Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is entered into between World SIP Ltd, a company registered in Mauritius (BRN C16143836), 4th Floor, Axis Building, 26 Bank Road, Ebene, Mauritius ("World SIP", the "Processor"), and the customer holding a PBXGuard account (the "Customer", the "Controller").

This DPA forms part of the Terms of Service and applies automatically whenever World SIP processes Customer Personal Data in providing PBXGuard (the "Service"). A signed copy is available on request at contact@pbxguard.com.

This DPA is drafted in English; the English version prevails over any translation.

2. Definitions

• Customer Personal Data: personal data retrieved from the Customer's 3CX PBXs and processed by World SIP on the Customer's behalf, as described in Annex 1.
• Data Protection Laws: the Data Protection Act 2017 of Mauritius and, where applicable, Regulation (EU) 2016/679 (the "GDPR").
• Sub-processor: a third party engaged by World SIP to process Customer Personal Data.
• Personal Data Breach, processing, controller, processor and data subject have the meanings given in the Data Protection Laws.

Data that World SIP processes as a controller — account, user, billing and security data — is outside the scope of this DPA and is described in the Privacy Policy.

3. Roles and instructions

• The Customer is the controller of Customer Personal Data; World SIP is its processor.
• World SIP processes Customer Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's configuration and use of the Service constitute those instructions.
• World SIP informs the Customer without delay if, in its opinion, an instruction infringes the Data Protection Laws.
• The Customer is responsible for the lawfulness of the processing it instructs, including informing the data subjects concerned and holding the authority to connect its 3CX PBXs to the Service (Terms of Service, section 4).

4. Details of the processing

The subject matter, nature, purpose, duration, categories of data and categories of data subjects are described in Annex 1.

5. Confidentiality

World SIP ensures that every person authorized to process Customer Personal Data is bound by an obligation of confidentiality and processes it only as needed to provide the Service.

6. Security

World SIP implements the technical and organizational measures described in Annex 2, appropriate to the risk. World SIP may update these measures, provided the overall level of security is not reduced.

7. Sub-processors

• The Customer grants World SIP a general authorization to engage Sub-processors. The current list is set out in Annex 3.
• World SIP notifies the Customer by email at least 30 days before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the Service by cancelling its subscription or deleting its account, as sole remedy.
• World SIP binds each Sub-processor to data protection obligations no less protective than this DPA, and remains responsible for their performance.

8. International transfers

Customer Personal Data is hosted in France (European Union). World SIP operates the Service from Mauritius, and a limited Sub-processor processes data in the United States (Annex 3).

Where the GDPR applies to the Customer and Mauritius is not covered by an adequacy decision, transfers to World SIP are governed by the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), incorporated into this DPA by reference, with the following selections:

• Clause 7 (docking clause): not used.
• Clause 9: option 2 — general written authorization, with the 30-day notice set out in section 7.
• Clause 11: the optional redress language is not used.
• Clause 13: the competent supervisory authority is that of the EU Member State in which the Customer is established or, failing that, where its EU representative is established.
• Clauses 17 and 18: the law and courts of the EU Member State in which the Customer is established.
• Annexes I, II and III of the Standard Contractual Clauses are completed by Annexes 1, 2 and 3 of this DPA.

Onward transfers to Sub-processors outside the European Union are covered by appropriate safeguards, including the Standard Contractual Clauses.

9. Assistance

Taking into account the nature of the processing, World SIP assists the Customer:

• in responding to data subject requests. If World SIP receives such a request directly, it forwards it to the Customer without responding itself, unless legally required;
• with data protection impact assessments and prior consultations with supervisory authorities, where required;
• in meeting its security obligations.

10. Personal Data Breach

World SIP notifies the Customer without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification describes, as far as then known, the nature of the breach, the categories and approximate volume of data concerned, its likely consequences and the measures taken or proposed. World SIP takes reasonable steps to contain the breach and mitigate its effects.

11. Audits

World SIP makes available to the Customer the information necessary to demonstrate compliance with this DPA. The Customer may, once per year and on 30 days' written notice, have an audit conducted by an independent auditor bound by confidentiality, at its own cost, during business hours and without disrupting the Service. Additional audits are possible where required by a supervisory authority or following a Personal Data Breach.

12. Return and deletion

• The Customer can remove a 3CX PBX from its account at any time; its stored credentials and data are erased.
• When the Customer deletes its account, all Customer Personal Data is erased immediately. Residual copies remain in encrypted backups for up to 30 days, then disappear.
• When a subscription ends without account deletion, data is kept for 24 months so the Customer can subscribe again, then permanently deleted. The Customer may delete its account at any time before then.
• Customer Personal Data displayed from the 3CX PBXs is not retained (Annex 1); there is therefore no dataset of such data to return.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of the Terms of Service, to the extent permitted by the Data Protection Laws.

14. Duration and precedence

This DPA applies for as long as World SIP processes Customer Personal Data. In case of conflict, the following order applies: the Standard Contractual Clauses, where applicable; then this DPA; then the Terms of Service.

Except as set out in section 8, this DPA is governed by the laws of Mauritius, and disputes are subject to the exclusive jurisdiction of the courts of Port-Louis, Mauritius.

Annex 1 — Details of the processing

Annex 2 — Technical and organizational measures

Annex 3 — Sub-processors

World SIP Ltd — 4th Floor, Axis Building, 26 Bank Road, Ebene, Mauritius · BRN C16143836 · contact@pbxguard.com