TVIXEL DATA PROCESSING AGREEMENT (DPA)

Version 2.0 — Last updated: 08-12-2025

Between:

The Customer (“Data Controller”)
and
Tvixel ApS, CVR 45665151, Gyvelhøjvej 7, Søballe, 8660 Skanderborg, Denmark
(“Data Processor”)

This Data Processing Agreement (“Agreement” or “DPA”) forms an integrated and legally binding part of the Main Agreement (the “Terms and conditions”) between the parties.

1. Purpose, Scope and Duration

1.1
The purpose of this Agreement is to ensure compliance with Article 28 of Regulation (EU) 2016/679 (“GDPR”) and to govern Tvixel’s processing of personal data on behalf of the Data Controller.

1.2
Tvixel processes personal data solely for the purpose of delivering, maintaining, securing, and improving the Tvixel customer communication platform (“Service”), including related support, analytics, diagnostics, and operational activities.

1.3
Processing under this Agreement begins when the Data Controller starts using the Service and remains in force until Tvixel no longer processes personal data on behalf of the Data Controller.

2. Nature and Purpose of Processing

2.1
The processing activities include, but are not limited to:

Receipt, routing and storage of customer messages
Synchronisation with email, live chat, contact forms, and messaging channels (Like Messenger, Instagram, WhatsApp, if used)
Outgoing communication via email and notifications
Logging for security, auditing, diagnostics, and operational stability
Data backup, redundancy and disaster recovery
User management and authentication
Technical support requested by the Data Controller

2.2
Tvixel shall not process personal data for any independent purpose or commercial interest.
Tvixel does not sell, share, profile, or use personal data for marketing or advertising.

3. Categories of Data Subjects

The following categories of data subjects may be processed under this Agreement:

End users/customers contacting the Data Controller via Tvixel
Employees, agents, and authorised users of the Data Controller
Visitors using live chat tools embedded by the Data Controller
Individuals whose data appears in inbound or outbound communication

4. Categories of Personal Data

Processing may include the following categories of personal data:

4.1. Standard personal data:

Name
Email address
Phone number (if provided)
Message content (text)
Attachments (images, documents, screenshots)
Conversation metadata (timestamps, channels, identifiers)
IP addresses and device/browser information
User access logs

4.2. Sensitive data (GDPR Article 9)

The Data Controller shall not process special categories of personal data via Tvixel unless appropriate legal grounds and safeguards are established.

Tvixel does not provide processing environments designed for confidential health data, biometric data, political opinions, etc.

4.3. Criminal offence data

Content containing criminal offence information (including child abuse material, threats, illegal activities) is strictly prohibited.
Such material will be reported to relevant authorities.

5. Obligations of the Data Processor (Tvixel)

Tvixel shall:

5.1
Process personal data only on documented instructions from the Data Controller, including through configuration and use of the Service.

5.2
Ensure that all employees, contractors, and personnel authorised to process personal data are subject to confidentiality obligations.

5.3
Take all measures required pursuant to Article 32 GDPR (security of processing).

5.4
Assist the Data Controller with fulfilling its obligations regarding:

Data subject rights (access, rectification, erasure, objection)
Data breach notifications
Impact assessments (DPIA)
Prior consultations with supervisory authorities

5.5
Maintain a secure and resilient infrastructure ensuring availability, integrity, and confidentiality of data.

5.6
Not engage another sub-processor without complying with the conditions in Section 8.

5.7
Notify the Data Controller immediately if Tvixel becomes aware of any instruction that violates GDPR.

6. Obligations of the Data Controller

The Data Controller is responsible for:

6.1
Ensuring a lawful basis for all processing carried out through Tvixel.

6.2
Ensuring that personal data entered into the Service is collected and processed in compliance with applicable law.

6.3
Implementing its own organisational and access control measures, including secure user account management.

6.4
Ensuring that end users are informed of the processing activities performed through Tvixel.

6.5
Configuring the Service according to its own compliance requirements.

7. Security Measures

Tvixel shall implement and maintain comprehensive technical and organisational security measures, including:

7.1. Technical security

All data in transit is encrypted (TLS 1.2+).
Infrastructure firewalls, network isolation, and access restrictions.
Zero trust access for internal systems.
Strong authentication and role-based access control.
Continuous monitoring and intrusion detection.
Regular vulnerability scanning and patch management.

7.2. Organisational security

Confidentiality agreements for all personnel.
Secure development practices (SDLC).
Regular security training for employees.
Documented backup and disaster recovery plans.
Logging and audit trails throughout the Service.

7.3. Hosting environment

All infrastructure is located exclusively within the EU and hosted by:

Hetzner Online GmbH
Industriestr. 25, 91710 Gunzenhausen, Germany
(Primary hosting and data center provider)

No data is transferred outside the EU/EØS.

8. Sub-processors

Tvixel is authorised to use the following EU-based sub-processors:

Sub-Processor	Location	Purpose
Hetzner Online GmbH	Germany	Hosting, compute, networking, storage
G-Core Labs S.A.	Luxembourg (EU)	DNS, CDN, security and WAF
Heysender ApS	Denmark	Outbound e-mail delivery
InMobile ApS (if enabled)	Denmark	SMS sending services
Mistral AI (EU infrastructure)	France/EU	AI processing strictly within EU boundaries

8.1
The Data Processor shall notify the Data Controller in advance of any intended changes to sub-processors.

8.2
Tvixel shall ensure that the same data protection obligations set out in this Agreement are imposed on sub-processors via written contract.

8.3
Tvixel remains fully liable for the actions and omissions of all sub-processors.

9. International Data Transfers

9.1
Tvixel performs no international transfers outside the EU/EØS.

9.2
If the Data Controller activates integrations (e.g., communication channels) that process data through third countries, such processing is performed strictly under the Data Controller’s own responsibility and instructions.

10. Data Subject Requests

10.1
Tvixel shall assist the Data Controller in responding to requests from data subjects regarding:

Access
Rectification
Erasure
Restriction
Objection
Data portability

10.2
Requests received directly by Tvixel will be forwarded to the Data Controller without undue delay.

11. Personal Data Breach Notification

11.1
In the event of a personal data breach, Tvixel shall notify the Data Controller without undue delay and provide:

A description of the breach
Categories and approximate numbers of affected subjects and records
Likely consequences
Measures taken or proposed to address the breach

11.2
Tvixel shall document all security incidents for audit purposes.

12. Audit and Inspection

12.1
The Data Controller may, upon reasonable notice, conduct audits or inspections.

12.2
Audits shall be limited to what is strictly necessary to verify compliance.

12.3
Tvixel may invoice the Data Controller for significant resource consumption arising from extensive audits, except where Tvixel is found non-compliant.

13. Data Retention and Deletion

13.1
Upon termination of the Main Agreement, the Data Controller may request export of personal data.

13.2
Tvixel shall delete all personal data processed on behalf of the Data Controller no later than 90 days after termination, unless EU law requires longer retention.

13.3
Deletion shall include backups after their normal rotation cycles.

13.4
Upon request, Tvixel shall provide written confirmation of deletion.

14. Liability and Indemnification

14.1
Tvixel’s liability under this Agreement is limited to the liability limits defined in the Main Agreement.

14.2
Nothing in this Agreement limits liability for intentional misconduct or gross negligence.

15. Governing Law and Jurisdiction

15.1
This Agreement is governed by Danish law.

15.2
Any disputes shall be settled before the Court of Horsens (Retten i Horsens) as the court of first instance.