1. Who we are

SudoX is a digital technology company operating since 2017. We design and build websites, web applications and custom platforms, and we deliver digital marketing, local SEO, customer support outsourcing and call center outsourcing services.

For the purposes of data protection law, the controller responsible for personal information described in this policy is SudoX LLC, a limited liability company registered in the State of Texas, United States, of 5900 Balcones Drive #23472, Austin, Texas 78731, United States.

• Privacy contact: info@sudox.net
• Telephone: +1 307 381 8264
• Data protection enquiries: mark your message “Data protection” and we will route it to the person responsible

SudoX LLC is established in the United States and serves clients worldwide. Where we offer services to, or monitor the behaviour of, individuals in the European Economic Area or the United Kingdom, we comply with the GDPR and the UK GDPR in respect of that processing, and we apply the transfer safeguards described in section 8.

2. Scope of this policy

This policy covers personal information we handle as a controller: meaning we decide why and how it is processed. That includes visitors to sudox.net, prospective clients who contact us, our clients and their staff, applicants, suppliers and subscribers.

It does not govern personal data we process on behalf of a client. For example end-customer records we handle while running a support desk, a call center campaign or an advertising account. In those cases the client is the controller and we act as processor under our Data Processing Agreement. See section 14.

3. Information we collect

3.1 Information you give us

• Contact and enquiry details: name, email address, telephone number, company name, job title, and the content of your message when you contact us or request a quote.
• Project information: requirements, brand assets, existing website access, content and any material you share so we can scope or deliver work.
• Client administration data: billing contacts, addresses, purchase order references and payment details processed by our payment providers.
• Recruitment data: CV, work history and portfolio if you apply to work with us.
• Marketing preferences: your subscription status and consent records.
• Call content: if you telephone us, or we call you, we keep a note of the call, and the call may be recorded for quality assurance and training. You are told at the start of the call if it is being recorded, and you can ask us not to record, or to continue by email instead. Recordings of calls to SudoX’s own numbers are kept for 90 days unless we need them longer to resolve a dispute.

3.2 Information collected automatically

• Device and connection data: IP address, browser type and version, operating system, device type, language and screen settings.
• Usage data: pages viewed, time on page, referring URL, links clicked and navigation paths.
• Cookie identifiers: see section 6 and our Cookie Notice.

3.3 Information from third parties

• Advertising and analytics platforms: aggregated campaign and audience reporting from Meta, Google and similar providers.
• Business sources: publicly available professional information, referrals and introductions.

We do not deliberately collect special category data: such as health, biometric, racial or ethnic origin, political, religious or trade union information, through this website. Please do not send it to us unsolicited.

4. How we use information

• To respond to enquiries, prepare proposals and provide written quotes.
• To deliver contracted services, manage projects and communicate about the work.
• To operate, secure and improve this website and diagnose technical faults.
• To send invoices, take payment and keep accounting records.
• To send marketing communications where we have a lawful basis, and to measure their performance.
• To detect, prevent and investigate fraud, abuse and security incidents.
• To assure and improve the quality of our support and call handling, including reviewing recorded calls and coaching our agents.
• To assess job applications.
• To comply with legal, tax and regulatory obligations and to establish or defend legal claims.

We do not sell personal information, and we do not use automated decision-making that produces legal effects for you.

5. Legal bases for processing (GDPR)

Where the EU or UK GDPR applies, we rely on the following legal bases:

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object at any time, see section 11.

6. Cookies and similar technologies

We use strictly necessary cookies to make the site work. Only with your consent, we also use analytics and advertising cookies to understand usage and measure campaigns. Non-essential cookies are not set before you consent.

Full details of each category, the cookies involved and how to control them are in our Cookie Notice. You can withdraw or change your choices at any time through the Cookie settings control in the footer of every page, or through your browser controls.

