DPF Program Notice
privacy.cafex.ai/dpf · compliance@cafex.com
Download PDF

CafeX Data Privacy Framework ("DPF") Program Notice

Effective 6 November 2026

Contents

This notice

This notice explains how CafeX Communications Inc. ("CafeX", "we", "us" or "our") handles personal data that we receive from the European Union and European Economic Area, the United Kingdom (and Gibraltar) and Switzerland in reliance on the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) (together, the "DPF"). It covers non-HR personal data only.

The CafeX Platform enables organizations in regulated industries, including healthcare, banking, insurance and government, to improve how they engage digitally with employees, customers and partners. It brings fragmented and often siloed data and applications together in a single, clean user interface, and automates routine steps based on that data and established working practices.

This notice supplements our Privacy Policy at https://privacy.cafex.ai/. If there is any conflict between this notice and the DPF Principles, the Principles govern.

Who we are

CafeX Communications Inc., 1460 Broadway, Suite 9054, New York, NY 10036, United States. This notice applies to CafeX Communications Inc.

Our participation in the Data Privacy Framework

CafeX Communications Inc. complies with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework Principles for personal data received from the EU and the UK, and to the Swiss-U.S. Data Privacy Framework Principles for personal data received from Switzerland.

To learn more about the DPF program, visit https://www.dataprivacyframework.gov/. To view our certification, visit https://www.dataprivacyframework.gov/participant/5840.

Personal data we collect and why

Data CafeX collects for its own purposes:

  • Contact and account data: names, email addresses and sign-in information (including profile information received when you sign in with Google or Microsoft), used to create and manage accounts, provide our services and respond to support requests.
  • Website data: IP address, browser and device information, approximate location derived from IP address, and information about how you use our website, collected through cookies and Google Analytics. We use it to operate, secure and improve our website. This data relates to our website only; our applications do not use Google Analytics or collect device location.
  • Security and service records: logs and support records, used to keep our services secure, diagnose problems and meet our legal and compliance obligations.

Customer Data: when our business customers use the CafeX Platform, they may send us personal data about their own employees, customers or partners. We process this Customer Data only on our customers' behalf and under their instructions, as set out in our agreements with them. AI capabilities in the CafeX Platform are turned off by default and are enabled only at a customer's request; Customer Data is never used to train AI models.

We do not sell personal data or use it for targeted advertising.

Sharing personal data with third parties

We share personal data only with service providers acting as our agents, under written contracts that limit their use of the data to providing services to us and require them to protect it to the level required by the DPF Principles. The categories of service providers are:

  • cloud computing, data storage and website hosting providers;
  • communication and collaboration tools;
  • customer support and ticketing services;
  • user account registration and authentication services;
  • data analytics services (website only).

We may also share personal data with our affiliates, which must protect it in line with this notice, and in connection with a merger, acquisition or sale of all or part of our business.

Our current list of subprocessors is available at our Trust Center: https://trust.cafex.ai

Onward transfer liability: CafeX remains responsible under the DPF Principles if an agent we transfer personal data to processes it in a manner inconsistent with the Principles, unless we prove that we are not responsible for the event giving rise to the damage.

Disclosure to public authorities: we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Your choices

We will offer you the opportunity to opt out before we disclose your personal data to a third party other than our agents, or use it for a purpose materially different from the purpose for which it was originally collected or that you later authorized. We do not collect sensitive personal data for our own purposes; if we ever do, we will obtain your express (opt-in) consent first.

We do not send marketing emails without your permission or another lawful basis. Every marketing email includes an unsubscribe option, and you can also contact compliance@cafex.com.

Your right to access, correct and delete

You have the right to access the personal data we hold about you, and to ask us to correct, amend or delete it where it is inaccurate or has been processed in violation of the DPF Principles. To make a request, email compliance@cafex.com.

If your personal data is Customer Data, please contact the relevant customer, which controls it. If you contact us instead, please tell us the name of the customer through which your data was provided; we will refer your request to that customer and help them respond.

Questions and complaints

In compliance with the DPF Principles, CafeX commits to resolve DPF-related complaints about our collection or use of your personal data. EU, UK and Swiss individuals with inquiries or complaints should first contact us at:

  • Email: compliance@cafex.com
  • Post: CafeX Communications Inc., 1460 Broadway, Suite 9054, New York, NY 10036, United States

Independent recourse mechanism: CafeX has further committed to refer unresolved DPF Principles-related complaints to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive a timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint. JAMS's services are provided at no cost to you.

Enforcement: CafeX is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

Binding arbitration: under certain conditions, you may invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. For more information, see Annex I of the DPF Principles: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction

Retention

We keep personal data only for as long as necessary for the purposes described in this notice: in most cases, for as long as you have an account with us, and for a reasonable period afterwards where needed for security, legal, audit or compliance purposes. When personal data is no longer needed, we delete or anonymize it. Where that is not immediately possible (for example, data in backups), we securely store it and isolate it from further processing until it can be deleted.

Security

We protect personal data with technical and organizational measures, including encryption at rest (AES-256) and in transit, access controls and monitoring. Our information security management system is certified to ISO/IEC 27001, and our controls are aligned with ISO/IEC 42001 and the SOC 2 Trust Services Criteria. More information is available at https://trust.cafex.ai.

Changes to this notice

We review this notice at least annually as part of our DPF recertification. The effective date at the top shows when it was last updated.

Last reviewed: 6 November 2026

The current version of this notice is published at https://privacy.cafex.ai/dpf/. Questions: compliance@cafex.com.