Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the agreement between EzyLab, LLC (“EzyStudio”, “we”) and the customer or partner agency using EzyStudio (“you”): our Terms of Service and, for partners, the Partner Agreement. It applies automatically when we process personal data for you. If it conflicts with those documents on data protection, this DPA wins.

1. When this DPA applies

It applies whenever EzyStudio processes personal data on your behalf (“customer personal data”), for example:

• the data of the people who use your sites and apps: visitors, sign-ups, buyers, form entries and everything stored in your Site Databases;
• for partner agencies, the data of your clients and their teams in your studio, and of your clients’ own users.

It doesn’t cover data we process as controller for our own purposes (for example your own account and billing), which our Privacy Policy describes.

“Data protection law” means every law that applies to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the CCPA. Words like “controller”, “processor”, “data subject” and “personal data breach” have the meaning those laws give them.

2. Roles

• You are the controller (or, if you act for your own client, a processor), and EzyStudio is your processor (or sub-processor).
• Partner agencies: for your clients’ data you are the controller, or the processor of your client. If you act as processor, you confirm your client has authorised you to appoint EzyStudio, and you pass on to your client the information and rights this DPA gives you. Requests and instructions come to us from you, not from your clients, except where the law lets a data subject or controller deal with us directly.
• You decide what personal data your sites and apps collect, why, and for how long, and you are responsible for having a lawful basis, giving notices, getting any consents, and answering your data subjects.
• Under US state laws, EzyStudio is your “service provider” or “processor”: we won’t sell or share customer personal data, retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the service, or combine it with other data except as the law allows.

3. Our commitments

We will:

1. Follow your instructions. Process customer personal data only to provide, secure and support EzyStudio as our agreement and your use of the product describe, which are your documented instructions, or as the law requires (in which case we tell you first, unless the law forbids it). We tell you if we think an instruction breaks data protection law.
2. Not use it for ourselves. We don’t use customer personal data for our own purposes, sell it, use it for advertising, or use it to train AI models. We don’t read the content of your Site Databases except as needed to provide or secure the service, at your request, or as the law requires.
3. Keep it confidential. Only people who need access to provide the service can access customer personal data, and they are bound by confidentiality.
4. Keep it secure. Apply the technical and organisational measures in Annex 2. We may update them as long as the overall level of protection doesn’t go down.
5. Help you with requests. Give you tools to answer data subjects: you can view, export and delete data in your Site Database yourself using the Services. If we receive a request directly from your data subject, we will pass it to you and not answer it ourselves, except to tell them to contact you. We help with other requests, impact assessments and consultations with authorities as far as is reasonable, at your cost when the help goes beyond the product’s tools.
6. Tell you about breaches. Notify you without undue delay, and in any case within 72 hours, after we become aware of a personal data breach affecting customer personal data. We will give you what we know (what happened, the data and people affected, the likely consequences and what we are doing), update you as we learn more, and take reasonable steps to contain it. Notifying you isn’t an admission of fault. We won’t tell your data subjects or the authorities about a breach of your data without consulting you, unless the law requires.
7. Delete it at the end. See section 6.

4. Sub-processors

• Authorisation. You authorise us to use the sub-processors listed on our Sub-processors page, and to appoint new ones under this section.
• Their terms. Each sub-processor is bound by a written contract with data protection obligations at least as protective as this DPA, as far as relevant to its service. We remain responsible for our sub-processors.
• Changes. We will tell you at least 30 days before a new sub-processor starts processing customer personal data, by updating the list and by email or in the dashboard. You can object on reasonable data protection grounds within 10 days of that notice, by writing to [privacy contact email]. We will then work with you in good faith on a solution. If we can’t find one, you may end the affected part of the service, and we will refund any prepaid fees for the period after it ends. That is your only remedy. If you don’t object in time, you accept the new sub-processor. In an emergency (for example to keep the service secure or running), we may replace a sub-processor sooner and tell you as soon as we can.
• Your own providers are not ours. Services you choose and connect yourself, such as your AI provider, payment account, email provider, GitHub, or any service your code calls, are not our sub-processors. Your contract with them governs them, and you are responsible for using them lawfully.

