Faximus Data Processing Addendum

Version: 2026.10.27-r2

This Data Processing Addendum (DPA) is part of the agreement between Faximus LLC, a South Carolina limited liability company (Faximus), and the Customer identified in the applicable order, account, or services agreement (Customer).

The DPA applies when Faximus processes Personal Data for Customer in providing the Services. It becomes effective when Customer accepts or signs an agreement that incorporates it.

1. Definitions

In this DPA:

• Applicable Data Protection Law means a law governing the privacy, security, or processing of Personal Data that applies to a party's processing under the Agreement. It may include the GDPR, UK GDPR, Swiss Federal Act on Data Protection, California Consumer Privacy Act as amended by the CPRA, and other U.S. state privacy laws.
• Controller means the party that determines the purposes and means of processing Personal Data. It includes a business under the CCPA and comparable terms under other laws.
• Customer Personal Data means Personal Data that Faximus processes for Customer as a processor in connection with the Services. It does not include information Faximus processes as an independent controller for its own billing, security, legal compliance, or direct relationship with Customer personnel.
• Data Subject means the individual to whom Personal Data relates. It includes a consumer under U.S. state privacy laws.
• GDPR means Regulation (EU) 2016/679.
• Personal Data means information relating to an identified or identifiable individual and includes personal information or personal data under Applicable Data Protection Law.
• Process or processing has the meaning given by Applicable Data Protection Law and includes collecting, storing, using, transmitting, disclosing, and deleting data.
• Processor means a party that processes Personal Data for a Controller. It includes a service provider or contractor under the CCPA and comparable terms under other laws.
• Security Incident means a confirmed breach of security that results in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in Faximus's possession or control. It does not include unsuccessful attempts that do not compromise data, such as blocked scans, pings, login attempts, or denial-of-service attempts.
• Subprocessor means a third party engaged by Faximus to process Customer Personal Data for Customer.
• UK GDPR means the GDPR as incorporated into United Kingdom law.

Terms such as supervisory authority, special categories of data, sell, share, and targeted advertising have the meanings given by Applicable Data Protection Law.

2. Scope and roles

2.1 Customer as Controller

Customer is the Controller of Customer Personal Data, unless Customer acts as a Processor for another Controller. Customer determines the purpose of the fax or workflow, selects the data, recipients, retention, users, and integrations, and gives Faximus instructions through the Agreement and use of the Services.

2.2 Faximus as Processor

Faximus is a Processor of Customer Personal Data when it receives, renders, stores, routes, transmits, retrieves, or otherwise processes that data to provide the Services at Customer's direction.

If Customer is a Processor, Faximus acts as Customer's Subprocessor and Customer represents that it is authorized to appoint Faximus and give the instructions in the Agreement.

2.3 Independent processing

Faximus is an independent Controller for account contacts, billing, fraud prevention, platform security, legal compliance, service management, and business communications, as described in the Privacy and Cookie Policy. This DPA does not change that role.

For a Consumer account, this DPA applies only when Faximus processes Customer Personal Data on Customer's documented behalf. It does not govern information Faximus processes as an independent Controller to form or manage the direct consumer relationship, collect payment, manage renewal or cancellation, secure the platform, or comply with law. The Privacy and Cookie Policy governs that independent processing.

2.4 PHI

A Business Associate Agreement, not this DPA alone, governs PHI. If the BAA and this DPA conflict about PHI, the BAA controls.

3. Processing details

The subject matter, duration, nature, purpose, data categories, and data subjects are described in Annex 1. Customer may give additional lawful instructions through supported settings, API requests, support requests, and signed orders.

4. Customer instructions and responsibilities

4.1 Documented instructions

Faximus will process Customer Personal Data only:

• to provide, maintain, secure, and support the Services;
• according to the Agreement and Customer's supported configuration;
• to comply with Customer's documented lawful instructions; or
• as required by law.

If law requires processing outside Customer's instructions, Faximus will notify Customer before processing unless law prohibits notice.

4.2 Unlawful instructions

Faximus will promptly inform Customer if, in Faximus's reasonable opinion, an instruction violates Applicable Data Protection Law. Faximus may suspend the affected processing until the parties resolve the issue. Faximus is not required to provide legal advice or independently investigate Customer's legal basis.