7. How we share information

We share personal information only where necessary, and never in exchange for money. Recipients fall into these categories:

• Service providers (processors): hosting, email, analytics, CRM, helpdesk, telephony, payment processing and professional advisers. Each is bound by a written contract limiting use to our instructions.
• Advertising platforms: where you have consented to advertising cookies, or where we manage campaigns on a client’s behalf.
• Clients: where you interact with a support desk or campaign we operate for them.
• Professional advisers: accountants, auditors, insurers and lawyers under duties of confidentiality.
• Authorities: where required by law, court order or to protect rights and safety.
• Corporate transactions: a buyer or successor in the event of a merger, acquisition or reorganisation, subject to this policy.

A current list of our sub-processors is maintained in Annex III of our Data Processing Agreement.

8. International data transfers

We are based in the United States and use providers that may process data in the US and other countries. Where we transfer personal data out of the EEA, the UK or Switzerland, we put a lawful transfer mechanism in place:

• European Commission Standard Contractual Clauses (2021/914), with the UK International Data Transfer Addendum where relevant;
• Adequacy decisions where the destination country is recognised as adequate;
• EU to US and UK to US Data Privacy Framework certification where a provider participates.

We carry out transfer risk assessments where required and apply supplementary measures such as encryption in transit and at rest. You may request a copy of the relevant safeguards by emailing info@sudox.net.

9. How long we keep information

We keep personal information only as long as necessary for the purpose it was collected, then delete or anonymise it.

10. How we protect information

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS) and at rest for stored data;
• Role-based access control on a least-privilege basis, with multi-factor authentication on administrative accounts;
• Segregation of client environments and credentials;
• Managed patching, dependency updates and vulnerability monitoring;
• Backups with tested restoration procedures;
• Confidentiality obligations and data protection training for staff and agents;
• A documented incident response procedure with defined notification timelines.

No system is completely secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority where the law requires it.

11. Your data protection rights

Subject to the law that applies to you, you have the right to:

• Access the personal information we hold about you and receive a copy;
• Rectify inaccurate or incomplete information;
• Erase information where there is no lawful reason to keep it;
• Restrict processing while a concern is investigated;
• Object to processing based on legitimate interests, and to direct marketing at any time;
• Data portability: receive data you provided in a structured, machine-readable format;
• Withdraw consent at any time, without affecting processing already carried out;
• Lodge a complaint with your supervisory authority.

To exercise any right, email info@sudox.net. We respond within 30 days and will tell you if we need longer. We may ask for information to verify your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.

If your request concerns data we process on behalf of a client, we will refer you to that client as controller and support them in responding.

12. US state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas or another state with comprehensive privacy legislation, you may have the right to know what personal information we collect, to access and delete it, to correct inaccuracies, to obtain a portable copy, and to opt out of targeted advertising, sale or profiling.

We do not sell personal information and we do not share it for cross-context behavioural advertising in exchange for money. We do not knowingly process the personal information of anyone under 16 for targeted advertising.

We will not discriminate against you for exercising a privacy right. You may use an authorised agent to submit a request on your behalf, provided we can verify their authority. To submit a request, email info@sudox.net with “Privacy Request” in the subject line. We honour the Global Privacy Control signal where your browser sends it.

California residents may also request details of categories of personal information disclosed for a business purpose in the preceding 12 months.

13. Children’s privacy

Our website and services are directed to businesses, not children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact info@sudox.net and we will delete it promptly.

Where we build or operate a platform that serves minors on a client’s behalf, such as an education service, we do so under the client’s instructions as processor, and the client remains responsible for parental consent and age-appropriate design obligations.

14. Controller and processor roles

Understanding which role we play determines who is accountable for your data:

Clients and prospective clients can review our processor commitments in the Data Processing Agreement.

15. Changes and how to contact us

We may update this policy to reflect changes in our practices or the law. The “last updated” date above will change, and we will notify you of material changes by a notice on this website or by email where appropriate.

For any privacy question, request or complaint:

• Email: info@sudox.net
• Telephone: +1 307 381 8264
• Post: SudoX, 5900 Balcones Drive #23472, Austin, Texas 78731, United States

If you are in the EEA or UK and are not satisfied with our response, you may complain to your local supervisory authority. This policy is governed by the laws of the State of Texas, United States, without prejudice to mandatory local data protection rights, including your rights under the GDPR and UK GDPR where those apply to you.