5. International transfers

Customer personal data may be processed in any country where we or our sub-processors operate, including the United States. Where data protection law requires a transfer mechanism, the European Commission’s standard contractual clauses (Module 2 controller to processor, or Module 3 processor to processor) apply between you and us and are incorporated by reference, with the UK addendum and Swiss amendments for those transfers. For the clauses: the docking clause (7) is not used; option 2 (general authorisation) of clause 9 applies with the notice period in section 4; the optional language in clause 11 is not used; clauses 17 and 18 use the law and courts of [EU member state]; and the annexes are filled in by Annexes 1 to 3 below. [Lawyer to confirm the transfer mechanism and these choices.]

6. Return and deletion

• During the agreement you can export your data at any time using the Services.
• When a site or workspace is deleted, we delete the related customer personal data within a reasonable period, as described in our Privacy Policy.
• When the agreement ends, you have 30 days to export your data, unless the agreement ended because of your serious breach. After that we delete customer personal data, except copies the law requires us to keep, which we keep protected and process only for that purpose. Copies in backups are deleted in the normal course.
• When a partner agency closes its studio, its client workspaces stay the agency’s: they do not move to EzyStudio. As set out in section 7 of the Partner Agreement, the agency and its clients get 30 days’ notice with a way to export their data, the sites then go offline, and 30 days after that we delete the workspaces and their data, keeping only the records the law requires.
• Records required by law, such as transaction and tax records, are kept for the periods the law requires.
• We don’t have to keep customer personal data after the times above, and we are not responsible for data you didn’t export in time.

7. Audits

• We make information available to show we comply with this DPA: this DPA, our Security page, answers to reasonable security questionnaires (once a year), and summaries of independent security tests or certifications when we have them.
• If that isn’t enough to meet a requirement of data protection law, or an authority asks, you may audit our compliance once a year, with at least 30 days’ written notice, during business hours, without disrupting our service or seeing other customers’ data, through an independent auditor bound by confidentiality, at your cost. We may charge for our reasonable time. Our sub-processors are audited through their own reports.

8. Your responsibilities

• Process personal data lawfully in your sites and apps: tell people what you collect, have a lawful basis, keep credentials out of your code, and set up your app’s sign-in and permissions with care.
• Don’t store special categories of data (such as health data), children’s data, or government ID numbers unless you need them and have checked that your setup on EzyStudio meets the law’s requirements for them.
• Configure EzyStudio’s settings (team roles, domains, the features you turn on) for your needs, and check what your AI builds.
• Make sure your instructions comply with data protection law.

9. Liability

Each party’s liability under this DPA is subject to the limits and exclusions in the Terms of Service, as far as data protection law allows. This DPA doesn’t limit what a data subject can claim directly under data protection law.

10. Term

This DPA lasts as long as we process customer personal data for you, and continues for any data we still hold after the agreement ends.

Annex 1. Details of the processing

Item	Details
Subject matter	Hosting and running your websites and apps, their Site Databases and forms, and (for partners) your studio and client workspaces
Duration	The term of the agreement, plus the deletion periods in section 6
Nature	Storage, hosting, serving, building and deploying, backup, transmission (including relaying your site’s account emails), analytics, and deletion
Purpose	Providing, securing and supporting EzyStudio for you
Data subjects	The users of your sites and apps (visitors, customers, members, people who fill in forms); for partners, your clients and their team members
Categories of data	Whatever you or your users put in: typically names, email addresses, account and sign-in data of your app’s users, orders and bookings, messages and form entries, and site analytics
Special categories	None intended. If you choose to store them, you are responsible for meeting the extra requirements
Frequency	Continuous, while you use EzyStudio

Annex 2. Security measures

• Encryption of data in transit and at rest, and protection of credentials and keys with industry-standard techniques.
• Access control: role-based permissions, and access by our personnel limited to those who need it and logged.
• Isolation: logical separation of customer environments from each other and from our internal systems.
• Logging and monitoring of the Services for security events.
• Resilience: backups and recovery procedures.
• Secure development: security review of our code and dependencies, and review of App Store apps.
• Incident response: a documented process to investigate, contain and notify, as section 3 describes.

Annex 3. Sub-processors

The current list is on our Sub-processors page. Contact for data protection questions: [privacy contact email].