Data processing agreement

This agreement applies when Pozy processes personal data on behalf of a customer (the controller) in providing the service, for example the messages, comments, contacts and analytics of the accounts the customer connects.

Pozy processes customer personal data only on the customer's documented instructions, which include using the service as designed and the actions taken through the dashboard, API, MCP server and CLI.

People at Pozy who can access customer data are bound by confidentiality. Pozy maintains technical and organisational measures appropriate to the risk, including encryption of stored credentials, hashed API keys, access controls and logging.

The customer authorises Pozy to use the subprocessors listed on the subprocessors page. Pozy will give notice of new subprocessors and the customer may object on reasonable grounds.

Pozy will help the customer respond to data subject requests and with security, breach notification and impact assessment obligations, taking into account the nature of the processing.

Pozy will notify the customer without undue delay after becoming aware of a personal data breach affecting customer data, with the information the customer needs to meet its obligations.

When the service ends, Pozy deletes customer personal data within a reasonable period, unless the law requires it to be kept.

Pozy will make available the information needed to demonstrate compliance with this agreement and allow for reasonable audits.

Transfers outside the European Economic Area rely on adequacy decisions or the standard contractual clauses, which are incorporated by reference where needed.