Customer records and marketing
Creating and maintaining profiles, segments, consent or suppression status, forms, pages, campaigns, engagement history, attribution, and related workflows.
Legal · Data processing
Clear responsibilities for data processed in Agorix.
The Agorix DPA is designed to define how customer data is processed across customer records, events, learning, meetings, marketing, commerce, workflows, and AI-assisted operations.
Roles
In most customer workspaces, the customer acts as the controller or business for personal data it uploads, collects, or directs Agorix to process. Agorix acts as a processor or service provider for that processing.
Agorix may act independently for limited account administration, billing, security, legal compliance, and service analytics where it determines the purposes and means of processing. The binding DPA and Privacy Notice should define those roles precisely for relevant jurisdictions.
Customer instructions
Agorix processes customer personal data to provide the service according to the customer's documented instructions, including configuration and authorized product use, and as otherwise permitted or required by the agreement or law.
The customer is responsible for the legality of its instructions, the information it collects, the notices and rights it provides, and its configuration of users, integrations, workflows, campaigns, and AI features.
If Agorix believes an instruction violates applicable data-protection law, the DPA should define how the parties communicate, pause affected processing, and resolve the issue.
Processing details
The DPA should include a completed processing schedule covering:
- Subject matter and duration: Providing the Agorix service for the subscription term and any agreed return, transition, or deletion period.
- Nature and purpose: Hosting, organizing, transmitting, analyzing, securing, supporting, and executing customer-configured operations.
- Data subjects: Customer users, prospects, contacts, attendees, learners, buyers, clients, members, event participants, and other individuals whose information the customer processes.
- Data categories: Contact and account data; form responses; event registration and attendance; course content and progress; meeting details and notes; marketing engagement and consent; orders, payments, and entitlements; workflow activity; Knowledge Base content; AI instructions and output; device, log, support, and diagnostic information.
- Sensitive data: [State supported and prohibited categories, safeguards, and any required written authorization.]
- Frequency: Continuous or as initiated and configured by the customer.
Product processing areas
Events, courses, and meetings
Managing registration, attendance, participation, learning content and progress, bookings, meeting details, notes, follow-up, and customer-configured delivery.
Commerce
Managing offers, orders, payment status, invoices, access, entitlements, refunds, subscription events, and related fulfillment. Payment providers may process card data under their own terms.
Workflows and AI features
Using customer-selected triggers, rules, context, instructions, and actions to automate or prepare work. AI features may draft, summarize, classify, recommend, analyze, configure, or route work.
Security, diagnostics, support, and billing
Authenticating users, managing access, logging activity, preventing abuse, monitoring reliability, troubleshooting, providing support, and administering the customer relationship.
Confidentiality and personnel
Agorix personnel authorized to process customer personal data should be subject to appropriate confidentiality obligations and receive access only as needed for their role. The DPA and security exhibit should describe access approval, review, revocation, and training commitments at the correct level of specificity.
Security measures
Agorix maintains administrative, technical, and organizational measures intended to protect customer data. The binding security exhibit should accurately describe access control, authentication, encryption, logging, backup, vulnerability management, incident handling, vendor oversight, business continuity, and relevant product controls.
Do not claim certifications, audit reports, regulatory status, or control maturity until verified and supported by current evidence.
Subprocessors
Agorix uses subprocessors to support functions such as hosting, infrastructure, email delivery, analytics, payments, support, monitoring, security, and AI model services.
The binding DPA should include or link to a current subprocessor list and define:
- The service and processing location for each subprocessor.
- Contractual data-protection obligations.
- Notice of additions or replacements.
- The customer's objection process and available remedy.
- Agorix's responsibility for subprocessor performance to the extent required.
AI model processing
When a customer uses AI features, selected workspace context may be sent to approved AI model providers to generate the requested output. Customers should be able to limit access through roles, policies, configuration, and approval gates supported by the product.
The DPA and subprocessor materials must state the providers, purposes, data locations, retention settings, training treatment, security terms, and any available customer controls. This language must match technical configuration and provider contracts.
Assistance with individual rights
Taking into account the nature of the processing, Agorix supports customers with reasonable technical and organizational measures for responding to valid requests to access, correct, delete, restrict, object to, or export personal data, as required by applicable law and the agreement.
The DPA should define request channels, customer self-service capabilities, response cooperation, and allocation of costs for unusual requests.
Security incidents
The DPA should require Agorix to notify affected customers of a confirmed personal-data breach without undue delay and within any specifically negotiated period. Notices should include available information about the nature of the incident, affected data, likely consequences, mitigation, and contact point, without admitting fault or liability.
The final language must align with the incident-response process and applicable law.
Deletion, return, and export
At termination or upon a valid instruction, Agorix supports reasonable export, return, or deletion of customer data according to product capabilities and the controlling agreement, unless law requires continued retention.
The DPA should define the customer export window, deletion timing, backup treatment, exceptions, verification, and any paid transition assistance.
International transfers
Where customer personal data is transferred across borders, the DPA should incorporate the appropriate transfer mechanism, such as applicable standard contractual clauses, the UK addendum or international data transfer agreement, or another valid mechanism.
The final package should identify exporter and importer roles, modules, selections, processing locations, supplementary measures, and government-access review where required.
Audits and compliance information
Agorix should make information reasonably necessary to demonstrate compliance with the DPA available to customers, subject to confidentiality, security, frequency, scope, and cost protections.
The binding terms should define the order of evidence—such as documentation, questionnaires, third-party reports, and on-site audit—and the circumstances in which each is available.
Procurement and privacy review
Request the documents behind the overview.
Contact Agorix for the current DPA package, security information, and subprocessor materials available for customer review.