1. Parties and structure

This Data Processing Agreement (“DPA”) is entered into between SudoX LLC, a limited liability company registered in the State of Texas, United States, of 5900 Balcones Drive #23472, Austin, Texas 78731, United States (“SudoX”, “Processor”) and the client identified in the applicable service agreement (“Client”, “Controller”).

This DPA forms part of and is subject to the service agreement, proposal, statement of work or master services agreement between the parties (the “Principal Agreement”). Where this DPA conflicts with the Principal Agreement on the processing of personal data, this DPA prevails.

2. Definitions

• Data Protection Laws: the EU GDPR (2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA/CPRA and other applicable US state privacy laws, and any other applicable law governing personal data.
• Personal Data: any information relating to an identified or identifiable natural person processed by SudoX on the Client’s behalf under the Principal Agreement.
• Processing: any operation performed on Personal Data, whether automated or not.
• Data Subject: the individual to whom Personal Data relates.
• Sub-processor: any third party engaged by SudoX to process Personal Data.
• Personal Data Breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
• Standard Contractual Clauses (SCCs): the clauses annexed to Commission Implementing Decision (EU) 2021/914.

Terms not defined here take the meaning given in the applicable Data Protection Laws.

3. Subject matter and roles

The Client is the Controller and SudoX is the Processor in respect of Personal Data processed under the Principal Agreement. Where the Client is itself a processor for a third party, SudoX acts as sub-processor and the Client warrants it has authority to engage SudoX on those terms.

SudoX processes Personal Data only:

• for the purposes set out in Annex I and as necessary to provide the services;
• in accordance with the Client’s documented instructions; and
• as required by applicable law, in which case SudoX will inform the Client before processing unless legally prohibited.

SudoX will not sell Personal Data, share it for cross-context behavioural advertising, retain or use it for its own purposes, or combine it with data from other sources except as permitted by law. SudoX will immediately inform the Client if, in its opinion, an instruction infringes Data Protection Laws.

4. Client obligations

The Client warrants and undertakes that:

• it has a lawful basis for the processing it instructs, and has provided all required notices and obtained all required consents;
• its instructions comply with Data Protection Laws and do not cause SudoX to breach them;
• Personal Data supplied to SudoX is accurate and limited to what is necessary for the services;
• it will not instruct the processing of special category data, children’s data or payment card data unless expressly agreed in writing and covered by additional safeguards;
• it maintains the accuracy of its own records and responds to Data Subjects as controller.

Where the Client provides SudoX with access to its systems, the Client is responsible for configuring access rights appropriately and for promptly revoking access when personnel change.

5. SudoX obligations

SudoX will:

• process Personal Data only on documented instructions, as set out in clause 3;
• implement and maintain the security measures in Annex II;
• ensure personnel are bound by confidentiality and receive data protection training;
• impose equivalent obligations on Sub-processors under written contract;
• assist the Client in responding to Data Subject requests (clause 9);
• notify the Client of Personal Data Breaches without undue delay and in any event within 48 hours of becoming aware (clause 10);
• assist the Client with data protection impact assessments and prior consultations with supervisory authorities;
• delete or return Personal Data on termination (clause 13);
• make available information necessary to demonstrate compliance and submit to audits (clause 12);
• maintain records of processing activities carried out on the Client’s behalf.

6. Confidentiality and personnel

SudoX will treat all Personal Data as confidential and will not disclose it except to personnel and Sub-processors who need access to deliver the services.

SudoX ensures that every employee, contractor and outsourced agent with access to Personal Data:

• is subject to a written confidentiality undertaking that survives termination of their engagement;
• receives data protection and security awareness training at onboarding and at least annually;
• is granted access strictly on a need-to-know, least-privilege basis;
• has access revoked promptly on role change or departure;
• is subject to background verification where appropriate to the role and permitted by law.

