Data Processing Agreement

When a business uses Jex to collect information from its customers, the business decides what to collect and why, and we process it on the business's behalf. This agreement sets out how we do that, so businesses subject to the EU or UK GDPR, Swiss law, Canada's PIPEDA, Australia's Privacy Act and similar laws can use Jex. It forms part of our Terms of Service and applies automatically, with no signature needed. If you want a countersigned copy, email [email protected].

1. Roles and scope

"You" means the business that holds a Jex account (the Account Holder). "We" means Mojo Systems LLC. For personal data that you or your visitors put into Jex ("Customer Personal Data"), such as responses to your forms, Smart Link visits, contracts, invoices and payment status, you are the controller and we are your processor (or service provider, under US state laws). For data about you as our customer, such as your account and billing details, we are a controller, and our Privacy Policy applies. Words such as "personal data," "processing," "controller," "processor" and "data subject" have the meanings given in the GDPR.

2. Processing only on your instructions

We process Customer Personal Data only to provide the Services, as described in our Terms, and as you direct through your settings and use of Jex, including any AI connections you approve. Those are your documented instructions. We will not sell Customer Personal Data, use it for our own marketing, or use it to train AI models. If we believe an instruction breaks data protection law, we will tell you. If a law requires us to process the data in another way, we will tell you first unless that law forbids it.

You are responsible for having a lawful basis to collect what your forms ask for, for the notices you give your visitors, and for following the email and messaging laws where your customers live. Jex helps by asking visitors outside the US to opt in before automatic follow-up emails. You must not use Jex to collect health information or other special categories of data, as our Terms prohibit.

3. Confidentiality and security

Everyone at Mojo Systems who can access Customer Personal Data is bound by confidentiality. We maintain the technical and organizational measures in Annex 2, appropriate to the risk, and we may update them as long as protection does not decrease.

4. Subprocessors

You authorize us to use the subprocessors listed in our Privacy Policy. Each is bound by written terms that protect the data at least as well as this agreement. We stay responsible to you for their work. We will update that list at least 30 days before a new subprocessor starts handling Customer Personal Data, and notify Account Holders by email. If you object on reasonable data protection grounds, tell us within that period. We will work with you on a solution, and if there isn't one, you may cancel the affected Services and get a refund of any prepaid fees for the remaining period.

5. Helping with people's requests

Jex lets you view, export, correct and delete responses, and stop emails to a person. If someone asks us directly to access, correct, delete or restrict their data, or objects to its use, we will send them to you and won't answer for you unless you ask us to. Where the tools aren't enough, we will reasonably help you meet your obligations, including with data protection impact assessments and consultations with a supervisory authority.

6. Personal data breaches

If we become aware of a breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, we will notify you without undue delay, and within 48 hours. We will tell you what we know, what we are doing about it, and how to reach us, and keep you updated as we learn more, so you can meet any 72-hour duty you have to notify a regulator.

7. International transfers

We store and process Customer Personal Data in the United States. Where the EU GDPR applies to a transfer to us, the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor), are incorporated into this agreement by reference. You are the data exporter and we are the data importer. Clause 7 (docking) applies, the optional wording in Clause 11 does not, Clause 9 option 2 (general authorization, with the notice period in section 4) applies, Clauses 17 and 18 use the law and courts of Ireland, and Annexes 1 and 2 below complete Annexes I and II. For transfers from the UK, the UK International Data Transfer Addendum (version B1.0) applies alongside those clauses. For Switzerland, the same clauses apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority. If a regulator or court invalidates a transfer mechanism, we will work with you on a lawful alternative.

8. Return and deletion

You can export your data at any time while your account is open, and during the grace period after you cancel. After that, we delete Customer Personal Data from our active systems, and from backups within ninety (90) days, unless a law requires us to keep it. Signed contracts, paid-invoice receipts and their signing records are the exception: on your instruction in our Terms, we keep them for seven (7) years from signing so that you and your customer can each prove what was agreed, use them only for that and for legal claims, and then delete them.

9. Information and audits

On written request, we will give you the information reasonably needed to show we comply with this agreement, including answers to security questionnaires once a year. If that isn't enough, or a regulator requires it, you may audit our compliance once a year at your own cost, with 30 days' notice, during business hours, and under confidentiality terms.

10. General

This agreement lasts as long as we process Customer Personal Data for you. If it conflicts with the Terms, this agreement wins for personal data. If it conflicts with the Standard Contractual Clauses, the clauses win. The limitation of liability in the Terms applies to this agreement, except where a law or the clauses don't allow it.

Annex 1: Details of processing

• Parties. Data exporter: the Account Holder (controller), with the contact details on its Jex account. Data importer: Mojo Systems LLC (processor), 1319 N Franklin St, Philadelphia, PA 19122, United States, [email protected].
• Data subjects. The Account Holder's visitors, prospects and customers: people who scan or tap a Smart Link, fill in a form or poll, sign a contract or pay an invoice. Also the Account Holder's own staff and teammates.
• Categories of data. Contact details (name, email, phone, company, address), answers to form questions, Smart Link visit details (time, approximate location, device), contract details and signatures (including a passkey confirmation or drawn signature), payment status and amounts (card details stay with Stripe), notes, follow-up emails, and email opt-outs.
• Special categories. None. The Terms prohibit collecting them.
• Frequency. Continuous, for as long as the account is open.
• Nature and purpose. Hosting, storing, organizing and displaying responses. Sending notifications and follow-ups the Account Holder sets up. Preparing contracts and invoices and taking payments through the Account Holder's own Stripe account. Syncing to CRMs the Account Holder connects. AI features the Account Holder chooses to use.
• Retention. As in section 8.
• Subprocessors. As listed in the Privacy Policy, for the purposes and locations shown there.
• Competent supervisory authority. The authority of the EU member state where the Account Holder is established, or where its representative is located. Otherwise, Ireland's Data Protection Commission.

Annex 2: Security measures

• Encryption in transit (TLS) for all traffic, and passwords stored only as salted hashes.
• Each Account Holder's leads are kept in a separate database.
• Least-privilege access for staff. Administrator access needs a second factor that expires after 12 hours.
• Session limits for sign-ins, bot checks on public forms, and rate limits on sensitive actions.
• Error reports are scrubbed of personal data before they leave our servers.
• Routine backups, with deletion from backups within 90 days of account closure.
• Dependencies are kept up to date and checked for known vulnerabilities, and code changes are reviewed and tested before release.
• Payment card data never touches our servers, because Stripe handles it.