Data Processing Addendum

1. About this Addendum#

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between you (the “Customer”) and Pushix (“we”, “Pushix”). It applies whenever we process personal data contained in Customer Data on your behalf (“Customer Personal Data”) — mainly data about the subscribers of your apps and websites. You accept it when you accept the Terms; no signature is needed. If you need a signed copy for your records, email us at info@pushix.in.

“Data Protection Law” means all laws on personal data that apply to the processing, including India’s Information Technology Act, 2000 and its rules, the Digital Personal Data Protection Act, 2023 and its rules (the “DPDP Act”) as they come into force, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection. Terms such as “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the GDPR; under the DPDP Act, “controller” corresponds to “data fiduciary” and “processor” to “data processor”. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

2. Roles of the parties#

You are the controller (or, if you act for your own clients, a processor) of Customer Personal Data, and we are your processor (or sub-processor). For personal data about our own customers’ accounts, we are an independent controller, as described in our Privacy Policy.

3. Details of the processing#

Subject matter

Providing the Pushix push-notification and in-app messaging service under the Terms.

Duration

For as long as we provide the Service to you, and until the data is deleted under section 13.

Nature and purpose

Registering devices and browsers, storing subscriber records and tags, building audiences and segments, sending notifications and in-app messages (immediately, on a schedule, through automations and A/B tests), recording deliveries, opens and clicks, producing statistics and exports, and providing support — all on your instructions.

Data subjects

Users of your apps and visitors to your websites who subscribe to notifications or whom your app or website registers; and anyone whose personal data you include in notifications, templates or tags.

Categories of data

Device push tokens or browser push endpoints and keys; platform, language, time zone, app version, device model, operating system and SDK version; country if your app sends it; external user IDs and tags you set; purchase totals and badge counts if you send them; session counts and times, first and last activity and active days; notification opens and button clicks; and the content of your notifications and messages.

Sensitive data

None is intended. You must not send special categories of personal data or other sensitive data to the Service (see the Acceptable Use Policy).

Frequency

Continuous, while the Service is used.

4. Processing only on your instructions#

We process Customer Personal Data only on your documented instructions, which are: the Terms and this DPA; your settings and actions in the dashboard; and your calls to our API and the behaviour of our SDKs as you configure them. We will not sell it, use it for our own purposes, or combine it with data from other customers. If we believe an instruction breaks Data Protection Law, we will tell you, and we may decline to follow it. If the law requires us to process Customer Personal Data in another way, we will tell you before we do, unless the law forbids it.

5. Your obligations#

You are responsible for the lawfulness of the processing you instruct, including: having a valid legal basis (such as consent) for each subscriber; giving subscribers the notices the law requires, including that you use a service provider for notifications; honouring their choices and requests; ensuring that the data you send us is accurate and limited to what you need; and not sending us data we have asked you not to send. You are responsible for the delivery credentials you upload and for your own agreements with Google and Apple.

6. Confidentiality#

We give access to Customer Personal Data only to people who need it to provide, support or secure the Service, and who are bound by a duty of confidentiality.

7. Security measures#

We maintain technical and organisational measures appropriate to the risk, which currently include:

• Access control: role-based access within organizations (owner, admin, member); separate API keys per app, which can be replaced at any time; email confirmation for new accounts; sessions that expire and can be signed out remotely.
• Authentication security: passwords stored as salted bcrypt hashes; session tokens stored only as hashes; anti-forgery tokens on changes; limits on repeated sign-in attempts and email requests.
• Encryption: Firebase service-account keys, web push private keys and other secrets encrypted at rest with AES-256-GCM; connections to the Service protected with HTTPS; web push content encrypted end to end (RFC 8291).
• Separation: each customer’s data is tied to its organization and apps, and every request is checked against them.
• Data minimisation: subscriber IP addresses are not stored in the database; daily activity records are deleted after about 13 months; no advertising identifiers or location are collected.
• Accountability and resilience: an audit log of important account actions; regular database backups kept for up to 30 days; prompt application of security updates to the software we run.

We may improve these measures over time, but we will not reduce the overall level of protection.

8. Sub-processors#

You give us general authorisation to use the sub-processors below. We impose data protection obligations on them that are no less protective than this DPA, and we remain responsible for their performance.

