Data processing agreement

This agreement applies between the customer as controller (“customer”) and good vibes GmbH, Gartenstrasse 7, c/o excent AG, Zweigniederlassung Zug, 6300 Zug, Switzerland, UID CHE-251.623.804, represented by its managing director Denis Lulic, as processor (“X3”, “we”). It is an annex to the terms and conditions and is concluded upon their acceptance without the need for a separate signature. On request, we provide a signed version.

It applies to all processing of personal data that we carry out on behalf of the customer when providing the X3 products. The General Data Protection Regulation (GDPR), insofar as it applies to the customer, and the Swiss Federal Act on Data Protection (FADP) apply. Terms have the meaning given in Art. 4 GDPR and Art. 5 FADP.

If the customer is itself a processor for a third party (such as an agency for its clients), we act as a further processor. The customer warrants that its instructions and the engagement of X3 have been approved by its controller and forwards notifications under this agreement.

This agreement does not cover processing for which we are the controller ourselves: the users' X3 Konto, billing, support, security and abuse prevention, and our website. Our privacy policy (x3growth.io/en/privacy) applies to these.

The subject matter is the provision of the X3 products used by the customer as software as a service: collecting, storing, organising, analysing, querying, transmitting to recipients chosen by the customer, restricting and deleting data. The sole purpose is the provision of the services under the terms and conditions, including operation, security, troubleshooting and support.

The duration corresponds to the term of the contract for the respective product plus the periods for export and deletion under clause 19 of the terms and conditions and clause 12 of this agreement.

Data subjects: visitors to the customer's websites and apps, leads and prospects, people who click on the customer's ads, and contacts from connected CRM systems.

Data: usage and event data (pages viewed, referrer, campaign parameters, click identifiers of ad platforms, clicks, scroll depth, time on page, events, goals), device and browser information, approximate location derived from the IP address (country, region, city), pseudonymous visit identifiers and, with consent, browser identifiers, the IP address and browser identifier for short-term processing without permanent storage, recordings and heatmaps (page layout, mouse movements, clicks, scrolling, with masked input), consent status, installs and purchases from apps (App Store, Google Play), lead details from forms, lead forms of ad platforms or APIs (e.g. name, email address, phone number, company, answers), pipeline status, revenue, and conversions and signals reported to ad platforms.

Data subjects: the customer's contacts, leads, customers, prospects and contact persons, recipients and senders of emails, participants in appointments and people who book via booking pages.

Data: master and contact data (name, company, position, email address, phone number, address, website, profiles), lead source and campaigns, deals, tasks, notes, call outcomes and call scripts, appointments and booking details, emails from connected mailboxes (Gmail, Outlook or the customer's own mail server; headers, content, attachments, insofar as synchronised) and sent emails, with tracking switched on the time and number of opens and clicks and the links clicked (without the recipients' IP address and browser identifier), calendar entries, import files and change logs.

Data subjects: the customer's employees and users, and all persons whose data the customer processes in chats, files, workflows or connected apps (such as customers, suppliers, applicants, business partners).

Data: input (prompts), chat histories and results of the AI features, content of files and messages, data that workflows read from or write to connected apps, approvals and logs (who triggered or approved what and when), usage and budget data, and data from the customer's network queried via the local server. The customer determines the nature and scope through its use; the customer only processes sensitive personal data if it has a legal basis for doing so (clause 24 of the terms and conditions).

Data across all products: the customer's users (name, email address, role, profile picture) in their function within the customer data, for example as editors, and access logs.

We only process the data on documented instructions from the customer, including with regard to transfers to third countries, unless we are required by law to process it; in that case we inform the customer of the legal requirement before processing, unless the law prohibits this.

The instructions are conclusively set out in the terms and conditions, this agreement, the customer's configuration and use of the products (e.g. settings, connections, workflows, exports, deletions) and individual instructions in text form. We treat instructions that go beyond the agreed scope of services as change requests.

If, in our view, an instruction infringes data protection law, we inform the customer without delay and may suspend its execution until the matter is clarified.

We commit all persons who have access to the data to confidentiality, unless they are subject to a statutory duty of confidentiality, and only grant access to the extent necessary for the task.

We take the technical and organisational measures under Art. 32 GDPR and Art. 8 FADP described in Appendix 1. We may develop them further as long as the level of protection is not reduced.

We support the customer with appropriate measures in fulfilling the rights of data subjects (access, rectification, erasure, restriction, data portability, objection), primarily through the features of the products (search, editing, export, deletion). If data subjects contact us directly, we forward the request to the customer, insofar as we can identify it, and do not respond on the substance ourselves.

