Data Processing Agreement

1. Purpose & Scope

This Data Processing Agreement ("DPA") forms part of the agreement between ApexGen Ltd ("Processor", "we") and the customer using the ApexGen platform ("Controller", "you"), and applies whenever ApexGen processes personal data on your behalf as a data processor — most commonly your lead and contact data — in the course of providing the Service described in our Terms of Service. It is intended to satisfy Article 28 of the UK/EU GDPR.

2. Subject Matter & Duration

The subject matter of processing is the personal data you upload, import, or connect to ApexGen (leads, contacts, campaign recipients, and conversation content). Processing continues for the duration of your subscription and for any post-termination retention period described in our Privacy Policy.

3. Nature & Purpose of Processing

• Storing and organizing lead/contact records you upload
• Sending campaign messages on your behalf (email, SMS, WhatsApp)
• Generating AI-drafted or AI-conducted conversations with your leads
• Scoring and qualifying leads based on conversation content
• Producing analytics and reporting about your campaigns

4. Categories of Data Subjects & Data

Data subjects: your leads, customers, and prospects, and your own team members with platform accounts.

Data categories: names, email addresses, phone numbers, company information, conversation transcripts, and any other fields you choose to import. You confirm you will not upload special category data (e.g. health, biometric, or financial account data) unless you have a separate written agreement with us covering it.

5. Processor Obligations

ApexGen agrees to:

• Process personal data only on your documented instructions, including regarding international transfers
• Ensure personnel with access to your data are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures (see our Security page)
• Not engage a sub-processor without prior notice, per Section 6 below
• Assist you in responding to data subject access requests and other rights under applicable data protection law
• Assist you in meeting security, breach-notification, and impact-assessment obligations
• Delete or return personal data at the end of the engagement, at your choice, subject to legal retention requirements
• Make available information reasonably necessary to demonstrate compliance with this DPA

6. Sub-processors

You authorize ApexGen to engage the sub-processors listed on our Subprocessors page to support the Service. We will keep that list current and provide reasonable notice before adding a new sub-processor that processes your personal data, giving you the opportunity to object on reasonable data-protection grounds.

7. International Transfers

Where personal data is transferred outside the UK or EEA, ApexGen relies on appropriate safeguards, including the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, as incorporated by reference into our sub-processor agreements.

8. Personal Data Breach Notification

ApexGen will notify you without undue delay, and in any case within 72 hours of becoming aware, of any personal data breach affecting your data, together with the information reasonably available to us to help you meet your own notification obligations.

9. Audits

On reasonable written request, no more than once per year, ApexGen will provide you with information reasonably necessary to demonstrate compliance with this DPA, including relevant security documentation, and will cooperate with audits conducted by you or an appointed auditor subject to reasonable confidentiality and scheduling arrangements.

10. Deletion & Return of Data

Upon termination of your subscription, ApexGen will delete or anonymize your personal data within 30 days, except where retention is required by law, as described in our Privacy Policy. You may export your data at any time before termination from within the app.

11. Contact

For questions about this DPA, or to request a countersigned copy for your records, contact us at apexgenteam@gmail.com.