4.3 Customer responsibilities

Customer represents and warrants that:

• it has a lawful basis for the processing and each fax transmission;
• it has given required notices and obtained required consents or authorizations;
• its instructions comply with law and do not violate another person's rights;
• Customer Personal Data is relevant and limited to what is reasonably necessary;
• its users, credentials, endpoints, recipients, and integrations are appropriately authorized and secured; and
• it will not submit data prohibited by the Agreement.

Customer is responsible for responding to Data Subjects and regulators about Customer's purposes and decisions.

5. Processing restrictions

Faximus will not:

• sell Customer Personal Data;
• share it for cross-context behavioral advertising;
• process it for targeted advertising;
• use it to build or enrich a profile for an independent commercial purpose;
• use fax content to train a general-purpose AI model without Customer's express written permission;
• retain, use, or disclose it outside the business purposes in the Agreement, except as permitted or required by law; or
• combine it with personal data received from another person or from Faximus's own consumer interactions, except as permitted by Applicable Data Protection Law to provide, secure, and improve the Services for Customer.

Faximus certifies that it understands these restrictions and will comply with them.

6. Confidentiality and personnel

Faximus will ensure that people authorized to process Customer Personal Data:

• are bound by confidentiality obligations;
• access data only as needed for their duties; and
• are subject to appropriate discipline for violations.

Faximus will limit access using role-based access controls appropriate to the system and risk, with administrative access to production systems limited to a small number of named staff.

7. Security

7.1 Security program

Faximus will maintain appropriate administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Customer Personal Data. The safeguards will take account of the state of the art, implementation cost, nature and scope of processing, and risk to individuals.

The current baseline measures are described in Annex 2.

7.2 Changes to safeguards

Faximus may update safeguards as technology and risks change, provided that the overall level of protection is not materially reduced during a paid order term.

7.3 Customer security duties

Customer must configure the Services appropriately, protect credentials and endpoints, control users, verify recipients, use supported encryption, and maintain its own security program. Faximus is not responsible for a Security Incident caused by Customer's systems or instructions, but will cooperate as required by this DPA.

8. Security Incidents

8.1 Notice

Faximus will notify Customer without undue delay after confirming a Security Incident affecting Customer Personal Data and, where reasonably possible, within 72 hours after confirmation. Notice to Customer is not an admission of fault or liability.

Faximus may provide notice in phases as information becomes available. The notice will include, to the extent known:

• the nature and approximate time of the incident;
• the categories of affected data and Data Subjects;
• the likely consequences;
• containment, investigation, and remediation steps; and
• a contact for follow-up.

8.2 Response and cooperation

Faximus will take reasonable steps to contain, investigate, mitigate, and remediate the Security Incident. Faximus will provide information reasonably needed for Customer to meet its notification and risk-assessment obligations, subject to security, privilege, confidentiality, and legal restrictions.

8.3 Notification decisions

Customer is responsible for deciding whether to notify Data Subjects, regulators, customers, or others, unless law directly requires Faximus to notify them or the parties agree otherwise. Faximus will not notify Customer's Data Subjects on Customer's behalf without authorization, except where law requires direct notice.

9. Data Subject requests

9.1 Requests received by Faximus

If Faximus receives a request from a Data Subject concerning Customer Personal Data, Faximus will, where legally permitted, direct the person to Customer and notify Customer. Faximus will not independently fulfill the request unless Customer instructs it or law requires it.

9.2 Assistance

Taking into account the nature of processing, Faximus will provide reasonable technical and organizational assistance through available product features or support so Customer can respond to access, correction, deletion, portability, restriction, objection, opt-out, appeal, and similar requests.

Faximus may charge reasonable fees for assistance that is unusually burdensome, outside standard features, or caused by Customer's failure to use available tools, unless law prohibits the charge.

10. Compliance assistance

Taking into account the nature of processing and information available to Faximus, Faximus will provide reasonable assistance with:

• data-protection impact assessments;
• prior consultation with a supervisory authority;
• security and breach-risk assessments;
• records of processing and vendor questionnaires; and
• information reasonably needed to demonstrate compliance with processor obligations.

Customer remains responsible for its own assessment, filing, and legal conclusions.