6.1 Access to Client-controlled systems

For customer support and call center engagements, SudoX agents access the Client’s own systems directly, which may include the Client’s CRM, helpdesk, ticketing, order management, telephony or billing platforms, rather than working solely inside SudoX-owned tooling. Where this is the case:

• access is provisioned by the Client, or by SudoX on the Client’s written instruction, using named individual accounts for each agent. Shared, generic or team logins are not used, so that every action is attributable to one person;
• permissions are scoped to the minimum role required to perform the agreed scope of work. SudoX will not request or accept administrative, export, bulk-download or global-search rights unless the Client determines they are necessary and records that instruction;
• SudoX maintains a per-Client access assignment register recording which agents hold access to which Client systems, the permission level held, the date access was granted and the date it was revoked;
• access is revoked within one business day of an agent leaving the engagement, changing role, or the engagement terminating, and SudoX will confirm revocation to the Client on request;
• the register is reviewed at least quarterly, and the Client may request a copy at any time to reconcile it against its own user lists;
• agents are prohibited from exporting, copying, photographing, screen-recording or storing Client data outside the Client’s systems and SudoX’s approved tooling, and from accessing records other than those needed to handle the enquiry in front of them;
• where the Client’s systems produce their own audit logs, those logs remain the Client’s record. SudoX will cooperate in investigating any access flagged by the Client as anomalous.

The Client remains the controller of, and is responsible for configuring, the permissions, retention settings and logging in its own systems. SudoX cannot restrict access more tightly than the roles the Client provisions, and will notify the Client if the access granted appears broader than the scope of work requires.

6.2 Call recording

Where telephony forms part of the services, calls are recorded for quality assurance, agent coaching, dispute resolution and training, and additionally on the Client’s specific instruction. Recording is subject to the following:

• Roles. The Client is the controller of call recordings relating to its customers and determines the lawful basis for recording. SudoX acts as processor. Where SudoX records for its own quality assurance purposes on its own platform, it does so on the Client’s documented instruction and within the purposes set out in this clause;
• Notice. Callers are informed that the call may be recorded, and of the purpose, before recording begins, by pre-connection announcement, IVR message, or equivalent notice agreed with the Client. Where the applicable law of the caller’s or the agent’s location requires the consent of all parties, recording will not proceed without it, and the caller is offered a route to continue on an unrecorded basis or through another channel;
• Withdrawal and objection. If a caller objects to being recorded, the agent will stop or suppress recording for that call where the system permits, or otherwise continue without recording, and will log the objection;
• Sensitive content. Agents are instructed not to capture payment card data in recordings. Where payment details must be taken by phone, pause-and-resume or equivalent suppression is used so that card and authentication data are not recorded. Special category data is not solicited;
• Access. Recordings are accessible only to authorised quality assurance and supervisory personnel on a need-to-know basis, and to the Client. Access is logged. Recordings are not used for any purpose beyond those stated, and are never used to train third-party models or for marketing;
• Retention. Recordings are retained for the period the Client specifies in writing. Absent a Client instruction, SudoX applies a default retention of 90 days, after which recordings are deleted, together with associated transcripts and quality assurance extracts, save where a longer period is required by law or to resolve an active dispute. Where recordings are held in the Client’s own telephony platform, retention is controlled by the Client;
• Data subject rights. SudoX will assist the Client in locating, providing, redacting or deleting a recording in response to a Data Subject request under clause 9. Redaction of third-party voices is carried out where reasonably practicable;
• Transfers. Recordings and transcripts are subject to the transfer safeguards in clause 11 in the same way as other Personal Data.

The Client is responsible for reflecting call recording in its own privacy notice to its customers, and for confirming that recording is lawful in the jurisdictions from which its customers call. SudoX will provide the technical detail needed for that assessment, including where recording takes place and how long recordings are kept.

7. Security measures

SudoX implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to the state of the art, cost of implementation, and the nature, scope, context and purposes of processing, as required by Article 32 GDPR.

Those measures are described in Annex II. SudoX may update them provided the level of protection is not reduced. SudoX regularly tests, assesses and evaluates the effectiveness of its measures.

