Data Processing Agreement (DPA) — FizzUp (skeleton)

1. Parties and relationship to the main agreement

• Controller (Customer): (completed by the Customer in the Order Form)
• Processor (Provider): DB 77 CUW Sp. z o.o.

The DPA is an annex to the enterprise agreement/Order Form.

2. Subject matter and duration

Processing of data for the purpose of providing the Service (AI coach / voice / reports), for the duration of the agreement and the period necessary to complete billing/data deletion.

3. Categories of data subjects and data

• users (employees/associates),
• company administrators,
• account data, usage data, transcripts (if applicable), support data, logs.

4. Customer instructions

The Provider processes data only on the documented instructions of the Customer, including administrative settings and instructions given as part of support.

5. Confidentiality and security

The Provider ensures appropriate technical and organizational measures (TOMs), including access control and transmission encryption.

6. Subprocessors

The Provider may use subprocessors in accordance with the list and the rules for notifications/changes (to be specified).

7. Transfers outside the EEA

Transfer mechanisms (SCC/adequacy) to be confirmed per provider.

8. Assistance with data subject rights

The Provider assists the Customer in fulfilling data subject requests, DPIAs and incidents, to a reasonable extent.

9. Termination and deletion/return of data

Upon termination of the agreement, the Provider deletes or returns the Customer's data, subject to legal obligations.