11. Subprocessors

11.1 General authorization

Customer gives Faximus general authorization to use Subprocessors to provide the Services. The current categories and known Subprocessors are listed in Annex 3. The public list at faximus.io/legal/subprocessors controls for operational updates made under this section.

11.2 Subprocessor obligations

Where a Subprocessor offers a data-processing agreement or equivalent written terms, Faximus will enter into it; where it offers only its standard terms, Faximus relies on those terms and applies the technical and organizational controls described in this DPA. Faximus remains responsible to Customer for the Subprocessor's performance of those duties to the extent required by law and the Agreement.

11.3 Notice of new Subprocessors

Faximus will provide at least 30 days' advance notice before authorizing a new Subprocessor to process Customer Personal Data, where practicable. Notice may be posted on a subprocessor page with email notice to a subscribed contact.

A shorter period may apply when an urgent replacement is needed for security, continuity, law, or a provider failure. In that case, Faximus will provide notice as soon as reasonably practical.

11.4 Objection

Customer may object within 15 days after notice, on reasonable documented grounds relating to data protection. The parties will work in good faith on a commercially reasonable solution. If none is available, Faximus may choose not to use the Subprocessor for Customer, allow Customer to discontinue the affected feature, or terminate the affected Service and refund prepaid fees for its unused portion. This is Customer's contractual remedy for the objection, without limiting a remedy that applicable law does not allow the parties to waive.

12. International transfers

12.1 General

Customer authorizes processing in the United States and other locations where authorized Subprocessors operate, subject to this DPA and Applicable Data Protection Law.

12.2 EEA transfers

If Customer Personal Data protected by the GDPR is transferred to Faximus in a country that is not recognized as adequate, the parties incorporate the European Commission Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (EU SCCs):

• Module 2 applies when Customer is a Controller and Faximus is a Processor;
• Module 3 applies when Customer is a Processor and Faximus is a Subprocessor;
• Clause 7, the docking clause, applies;
• in Clause 9, Option 2 applies and the notice period is the period in Section 11;
• the optional language in Clause 11 does not apply;
• in Clause 17, Option 1 applies and the governing law is the law of Ireland, unless the parties select another eligible EU member-state law in an order form;
• under Clause 18, the courts of Ireland have jurisdiction, unless the parties select another eligible member state in an order form; and
• Annexes 1 through 3 of this DPA supply the information for the corresponding SCC annexes.

If the EU SCCs conflict with this DPA, the EU SCCs control for the restricted transfer.

12.3 UK transfers

For a restricted transfer governed by the UK GDPR, the parties incorporate the then-current UK International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner's Office (UK Addendum). The parties and transfer details are those in the Agreement and Annexes 1 through 3. The EU SCCs as completed above are the Approved EU SCCs. Either party may end the UK Addendum as permitted by its mandatory clauses if the UK transfer mechanism changes.

12.4 Switzerland

For transfers governed by Swiss law, references in the EU SCCs to the GDPR include the Swiss Federal Act on Data Protection where applicable; references to EU or member-state law include Swiss law; the competent authority is the Swiss Federal Data Protection and Information Commissioner where required; and Data Subjects in Switzerland may enforce applicable rights in Switzerland.

12.5 Transfer assessments and supplementary measures

The parties will reasonably cooperate on a transfer risk assessment or data-protection test. Faximus will provide information about relevant technical and organizational measures, government-request practices, and Subprocessors, subject to confidentiality and security restrictions.

Faximus will use reasonable efforts to challenge an unlawful or disproportionate government request and will notify Customer when legally permitted.

13. Return, export, and deletion

13.1 During the term

Customer may access or export Customer Personal Data using available product features, subject to plan limits and the Agreement.

13.2 At termination

At Customer's choice and subject to the Agreement, Faximus will delete or return available Customer Personal Data after termination. Unless a different period applies, Customer should request export within 30 days after termination.

Faximus applies the Data Retention and Deletion Schedule and Customer's configured retention to live copies and works to delete them when the applicable period ends; deletion timing may vary. Copies in backups will be isolated from ordinary use and expire on the normal backup rotation.

13.3 Required retention

Faximus may retain limited data when law, legal process, a legal hold, fraud prevention, security, billing, or the establishment, exercise, or defense of legal claims requires it. This DPA continues to apply to retained Customer Personal Data, and Faximus will not use it for another purpose.

