Data Processing Addendum

1. Scope and parties

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Palzin LLC (“Processor”, “we”) and the customer (“Controller”, “you”). It applies when we process personal data in customer data on your behalf, and it takes effect when you accept the Terms. No signature is needed.

“Data Protection Laws” means the laws that apply to that processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP and the California Consumer Privacy Act. Terms such as personal data, processing, controller, processor and data subject have the meanings those laws give them. If you are yourself a processor, we are your sub-processor and this DPA applies in the same way.

2. Details of the processing

• Subject matter and purpose: providing LogZuno: receiving, storing, analysing and reporting on events, pageviews and user profiles, and sending the alerts you configure.
• Duration: while you use LogZuno, and until the data is deleted as described in section 9.
• Data subjects: your end users, your website and app visitors, and your team members.
• Personal data: what you choose to send, typically user IDs, names, email addresses, account and group IDs, event names and properties, pageview URLs and referrers, browser, device and country. IP addresses are used once, at ingest, and not stored.
• Special categories: none. You agree not to send them.

3. Your instructions

We process personal data only on your documented instructions: the Terms, this DPA and your settings and use of LogZuno. We will tell you if we believe an instruction breaks Data Protection Laws. We don't sell or share the data, use it for our own purposes, or combine it with other data, except as the law allows a service provider to. You are responsible for having a lawful basis and giving notices for the data you send.

4. Confidentiality

Everyone at Palzin LLC who can access personal data is bound by confidentiality and has access only as far as their work requires.

5. Security

We maintain appropriate technical and organisational measures to protect personal data, including per-organisation database partitions with row-level security, encryption in transit, hashed API keys, two-factor authentication, role-based access, audit logs and backups. They are described on Security at LogZuno. We may improve them, but won't reduce the overall level of protection.

6. Sub-processors

You authorise us to use the sub-processors below. Each is bound by written terms that protect personal data at least as well as this DPA, and we remain responsible for them.

We will update this list and email account owners at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us at [email protected] within that time; if we can't resolve it, you may end the affected service and receive a refund of prepaid fees for the unused period.

7. Data subject requests and assistance

You can find and export a person's data in LogZuno. To delete one person's data before it expires, email us their user ID and we will delete it within 30 days. If a data subject contacts us directly, we will pass the request to you rather than answer it. We will reasonably help you respond to requests, carry out data protection impact assessments and consult authorities, taking into account the nature of the processing.

8. Personal data breaches

We will notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data. We will tell you what we know, what we are doing about it and who to contact, and update you as we learn more.

9. Deletion and return

Events and pageviews are deleted after 90 days. You can export your data at any time. When you delete an organisation, or after your subscription ends and the retention periods in the Privacy Policy pass, we delete the personal data, unless the law requires us to keep it. Backups are overwritten on a rolling schedule.

10. Audits

We will make available the information reasonably needed to show compliance with this DPA, including answering security questionnaires once a year. If that isn't enough, or an authority requires it, you may audit us with 30 days' notice, at your cost, during business hours and under confidentiality.

11. International transfers

LogZuno's servers are in the United States or India, and some sub-processors are in the United States. For transfers of personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Commission Decision 2021/914): Module Two where you are a controller and Module Three where you are a processor, with clause 7 included, option 2 of clause 9 with the notice period in section 6, the optional language in clause 11 omitted, and Irish law and courts in clauses 17 and 18. For the UK, the UK Addendum to those clauses applies; for Switzerland, references to the GDPR are read as references to the FADP. Sections 2 and 5 of this DPA provide the information for the clauses' annexes.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms, as far as Data Protection Laws allow. If this DPA conflicts with the Terms, this DPA wins; if it conflicts with the Standard Contractual Clauses, the clauses win.