Taking into account the information available to us, we support the customer with the security of processing, with notifications of breaches, with data protection impact assessments and with prior consultations of the supervisory authority (Art. 32 to 36 GDPR, Art. 22 and 23 FADP). We may charge for support that goes beyond the features of the products and simple information on a time-and-effort basis, unless it results from our own breach.

We keep a record of processing activities as a processor where required by law. We have not appointed a data protection officer as there is no obligation to do so; the contact for data protection is deno@x3growth.io.

The customer is responsible for the lawfulness of the processing, in particular for legal bases and consents, for informing the data subjects, for the choice of settings (e.g. consent mode, masking, open and click tracking, approvals) and for selecting the recipients to whom it transmits data via connections.

It informs us without delay if it detects errors or irregularities in the processing.

The customer grants us general authorisation to engage sub-processors. The sub-processors engaged at the time the contract is concluded are listed in Appendix 2 and are deemed approved.

We inform the customer at least 30 days in advance of any intended addition or replacement of a sub-processor by updating Appendix 2 and sending a notification by email or in the app. Within this period, the customer may object in text form for an important reason under data protection law. If we cannot provide a reasonable remedy, the customer may terminate the affected product with effect from the date of the change; we refund prepaid fees pro rata. In urgent cases (such as the failure of a service provider or for security reasons), we may shorten the period and will inform the customer without delay.

We contractually bind every sub-processor to a level of protection that corresponds to this agreement and are liable to the customer for its obligations as for our own.

The following are not sub-processors of X3: services that the customer connects itself and to which it has data transmitted (such as ad platforms for conversions, its mailboxes, calendars, CRM systems and the apps it connects via Composio), AI providers that the customer uses with its own API key, and providers of pure transport services (internet and telecommunications providers). For these, the customer is itself responsible in its relationship with the respective provider.

We store the customer data of the products in data centres in the European Union (Frankfurt am Main). Under Swiss law, the European Union is considered to provide adequate data protection, and so is Switzerland under an adequacy decision of the European Commission.

We only make transfers to countries without adequate data protection, in particular to the USA (for example because a sub-processor is based there or provides support from there), if the requirements of Art. 44 et seq. GDPR and Art. 16 et seq. FADP are met: on the basis of a certification under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework or on the basis of the European Commission's standard contractual clauses (Decision 2021/914) with the adaptations required for Switzerland, in each case with supplementary measures where necessary (e.g. encryption in transit and at rest).

Insofar as standard contractual clauses would be required for a transfer between the customer and X3 itself (for example for customers in the EU, as X3 is based in Switzerland), the European Commission's adequacy decision for Switzerland is sufficient. If we transfer data of a customer from the EU to a sub-processor in a third country, the standard contractual clauses Module 3 (processor to processor) apply between us and the sub-processor.

We notify the customer of a personal data breach affecting customer data without undue delay, at the latest within 48 hours of becoming aware of it, at the email address of the owners of its organisation.

Where known, the notification contains the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact person. We provide information that is not yet available without delay as it becomes available. We immediately take appropriate measures to contain the breach and mitigate its consequences.

The customer, as controller, notifies the supervisory authority (Art. 33 GDPR, Art. 24 FADP) and informs the data subjects; we support it in doing so. A notification is not an admission of fault.

After the services for a product end, the customer can export its data within the period under clause 19 of the terms and conditions (30 days). After that, we delete the customer data of the product, including existing copies, within a further 30 days; backups are deleted as part of the regular rotation after a further 35 days at the latest and are no longer actively processed until then.

This does not apply to data we must retain under applicable law; we block such data for any other processing. During the term, the retention periods of the products set by the customer or stated in the privacy policy and product documentation apply (such as the automatic deletion of raw data and recordings in X3 Growth Intelligence). On request, we confirm the deletion in text form.

On request, we provide the customer with the information necessary to demonstrate compliance with this agreement, in particular a current description of the measures, the list of sub-processors and, where available, certificates or audit reports of our service providers.

If this evidence is not sufficient, the customer or an auditor appointed by it who is bound to confidentiality and is not a competitor of X3 may carry out audits, including inspections, after giving at least 30 days' notice, during business hours, at most once per calendar year, unless there is a specific reason such as a breach under clause 11 or an order from a supervisory authority. Audits must not impair operations or the confidentiality of other customers' data. Our service providers' data centres are audited through their audit reports. The customer bears the costs of on-site audits, unless the audit reveals a material breach by X3.

Liability is governed by the rules of the terms and conditions (clause 16), unless Art. 82 GDPR or mandatory law provides otherwise. As between the parties, each party bears the damage resulting from its own breach.