14. Audit and information rights

14.1 Standard information

On reasonable request and subject to confidentiality, Faximus will provide available information reasonably sufficient to demonstrate compliance with this DPA. This may include a security overview, relevant policies, and questionnaire responses, any penetration-test summary or third-party report Faximus has, and Subprocessor information.

14.2 Additional audit

If the standard information is not reasonably sufficient, Customer may request an additional audit no more than once per year, unless required by a regulator or following a Security Incident affecting Customer Personal Data.

The parties will agree on scope, timing, confidentiality, and method. The audit must:

• be performed by an independent qualified auditor;
• avoid access to another customer's data or sensitive system details;
• avoid disruption, vulnerability creation, or penetration testing without written permission;
• occur during normal business hours; and
• comply with Faximus security requirements.

Customer will pay its audit costs and Faximus's reasonable costs for a Customer-specific audit, unless the audit identifies a material uncured breach by Faximus.

14.3 Regulatory audit

Nothing in this section limits a supervisory authority's lawful powers.

15. U.S. state privacy terms

To the extent a U.S. state privacy law applies to Customer Personal Data and recognizes service providers, contractors, or processors:

• Faximus acts as Customer's service provider, contractor, or Processor;
• the specific business purposes are providing, securing, supporting, metering, and maintaining the Services;
• Faximus will not sell or share Customer Personal Data or use it for targeted advertising;
• Faximus will not retain, use, or disclose it outside the direct business relationship or specified business purposes, except as permitted by law;
• Faximus will not combine it with personal information from another source except as permitted to provide the Services;
• Faximus will provide the same level of privacy protection required of the applicable role;
• Faximus will notify Customer if it determines it can no longer meet an applicable obligation;
• Customer may take reasonable steps to stop and remediate unauthorized use; and
• Faximus will assist with verified consumer requests, security obligations, and legally required assessments as described in this DPA.

Customer may monitor Faximus's compliance through the audit process above.

16. Government and legal requests

Unless prohibited, Faximus will notify Customer before disclosing Customer Personal Data in response to a government or third-party legal demand. Faximus will review the demand for facial validity, seek clarification or narrowing when appropriate, and disclose only information reasonably required.

Faximus may disclose without advance notice in an emergency involving imminent risk of serious harm, but will notify Customer later when permitted.

17. Records and accountability

Each party will maintain records required for its role. Faximus will cooperate with a competent supervisory authority and make required processor records available to that authority as required by law.

18. Term and termination

This DPA remains effective while Faximus processes Customer Personal Data. A material breach of this DPA is a material breach of the Agreement. If a breach is curable, the non-breaching party will ordinarily give a reasonable opportunity to cure before termination, unless law or urgent risk requires faster action.

Sections that must continue to protect retained data survive termination.

19. Liability and priority

The liability limits and exclusions in the Terms of Service or negotiated agreement apply to this DPA, except to the extent Applicable Data Protection Law or the EU SCCs do not allow them.

If this DPA conflicts with the Agreement about processing Customer Personal Data, this DPA controls. The EU SCCs or UK Addendum control over this DPA for the restricted transfer where required.

20. Contact

Privacy and DPA notices: privacy@faximus.io
Security incidents: security@faximus.io
Legal notices: legal@faximus.io

Annex 1 - Processing Details

A. Parties

Data exporter / Customer: The Customer identified in the Agreement, including its address and contact details in the account or order form. Customer is a Controller or Processor as described in Section 2.

Data importer / Faximus: Faximus LLC, Spartanburg County, South Carolina, United States. Privacy contact: privacy@faximus.io. Faximus is a Processor or Subprocessor.

B. Subject matter and purpose

Faximus processes Customer Personal Data to provide cloud fax transmission, receipt, document handling, storage, inbox, API, webhook, email, number, support, security, compliance, and related services selected by Customer.

C. Duration

Processing continues for the term of the Agreement and the retention or deletion period that follows it.

D. Nature and frequency

Processing may include collecting, uploading, receiving, rendering, converting, organizing, storing, retrieving, viewing, transmitting, routing, disclosing to Customer-selected recipients, logging, securing, backing up, supporting, exporting, and deleting data. Processing occurs continuously or whenever Customer or a sender uses the Services.