8. Sub-processors

The Client grants SudoX general written authorisation to engage Sub-processors, subject to the following conditions:

• Sub-processors currently approved are listed in Annex III;
• SudoX will give the Client at least 30 days’ notice before adding or replacing a Sub-processor;
• the Client may object on reasonable data protection grounds within that notice period. The parties will work in good faith to resolve the objection; if it cannot be resolved, the Client may terminate the affected service without penalty for the unused portion of any prepaid fees;
• SudoX imposes data protection obligations on each Sub-processor that are no less protective than this DPA;
• SudoX remains fully liable to the Client for the performance of its Sub-processors.

9. Data subject requests

SudoX will not respond to a Data Subject request relating to Client Personal Data except on the Client’s instruction or as required by law. If SudoX receives such a request directly, it will:

• promptly inform the Client, and in any event within 5 business days;
• direct the Data Subject to the Client as controller;
• provide reasonable assistance, including technical measures where available, to help the Client respond within statutory deadlines.

Assistance covers requests for access, rectification, erasure, restriction, portability, objection and opt-out rights under US state law. SudoX may charge reasonable costs for assistance that goes materially beyond the standard functionality of the services.

10. Personal data breach

SudoX will notify the Client without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Client Personal Data.

The notification will include, to the extent known:

• the nature of the breach, including categories and approximate number of Data Subjects and records affected;
• the likely consequences of the breach;
• measures taken or proposed to address it and mitigate adverse effects;
• contact details for the person coordinating the response.

Where full information is not available at the outset, SudoX will provide it in phases without undue further delay. SudoX will document all breaches, cooperate with the Client’s investigation, and not make public statements identifying the Client without prior written consent unless legally required.

Notification of a breach is not an acknowledgement of fault or liability.

11. International transfers

SudoX is established in the United States. The Client acknowledges that provision of the services involves processing in the United States and potentially in other jurisdictions where Sub-processors operate, as identified in Annex III.

Region matching. SudoX selects the hosting region to match the Client’s own region. For Clients in the EEA, UK or Switzerland, the hosting, storage and backup components of the stack are configured in EU regions, using AWS, Google Cloud, Azure or Hetzner EU regions. Where an engagement is hosted entirely in the EU, the Client’s data at rest does not leave the EEA. The Client may require region pinning as a condition of the engagement, recorded in the statement of work, in which case SudoX will not migrate that data to a non-EU region without the Client’s prior written consent.

Residual US access. Even where data is hosted in the EU, the Client should be aware that SudoX is a US entity and that its personnel and its support and administrative tooling access that data from the United States. That remote access is itself a restricted transfer under the GDPR and the UK GDPR, and it is covered by the Standard Contractual Clauses set out below rather than by the hosting region. If an engagement ever requires personnel to access Client data from a country outside the United States, SudoX will disclose that country to the Client in the statement of work before the access begins, and will not proceed without the Client’s agreement.

Adequacy and framework reliance. Where a Sub-processor is certified under the EU-US Data Privacy Framework and the UK Extension, transfers to that Sub-processor may rely on the relevant adequacy decision for as long as the certification and the decision remain in force. SudoX does not rely on the Data Privacy Framework alone. The Standard Contractual Clauses below apply in parallel, so that a transfer mechanism remains in place if an adequacy decision is invalidated or a certification lapses.

Where processing involves a transfer of Personal Data from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree that:

• the EU Standard Contractual Clauses (2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated into this DPA by reference and take precedence in the event of conflict;
• the UK International Data Transfer Addendum applies to UK transfers;
• Annex I of this DPA populates Annexes I.A and I.B of the SCCs, and Annex II populates Annex II of the SCCs;
• the competent supervisory authority is that of the Client’s place of establishment;
• for clause 17, the governing law is that of Ireland; for clause 18(b), the forum is the courts of Ireland.

SudoX will assist the Client with transfer impact assessments and will notify the Client if it becomes subject to a legally binding request for disclosure by a public authority, unless prohibited from doing so.

12. Audit and assistance

SudoX will make available to the Client information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Client or an independent auditor appointed by the Client.

Audits are subject to the following: at least 30 days’ prior written notice; no more than once in any 12-month period unless required by a supervisory authority or following a Personal Data Breach; conducted during business hours without unreasonable disruption; subject to confidentiality obligations; and limited to systems and records relevant to the processing of Client Personal Data. The auditor may not be a competitor of SudoX. The Client bears its own audit costs and SudoX’s reasonable costs for audits exceeding the standard scope.

