.
8.2 Our notice will describe, as far as we know at the time: what happened; the categories and approximate number of individuals and records concerned; the likely consequences; and what we have done or propose to do. We will send further information as it becomes available.
8.3 We will take reasonable steps to contain the breach and reduce its effects, and help you meet your own obligations to notify regulators and individuals.
8.4 We send notices to the email address of your workspace administrator. Our notice is not an admission of fault.
9. Assessments and consultations
Where you need to carry out a data protection impact assessment or consult a regulator about the Service, we will give you reasonable help using the information available to us.
10. Deletion and return
10.1 Your workspace administrator can export Your Content at any time from the Service.
10.2 When the workspace is deleted, it becomes read-only for 7 days, so the deletion can be cancelled. It is then erased automatically, within 30 days of the deletion request at the latest. Copies in our backups are removed within 7 days after that, as the backups expire, and any copies in our service providers' system logs within 90 days.
10.3 On request, we will confirm in writing that the deletion has been completed.
10.4 We keep data after deletion only where the law requires us to. That data stays protected by this DPA for as long as we keep it.
11. Information and audits
11.1 Once a year, on request, we will answer a reasonable security questionnaire and give you the information needed to show that we comply with this DPA.
11.2 An on-site audit is available only where a regulator or the law requires it, or after a Personal Data Breach that affected your Customer Personal Data. You must give at least 30 days' written notice. The audit takes place during business hours, at your cost, under confidentiality terms, and without disrupting the Service. It may not be carried out by our competitors.
11.3 If you are a business under the CCPA, these rights also let you take reasonable steps to check that we use Customer Personal Data in line with the CCPA.
12. International transfers
12.1 We are based in Israel. The European Commission has recognised Israel as providing an adequate level of protection for personal data, and so has the United Kingdom.
12.2 Our sub-processors process data in other countries, mainly the United States, Singapore (our database) and the European Union (Annex 3). Where a sub-processor is in a country without an adequacy recognition, the transfer is protected by the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss changes where relevant) in that sub-processor's terms, or by the EU-US Data Privacy Framework where the sub-processor is certified.
12.3 Fallback. If a transfer of Customer Personal Data from you to us is not covered by an adequacy recognition, or if that recognition is withdrawn, the Standard Contractual Clauses, Module Two (controller to processor), adopted by Commission Implementing Decision (EU) 2021/914, are incorporated into this DPA. They apply as follows:
- (a) you are the data exporter and we are the data importer;
- (b) clause 7 (docking clause) applies;
- (c) clause 9: option 2 (general authorisation), with the notice period in section 6.2;
- (d) clause 11: the optional wording does not apply;
- (e) clause 13: the supervisory authority is that of your EU establishment, or of your EU representative, or Ireland if neither applies;
- (f) clauses 17 and 18: the law and courts of Ireland;
- (g) Annex I is Annex 1 of this DPA, Annex II is Annex 2, and Annex III is the list in Annex 3.
For UK data, the UK International Data Transfer Addendum (version B1.0) applies together with them. For Swiss data, they apply with the references changed to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner.
13. Israel
13.1 For Customer Personal Data subject to Israeli law, this DPA is our agreement under regulation 15 of the Protection of Privacy (Data Security) Regulations, 2017:
- (a) the data we may process, and the purposes: Annex 1;
- (b) the systems we may access: the CX-Signals application and its database, hosted by the sub-processors in Annex 3;
- (c) the types of processing: Annex 1;
- (d) duration and deletion: for as long as you use the Service, and then as in section 10, including a written confirmation of deletion on request;
- (e) security: Annex 2, plus any reasonable additional security instructions you give us in writing that we agree to;
- (f) personnel: confidentiality (section 5.2), use only as this DPA allows, and the security measures in Annex 2;
- (g) sub-processors are bound by obligations no less protective (section 6.4);
- (h) reporting: once a year, on request, we will send you a written confirmation of our compliance with this DPA, and we will notify you of any security incident affecting your Customer Personal Data (section 8).
