Effective Date: November 07, 2025
This DPA is incorporated into and forms part of the agreement between Metrix Zenith X Artificial Intelligence ( “MZX AI”, “Processor”, “Service Provider”) and [Customer legal name] (“Customer”, “Controller”, “Business”) that governs Customer’s use of MZX AI Services (the “Agreement”). If there is a conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA controls.
Capitalized terms not defined here have the meanings in the Agreement.
2.1 Roles. For Customer Content, Customer is the Controller/Business and MZX AI is the Processor/Service Provider.
2.2 Instructions. MZX AI will Process Personal Data only (a) to provide the Services; (b) per the Agreement and this DPA; and (c) per Customer’s written, documented instructions, including configurations made in the Services. MZX AI will notify Customer if an instruction violates Applicable Privacy Laws.
2.3 No Sale/No Sharing. Under CPRA and similar laws, MZX AI does not sell or share Personal Data; it receives Personal Data solely to perform the Services for Customer.
2.4 No Training by Default. MZX AI will not use Customer Content or Personal Data to train foundation models or general-purpose AI except where Customer explicitly opts in in a signed order or DPA addendum.
2.5 No-Training Subprocessors (LLM APIs). MZX AI will engage LLM/API Subprocessors only where (a) the Subprocessor’s publicly available privacy policy and/or terms state that API inputs/outputs are not used to train or improve its foundation models; and (b) MZX AI’s contract with such Subprocessor prohibits the Subprocessor from using Customer Content or Personal Data for model training or improvement. MZX AI will flow down these no-training restrictions to all such Subprocessors and will not enable any provider feature that permits retention for training unless Customer expressly opts in in a signed order or addendum.
MZX AI will ensure personnel authorized to Process Personal Data are bound by confidentiality obligations and receive appropriate privacy/security training.
4.1 Measures. MZX AI will implement and maintain appropriate technical and organizational measures (“TOMs”) designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, considering the state of the art, costs, and nature, scope, context, and purposes of Processing. Core TOMs are summarized in Annex II (Security Measures).
4.2 Customer Responsibilities. Customer is responsible for (a) its Users’ access controls; (b) secure submission of Customer Content; (c) configurations Customer selects (e.g., deletion schedules, approved regions); and (d) notifying MZX AI of special categories or high-risk data if permitted under the Agreement.
5.1 Authorization. Customer authorizes MZX AI to use Subprocessors reasonably necessary to provide the Services (e.g., cloud hosting, email delivery, ticketing, optional model APIs). The current Subprocessors are identified in MZX AI’s “Subprocessor List” (as updated from time to time), which is incorporated by reference into this DPA.
5.2 Engagement. MZX AI will: (a) impose written obligations on Subprocessors that are no less protective than this DPA; and (b) remain responsible for Subprocessors’ performance.
5.3 Changes. MZX AI will provide advance notice of changes to Subprocessors by updating the Subprocessor List (and, where contractually agreed, via email alert). Customer may object on reasonable privacy grounds within 10 days. If the parties cannot resolve the objection, Customer may terminate the impacted Services (without penalty) and receive a pro-rata refund of prepaid unused fees.
5.4 LLM/API Subprocessors. For LLM/API Subprocessors, the no-training commitment in §2.5 applies in addition to the obligations in this §5.
6.1 Transfers. Where MZX AI transfers Personal Data outside the EEA/UK/Switzerland, it will ensure a valid transfer mechanism (e.g., EU SCCs, UK Addendum/IDTA, Swiss Addendum) as set out in Annex I.
6.2 Supplementary Measures. Where appropriate, MZX AI will implement supplementary measures (organizational, contractual, technical) to ensure essentially equivalent protection.
7.1 Individual Rights. Taking into account the nature of Processing, MZX AI will reasonably assist Customer by appropriate technical and organizational measures, insofar as possible, to fulfill requests to exercise data subject rights (access, rectification, deletion, restriction, portability, objection). If MZX AI receives a request directly, it will promptly forward it to Customer (unless legally prohibited).
