Data Processing Addendum

1. Roles of the parties

For personal data that Customer submits to the Services, or that is collected through experiences Customer publishes, Customer is the controller and MXR is the processor. MXR processes this data only on Customer's documented instructions, including as set out in the agreement and this DPA.

2. Scope of processing

MXR processes Customer personal data to provide the Services, including:

• Hosting and delivering try-on, spatial and AR experiences.
• Operating telepresence sessions among invited participants.
• Producing analytics and reports for Customer.
• Providing support and maintaining the security of the Services.

3. Categories of data and data subjects

Data subjects may include Customer's team members, Customer's end users and telepresence participants. Personal data may include contact details, account identifiers, device and usage information, and session content such as live video, audio and annotations.

4. Confidentiality

MXR ensures that people authorized to process Customer personal data are bound by appropriate confidentiality obligations and access the data only as needed to provide the Services.

5. Security measures

MXR implements appropriate technical and organizational measures to protect Customer personal data, including encryption in transit and at rest, role-based access controls, monitoring, and regular review of its security practices.

6. Subprocessors

Customer authorizes MXR to engage subprocessors, such as hosting providers, payment processors and analytics providers, to support the Services. MXR imposes data protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for their performance. MXR will provide notice of new subprocessors and Customer may object on reasonable grounds.

7. Assistance and data subject requests

Taking into account the nature of the processing, MXR will provide reasonable assistance to help Customer respond to data subject requests and meet its obligations relating to security, breach notification and data protection impact assessments.

8. Personal data breaches

MXR will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, and will provide information reasonably available to help Customer meet its obligations.

9. International transfers

Where Customer personal data is transferred across borders, MXR will ensure the transfer is protected by appropriate safeguards required by applicable data protection law.

10. Deletion and return

When the agreement ends, MXR will delete or return Customer personal data at Customer's choice, unless retention is required by law. Customer can export much of its data directly from the Services before closing its account.

11. Audits and contact

MXR will make available information reasonably necessary to demonstrate compliance with this DPA. Requests relating to this DPA, including requests for a countersigned copy, can be made through the contact form at /contact.