SudoX may satisfy audit requests by providing existing certifications, penetration test summaries or completed security questionnaires where these reasonably address the Client’s enquiry.

13. Deletion and return of data

On termination or expiry of the Principal Agreement, or earlier on the Client’s written request, SudoX will at the Client’s election either return Personal Data in a commonly used machine-readable format, or delete it.

Deletion will be completed within 90 days of termination, including from backup systems in the ordinary backup rotation cycle, except where SudoX is required by law to retain a copy. In which case SudoX will retain it only for the period required and continue to protect it under this DPA.

SudoX will provide written confirmation of deletion on request. Personal Data that has been irreversibly anonymised is not subject to this clause.

14. Liability, term and governing law

This DPA takes effect on the effective date of the Principal Agreement and continues for as long as SudoX processes Personal Data on the Client’s behalf. Clauses 6, 13 and 14 survive termination.

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Principal Agreement. Nothing in this DPA limits liability that cannot be limited under applicable law, including a Data Subject’s rights to compensation.

This DPA is governed by the law stated in the Principal Agreement, or where none is stated, the laws of the State of Texas, United States, and the parties submit to the exclusive jurisdiction of the state and federal courts located in Travis County, Texas. Where the SCCs apply, clause 11 of this DPA governs their construction and the governing law and forum stated in clause 11 prevail over this paragraph for the purposes of those Clauses.

If any provision is held invalid, the remainder continues in force. Amendments must be in writing, save that SudoX may update Annex II and Annex III in accordance with clauses 7 and 8.

15. Annex I, Description of processing

A. Categories of data subjects

• The Client’s customers, end users and prospects;
• Visitors to websites and applications built or maintained by SudoX for the Client;
• Callers to and contacts of support desks or call center campaigns operated by SudoX;
• The Client’s employees, contractors and administrative users;
• Recipients of marketing campaigns run on the Client’s behalf.

B. Categories of personal data

• Identity and contact data: name, email address, telephone number, postal address, company and job title;
• Account data: usernames, hashed credentials, profile settings, preferences;
• Transaction and enquiry data: orders, bookings, quotes, service history, support tickets;
• Communications content: emails, chat transcripts, call notes, and call recordings and derived transcripts or quality assurance scores where telephony forms part of the services;
• Technical data: IP address, device and browser information, cookie identifiers, log data;
• Marketing and behavioural data: campaign engagement, on-site activity, conversion events.

C. Special category data

Not processed by default. SudoX does not solicit special category data. Where a Client’s use case necessarily involves it, such as a healthcare enquiry form, it must be agreed in writing in advance, with additional safeguards recorded in the statement of work. Payment card data is processed only by PCI-DSS compliant payment providers and is not stored by SudoX, and is suppressed from call recordings as described in clause 6.2.

D. Nature and purpose of processing

• Design, development, hosting, maintenance and support of websites, web applications and custom platforms;
• Operation of customer support desks across email, chat and telephone, including handling enquiries directly within the Client’s own CRM, helpdesk or ticketing systems;
• Operation of inbound and outbound call center campaigns, including call recording for quality assurance as set out in clause 6.2;
• Creation, delivery and optimisation of advertising campaigns and local SEO activity;
• Analytics, reporting and performance measurement;
• Data migration, integration and quality assurance testing.

E. Duration of processing

For the term of the Principal Agreement, plus the deletion period in clause 13. Call recordings and derived transcripts are retained for the period the Client specifies, or 90 days by default, as set out in clause 6.2.

F. Frequency of transfer

Continuous, for the duration of the services.

16. Annex II: Technical and organisational measures

17. Annex III, Approved sub-processors

SudoX engages the sub-processors below to deliver the services. Hosting region is selected to match the Client’s own region: engagements for EU and UK clients are hosted in EU regions, and engagements for US clients are hosted in US regions. The Client’s hosting region is confirmed in the statement of work.