7.2 DPIAs & Consultation. MZX AI will provide reasonable assistance to Customer with data protection impact assessments and consultations with supervisory authorities to the extent required by Applicable Privacy Laws and related to the Services.
7.3 Records. MZX AI will maintain records of Processing as required by Applicable Privacy Laws and make them available upon reasonable request.
8.1 Notification. If MZX AI becomes aware of a Personal Data Breach affecting Customer Personal Data, MZX AI will notify Customer without undue delay (and, where feasible, within 72 hours) after becoming aware, providing available information to assist Customer in meeting its breach notification obligations.
8.2 Remediation & Cooperation. MZX AI will take reasonable steps to mitigate the effects and cooperate with Customer to investigate and remediate. Notifications are not an acknowledgment of fault.
9.1 Documentation. Upon request, MZX AI will make available information reasonably necessary to demonstrate compliance with this DPA (e.g., security summaries, policies, third-party assessment summaries where available).
9.2 Audits. Where required by Applicable Privacy Laws, Customer (or an independent auditor it appoints) may audit MZX AI’s compliance no more than once per 12 months, on 30 days’ prior written notice, during normal business hours, in a manner that does not unreasonably disrupt operations, and subject to confidentiality and facility/IT security policies. Remote reviews of documentation are preferred; onsite activities (if any) are narrowly scoped and at Customer’s expense.
9.3 Confidentiality. Audit results are Confidential Information.
Upon termination or expiry of the Agreement, MZX AI will, upon written request and subject to legal retention requirements, either return or delete Personal Data in its systems. Standard backup media will be overwritten per normal cycles. If Customer requires a specific deletion certificate, MZX AI will provide a confirmation upon completion.
Default retention (unless configured otherwise or required by law):
We may retain de-identified or aggregated data for longer.
Where legally permitted, MZX AI will promptly notify Customer of any binding request for disclosure of Personal Data by a public authority and will challenge unlawful equests. MZX AI will disclose only the minimum necessary to comply with applicable law.
To the extent state privacy laws apply, MZX AI will:
(a) not sell or share Personal Data;
(b) not retain, use, or disclose Personal Data for any purpose other than performing the Services or as permitted by law/this DPA;
(c) not combine Personal Data with data received from other sources except to detect security incidents, protect against fraudulent or illegal activity, or to the extent permitted for aggregated/de-identified analytics not identifiable to a consumer or household;
(d) assist Customer in responding to verifiable consumer requests; and
(e) flow down equivalent obligations to Subprocessors.
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. If there is a conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA prevails. Nothing in this DPA limits either party’s responsibilities under Applicable Privacy Laws.
This DPA becomes effective on the Effective Date or the date the parties otherwise agree to be bound. Electronic acceptance or signature is permitted. This DPA terminates automatically upon termination of the Agreement.
Module 2 (Controller → Processor) applies where Customer (data exporter) transfers Personal Data to MZX AI (data importer) in a non-adequate country. The parties agree the EU Commission Implementing Decision (EU) 2021/914 SCCs are incorporated by reference with the following selections:
Annex I.A – Parties
Annex I.B – Description of Transfer
Annex I.C – Competent Supervisory Authority: Determined per Clause 13.
For transfers subject to UK GDPR, the parties incorporate the UK Addendum to the EU SCCs (version issued by the ICO) with the EU SCCs above, with:
For transfers subject to the Swiss FADP, the EU SCCs apply with: references to GDPR read as FADP; “Member State” read as “Switzerland”; the FDPIC as the competent authority; and the governing law/forum adapted accordingly.
MZX AI maintains commercially reasonable TOMs including:
Governance & Access Control
Infrastructure & Network Security
Encryption
Monitoring, Logging, and Alerting
Application Security
Data Management
Business Continuity & DR
Incident Response
Personnel & Training
Vendor & Subprocessor Management
Signatures
By signing below (or accepting the Agreement referencing this DPA), the parties agree to this DPA, including Annexes.
Customer (Controller/Business)
Name:__________________________
Title: ___________________________
Date:___________________________
MZX AI (Processor/Service Provider)
Name:__________________________
Title: ___________________________
Date:___________________________