In the event of conflicts, this agreement takes precedence over the terms and conditions in matters of data protection and, where applicable, the standard contractual clauses take precedence over this agreement. Changes are governed by clause 20 of the terms and conditions. The law and place of jurisdiction under clause 21 of the terms and conditions apply, unless mandatory data protection law provides otherwise.

Confidentiality, physical access: we do not operate our own data centres. The infrastructure runs at Vercel and Neon on Amazon Web Services in Frankfurt am Main; their data centres are audited under ISO 27001 and SOC 2 and have access controls, security staff and video surveillance. Our employees' work devices are encrypted and locked when unattended.

System and data access: users sign in centrally via the X3 Konto with a password (stored only as a secure hash) or a sign-in link, email address confirmation, sessions with secure, server-only cookies and expiry. Strict separation of organisations (tenant isolation) in every query, roles and permissions per organisation, product and project, API keys and MCP access with permission scopes, revocable. Our employees only access production systems on the principle of least privilege, with two-factor authentication and logging.

Encryption and pseudonymisation: transmission exclusively encrypted (TLS), storage in the database encrypted (encryption at rest). Access tokens of connections and customers' own API keys are additionally encrypted at application level. IP addresses of website visitors are not stored in X3 Growth Intelligence but only processed into a pseudonymous check value that changes daily and an approximate location; input in recordings is masked in the browser, and sign-in, payment and account pages are never recorded. With open and click tracking in X3 CRM, the recipients' IP address and browser identifier are not stored. The local server of X3 Automation only establishes outgoing, signed connections.

Integrity: logging of changes and approvals (audit log), approvals before sending or executing in X3 Automation, input validation, code review and automated tests before every deployment, separation of development, test and production environments, management of secrets outside the code.

Availability and resilience: hosting on redundant cloud infrastructure with automatic scaling, protection against denial-of-service attacks by the host, automatic database backups with point-in-time recovery, monitoring of errors and availability, rate limits, hard budgets for AI usage.

Procedures for regular review: updating dependencies and security updates, vetting sub-processors before use, confidentiality obligations and training for employees, a process for data protection incidents with notification under clause 11, data protection by design and by default (cookieless measurement, masking, consent mode, open and click tracking can be switched off), automatic deletion periods.

Processing control: sub-processors only with a contract under Art. 28 GDPR and, where third countries are involved, the Data Privacy Framework or standard contractual clauses; processing only on the customer's instructions.

As of November 2026. For each sub-processor: name and registered office, service, products concerned, place of processing and basis for any transfer abroad.

Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA: hosting of the apps and interfaces, server functions, file storage (Vercel Blob, for example recordings, imports, attachments, exports, profile pictures) and operational logs. All products. Server functions in Frankfurt am Main (region fra1), delivery via Vercel's global network. Transfer: EU-U.S. and Swiss-U.S. Data Privacy Framework, supplemented by standard contractual clauses.

Neon Inc., USA: database (PostgreSQL) for all customer data of the products and the X3 Konto. All products. Storage in Frankfurt am Main (Amazon Web Services, region eu-central-1). Transfer (for example for support from the USA): standard contractual clauses.

Vercel Inc. (AI Gateway), USA: routing requests to AI models and billing usage when the customer does not use its own API key. X3 Automation. Transfer: Data Privacy Framework, supplemented by standard contractual clauses.

Anthropic, PBC, USA: language models (Claude) for AI features, called via the Vercel AI Gateway. X3 Automation. Transfer: standard contractual clauses. Under the provider's API terms, input and output are not used to train its models.

OpenAI, L.L.C., USA: language models as an optional model, called via the Vercel AI Gateway. X3 Automation. Transfer: standard contractual clauses. Under the provider's API terms, input and output are not used to train its models.

Composio, Inc., USA: management of sign-in (OAuth) and execution of queries and actions for connections set up by the customer: ad accounts, Search Console and CRM systems (Growth Intelligence), mailboxes, calendars and video conferencing (CRM), apps and workflows (Automation). All products. Transfer: standard contractual clauses.

Twilio Inc. (SendGrid), USA: sending platform emails, such as confirmations, invitations, notifications, reports and booking confirmations. All products. Emails that users send in X3 CRM via their own mailbox do not go through this service. Transfer: Data Privacy Framework, supplemented by standard contractual clauses.

650 Industries, Inc. (Expo), USA: delivery of push notifications to the mobile apps (forwarded to Apple Inc.'s Apple Push Notification Service and Google LLC's Firebase Cloud Messaging) and delivery of app updates. X3 CRM and mobile apps. Transfer: standard contractual clauses.

This list does not include recipients that the customer selects and connects itself (clause 9 paragraph 4), such as ad platforms for conversions, its own mailbox or its own AI provider, nor Stripe, which exclusively handles our own billing with the customer.