The current version of this register is available on request from info@sudox.net. Clients may subscribe to change notifications under clause 8.

Requesting a signed copy

If you are a client or prospective client and need an executed DPA for your procurement or vendor onboarding process, email info@sudox.net with your entity details and any specific annex requirements. We can also complete security questionnaires and provide the sub-processor register on request.

1. What cookies are

Cookies are small text files placed on your device when you visit a website. They let a site remember your actions and preferences, understand how it is being used, and in some cases measure advertising performance.

We also use similar technologies that work in comparable ways and are covered by this notice:

• Local storage and session storage: browser storage used to retain preferences such as your theme or consent choice;
• Pixels and tracking tags: small pieces of code that record that a page was loaded or an action completed;
• Software development kits and server-side identifiers used for measurement.

Cookies are either session cookies, which expire when you close your browser, or persistent cookies, which remain for a set period. They are set either by us (first-party) or by another organisation whose service we use (third-party).

2. Consent and your choices

Strictly necessary cookies do not require consent because the site cannot function without them. Every other category, meaning analytics, functional and advertising, is set only after you consent.

When you first visit sudox.net you are presented with a cookie banner. Until you make a choice, no non-essential cookies are set. You can accept all, reject all non-essential cookies, or choose categories individually. Rejecting non-essential cookies does not restrict your access to any part of the site.

You can change or withdraw your choice at any time using the Cookie settings control in the footer of every page, or by clearing cookies in your browser. Withdrawing consent does not affect processing that already took place lawfully. Your choice is stored for 12 months, after which we ask again.

3. Categories we use

4. Cookie inventory

This site uses three measurement tools: Google Analytics 4, Google Ads and the Meta Pixel. The table below lists the cookies and storage items they set, alongside our own first-party items. Names and durations set by third parties are controlled by those providers and may change without notice to us.

Analytics and advertising cookies in this table are set only if you consent. If you reject non-essential cookies, only the necessary rows apply.

5. Third-party cookies

Some cookies are set by organisations other than SudoX. We do not control how those organisations use the data they collect, and their own privacy notices apply in addition to ours:

• Google Analytics 4: how the site is used, which pages are visited and where visitors leave;
• Google Ads: recording that a visit followed one of our ads, and measuring resulting enquiries;
• Meta Pixel (Facebook, Instagram): advertising measurement and audience building;
• Cloudflare: security, bot mitigation and performance, where the site is served through it;
• Embedded content providers: where a page includes an embedded video or map, that provider may set cookies when the content loads.

Where these providers process personal data outside your region, transfer safeguards described in our Privacy Policy apply.

6. How to control cookies

On this site

Use the Cookie settings control, available here and in the footer of every page, to review and change your category choices at any time. Turning a category off also deletes the cookies that category had already set.

In your browser

All major browsers let you view, block and delete cookies. Blocking all cookies may stop parts of this or other websites working correctly.

• Chrome: Settings › Privacy and security › Third-party cookies;
• Safari: Settings › Privacy › Manage Website Data;
• Firefox: Settings › Privacy & Security › Cookies and Site Data;
• Edge: Settings › Cookies and site permissions.

Opting out of advertising measurement

• Google Ads settings and the Google Analytics browser opt-out add-on;
• Meta ad preferences within your account settings;
• Industry opt-out tools operated by the Digital Advertising Alliance, the Network Advertising Initiative and, in Europe, Your Online Choices.

7. Do Not Track and Global Privacy Control

There is no common industry standard for responding to browser Do Not Track signals, and this site does not currently respond to them.

We do honour the Global Privacy Control (GPC) signal. Where your browser or extension sends GPC, we treat it as a valid request to opt out of targeted advertising and any sharing of personal information for cross-context behavioural advertising, as required by US state privacy laws.

8. Changes and contact

We update this notice when the cookies we use change or when the law requires. The “last updated” date above will change accordingly, and material changes will be reflected in the consent banner so you can review your choices.

Questions about cookies or this notice:

• Email: info@sudox.net
• Telephone: +1 307 381 8264
• Post: SudoX, 5900 Balcones Drive #23472, Austin, Texas 78731, United States