E. Categories of Data Subjects

Depending on Customer's use, Data Subjects may include:

• Customer administrators, users, employees, contractors, patients, clients, customers, members, vendors, and business contacts;
• fax senders and recipients;
• individuals named or described in fax documents;
• healthcare patients, insured members, caregivers, and providers;
• applicants, employees, beneficiaries, students, consumers, and other individuals whose data Customer lawfully processes; and
• people who submit opt-outs, support requests, or abuse reports.

F. Categories of Personal Data

Depending on Customer's use:

• names, contact details, addresses, telephone and fax numbers, email addresses, identifiers, and signatures;
• account, user, role, authentication, and audit data;
• fax documents, attachments, cover sheets, notes, and Customer metadata;
• transmission, carrier, recipient, page, status, attempt, timing, and error metadata;
• API, webhook, device, network, and security data;
• billing, subscription, tax, and transaction data; and
• any other Personal Data Customer lawfully submits within supported fields.

G. Sensitive data

Customer Personal Data may include health information and other sensitive or special-category data if the Agreement permits it. PHI requires a signed BAA and HIPAA-enabled account. Customer must not submit prohibited data and must apply additional safeguards appropriate to the risk.

H. Processing operations and retention

Operations are described above. Retention follows Customer configuration, the Agreement, and the Data Retention and Deletion Schedule.

I. Supervisory authority

The competent supervisory authority is determined under Clause 13 of the EU SCCs based on the data exporter and applicable law.

Annex 2 - Technical and Organizational Measures

Faximus maintains measures appropriate to the relevant system, environment, plan, and risk, including:

1. Governance

• assigned responsibility for security, privacy, and incident response;
• documented security and data-lifecycle requirements;
• workforce confidentiality obligations;
• change management and separation of production access from ordinary development access; and
• Subprocessor list maintained and reviewed when providers change.

2. Access control

• unique identities and role-based authorization;
• administrative access to production systems limited to a small number of named staff;
• optional authenticator-app (TOTP) two-step verification available for portal user accounts;
• prompt removal of access that is no longer needed, and replacement of credentials that are exposed or suspected to be exposed; and
• segregation of Customer and operator access paths.

3. Encryption and secrets

• TLS for the web portal and API, and for other connections where supported;
• encryption at rest for stored fax documents and production databases, using cloud key-management capabilities;
• secrets stored in managed secret-storage systems rather than source code; and
• short-lived or scoped access mechanisms where practical.

4. Application and infrastructure security

• environment and account separation;
• network controls and restricted administrative access;
• secure software-development, code review, testing, and controlled deployment practices;
• dependency, patch, and configuration management; and
• malware and file-handling controls appropriate to the Service.

5. Logging and monitoring

• application, job-lifecycle, and operational logging;
• monitoring and alerting for service health;
• controls designed to avoid PHI or document content in ordinary logs; and
• protected log access and retention under the retention schedule.

6. Availability and recovery

• backups appropriate to the production data store;
• recovery procedures, with restore testing appropriate to service maturity and risk;
• queued processing and retry mechanisms for supported workflows; and
• incident escalation and emergency-access procedures.

7. Data lifecycle

• plan and account-based retention controls where supported;
• deletion or lifecycle rules for live document storage;
• backup rotation and restricted use of residual copies;
• export tools or assisted export where available; and
• legal-hold and preservation procedures.

8. Physical security

Production infrastructure is hosted in professional cloud data centers operated by authorized providers. Faximus relies on those providers' physical and environmental controls and restricts its workforce from direct physical access to production hardware.

Annex 3 - Authorized Subprocessors

The following are authorized categories and known providers. The current list maintained in Faximus's legal or trust materials controls for operational updates made under Section 11.

A payment processor may act as an independent Controller for some payment and fraud data under its own legal obligations.

Annex 4 - UK Addendum Table Information

For the UK Addendum:

• Start date: the effective date of this DPA for the relevant transfer.
• Parties: Customer is the exporter and Faximus is the importer, with details in Annex 1.
• Approved EU SCCs: the EU SCCs completed under Section 12.2.
• Appendix information: Annexes 1 through 3 of this DPA.
• Ending the Addendum: either party may exercise the termination right in the mandatory clauses if the approved mechanism changes.
• Importer contact: privacy@faximus.io.