Data Processing Agreement

This page summarizes the data-processing terms that apply when a business customer asks SPX to process personal data on its behalf.

In that relationship, the customer is generally the controller and SPX acts as the processor for the covered processing activities.

We process customer data only for the purpose of providing SPX, fulfilling documented instructions, and meeting legal or security obligations that apply to us.

If instructions are inconsistent with law or with the service design, we may pause processing and ask for clarification before continuing.

We apply reasonable technical and organizational measures to keep customer data confidential and to reduce the risk of unauthorized access, loss, or alteration.

Access to production data should be limited to personnel who need it to operate, secure, or support the service.

We may use subprocessors to host infrastructure, store data, send email, provide monitoring, or support other service operations.

Where a subprocessor is used, it should only receive the data required to perform its function.

Where appropriate, we will help the controller respond to access, deletion, export, or other requests that are technically feasible for us to support.

The controller remains responsible for deciding whether a request should be granted and for communicating with the relevant data subject.

When a business customer deletes data or ends its use of SPX, we will delete or return customer data in line with the service agreement and our retention rules.

Some data may be retained for legal, audit, or security purposes if the law requires it or if a dispute needs to be resolved.

If we become aware of a security incident affecting customer personal data, we will investigate and notify the customer as required by the agreement and applicable law.

If you need a signed DPA or have a processing question, contact us at the address below.