Notifications to Android and iOS are sent through your Firebase project with your credentials, so your own agreement with Google also applies to that processing. Details of our hosting provider, including where the servers are located, are available on request.

We will announce any new or replacement sub-processor on this page and by email to organization owners at least 14 days before it starts processing Customer Personal Data. You may object on reasonable data protection grounds within that period. We will then work with you in good faith to find a solution; if we cannot, you may stop using the affected part of the Service or terminate it, and we will refund any prepaid fees for the remaining period.

9. International transfers#

We are based in India, and our sub-processors may process data in other countries, including the United States. Where Data Protection Law restricts the transfer:

• From the EEA: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference — Module 2 where you are a controller and Module 3 where you are a processor — with you as data exporter and us as data importer. For those clauses: the optional docking clause does not apply; under clause 9(a), option 2 (general written authorisation) applies with the notice period in section 8; the optional wording in clause 11 does not apply; clauses 17 and 18 refer to the law and courts of the EU Member State where you are established, or Ireland if that law does not allow for third-party beneficiary rights; Annex I is completed by section 3 and the details of the parties in the Terms; Annex II by section 7; and Annex III by section 8.
• From the UK: the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner applies, with its tables completed using the information in this DPA.
• From Switzerland: the Standard Contractual Clauses apply with the changes needed for the Swiss Federal Act on Data Protection, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.
• From India: we will follow any restriction the Government of India notifies under section 16 of the DPDP Act.

If the Standard Contractual Clauses conflict with this DPA, the clauses prevail.

10. Helping you respond to individuals#

The dashboard and API let you find a subscriber by subscriber ID or external user ID, view and change their tags, export subscriber data as CSV, and delete a subscriber with all their tags. If you need more help to answer a request from a data subject, we will assist you, taking into account the nature of the processing. If a data subject contacts us directly about Customer Personal Data, we will pass the request to you (where we can identify you) and will not respond to it ourselves except to direct them to you, unless the law requires otherwise.

11. Personal data breaches#

We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will tell you, as far as we know them, the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, and the measures taken or proposed — adding information as it becomes available. We will take reasonable steps to contain the breach and limit its effects, and will help you meet your own obligations, such as notifying a supervisory authority or the Data Protection Board of India and informing the people affected. We will also report cyber security incidents to CERT-In as Indian law requires. Notifying you is not an admission of fault.

12. Impact assessments and consultations#

We will give you reasonable information and help, taking into account the nature of the processing and the information available to us, so that you can carry out data protection impact assessments and any prior consultation with a supervisory authority that the law requires.

13. Deletion and return of data#

You can export Customer Personal Data as CSV and delete it in the dashboard at any time: individual subscribers, whole apps with everything recorded for them, or — on request — your whole organization. Deleted data is removed from our live systems at once and from backups within 30 days. When the Service ends for you, we will delete the remaining Customer Personal Data in the same way, after giving you the chance to export it as described in the Terms, unless the law requires us to keep part of it. Any data we must keep stays protected under this DPA and is used only for the purpose for which it was kept.

14. Information and audits#

We will make available the information you reasonably need to show compliance with Article 28 of the GDPR and similar laws, including by answering reasonable security questionnaires once a year. If that is not enough, or a supervisory authority requires it, you may audit our compliance — yourself or through an independent auditor bound by confidentiality — with at least 30 days’ written notice, during business hours, at your own cost, no more than once in 12 months (unless after a personal data breach), and in a way that does not disrupt the Service or expose other customers’ data.

15. Requests from authorities#

If a court or government authority asks us for Customer Personal Data, we will try to direct it to you. If we must disclose the data, we will tell you first so you can seek protection — unless the law forbids us — and disclose only what we are legally required to.

16. Liability#

Each party’s liability under this DPA is subject to the limits in the Terms of Service, except where Data Protection Law does not allow liability to be limited, and without limiting the rights of data subjects under the Standard Contractual Clauses.

17. Duration and changes#

This DPA applies as long as we process Customer Personal Data for you. We may update it to reflect changes in the law or in the Service, and will announce material changes as described in the Terms. We will not change it in a way that reduces the protection of Customer Personal Data, except where the law requires.

18. Contact#

For questions about this DPA or about how we process Customer Personal Data, email us at info@pushix.in. For complaints, contact our Grievance Officer, Sanjit Karmakar, at sanjit@pushix.in.

Last updated 30 October 2026.