14. California (CCPA)
14.1 Where the CCPA applies, we act as your service provider. We will:
- (a) not sell or share Customer Personal Data;
- (b) process it only for the business purpose of providing the Service to you, as described in Annex 1, and not retain, use or disclose it for any other purpose, including any other commercial purpose;
- (c) not use it outside our direct business relationship with you, or combine it with personal data we receive from others, except as the CCPA permits;
- (d) comply with the CCPA and give it the same level of protection the CCPA requires of you;
- (e) tell you if we can no longer meet our obligations under the CCPA; and
- (f) help you respond to consumer requests, as in section 7.
14.2 You may take reasonable steps to stop and fix any unauthorised use of Customer Personal Data.
15. Liability
Each side's liability under this DPA is subject to the limitations and exclusions of liability in the Terms & Conditions. This does not limit any rights that individuals have directly under Data Protection Laws.
16. Duration and changes
16.1 This DPA applies for as long as we process Customer Personal Data for you.
16.2 We may update this DPA in the same way as the Terms & Conditions (section 19 of the Terms): by posting the updated DPA, updating its date and emailing workspace administrators, with the right to stop using the Service if you do not accept the change.
Annex 1: Details of the processing
| Subject matter and purpose | Providing the CX-Signals service: searching public sources for developments at the organizations the Customer tracks, and producing signals, summaries, talking points, digests and alerts for the Customer's users |
| Nature of processing | Collection (as entered by the Customer), storage, organisation, use in searches and AI analysis, display, transmission by email to the Customer's users, export, and deletion |
| Categories of data subjects | People whose personal data the Customer puts into the Service: incidentally, for example contacts named in notes or in the product description |
| Categories of personal data | Names and other details of such people as they appear in Your Content. Normally little or none |
| Sensitive data | None. The Customer must not enter it (section 4.2) |
| Frequency | Continuous, for as long as the Customer uses the Service |
| Duration and retention | For as long as the Customer uses the Service; then as in section 10. Content about an organization is deleted when the Customer removes the organization from the Service |
| Sub-processors | Annex 3 |
Annex 2: Security measures
Access and identity
- Users sign in with one-time codes sent by email, through our sign-in provider. We store no user passwords.
- Every request to our application is checked: we verify the sign-in token's signature, algorithm and issuing application, and limit each request to the user's own workspace.
- Database-level access is denied by default on every table; only our application's server, with a separate key, can read or write data.
- Our staff console uses separate sign-in with two-factor authentication, refuses access on any error, and records every change our staff make in an audit log.
- Access to production systems is limited to the people who need it.
- An invitation link carries a random token that we store only as a one-way hash. An invitation adds a person to a workspace only after they sign in with the invited email address, verified by our sign-in provider.
Data protection in transit and at rest
- All traffic to the website, application and API uses HTTPS (TLS).
- Data in our database is encrypted at rest (AES-256) by our database provider.
Data minimisation
- We send our search provider only search queries (built from organization names, industry terms and general topic words) and public website addresses (tracked organizations' websites, and the website the Customer enters when describing its product). We never send users' identities or the Customer's product description.
- We do not keep the text of news articles, only our own summary and the link. Short excerpts from discarded search results are deleted after 30 days.
- Our error monitoring is set not to collect users' IP addresses or identities.
Application security
- Text from web pages is neutralised before it reaches the AI model, to resist instructions hidden in web pages.
- Requests to websites entered by customers pass a guard that blocks internal network addresses.
- Dependencies are checked for known vulnerabilities, and we carry out periodic security reviews.
Resilience and recovery
- Daily database backups, each kept for 7 days.
- Each workspace's billing ledger cannot be edited or deleted, and an hourly check detects inconsistencies.
- Our database is monitored: if it stops answering for 10 minutes, we are alerted automatically by email.
Incidents
- A written security-incident procedure covers containing the incident, assessing it, notifying customers and authorities, and keeping a record of every incident. Breaches are notified as in section 8.
Annex 3: Sub-processors
The current list, with each sub-processor's purpose, the data it processes and its location, is at cx-signals.com/subprocessors.