Data Processing Addendum

This Data Processing Addendum (“Addendum”) is between you (“Customer”) and Doan Than trading as Wizel (“Wizel”) and forms part of our Terms of Service. Terms defined there have the same meaning here.

Our roles. For personal data you bring into the Services — your subscribers, your customers, the profiles and events you sync from a connected platform (“Customer Personal Data”) — you are the controller and Wizel is your processor. If you are an agency acting for a client, you are that client’s processor and Wizel is a sub-processor; you confirm you have your client’s authority to enter into this Addendum on their behalf.

For your own account and billing information, and for how we run our website and business, Wizel is an independent controller. That processing is described in our Privacy Policy rather than here.

Connected platforms are not our sub-processors. Klaviyo, Shopify, and Omnisend are your own systems. When data moves between them and Wizel it does so on your instruction and under your own agreement with those providers. We are not responsible for how they process your data.

The details required by Article 28(3) — subject matter, duration, nature and purpose, data types, and categories of data subject — are set out in Annex I.

Wizel will process Customer Personal Data only on your documented instructions, including for international transfers, unless required to do otherwise by law that applies to us — in which case we will tell you before processing, unless that law prohibits it on important grounds of public interest.

Your instructions are: this Addendum, the Terms, and your use of the features of the Services, your agreed service orders and documented instructions for that work (including any configuration you set and any generation, sync, export, or deletion you trigger). If we believe an instruction infringes data protection law, we will tell you and may pause that processing.

Wizel will not:

• sell or share Customer Personal Data, or process it for cross-context behavioural advertising;
• use Customer Personal Data to train our own AI models;
• process Customer Personal Data for our own purposes, or combine it with data from other customers, except to produce aggregated and de-identified statistics that cannot identify you, your customers, or any individual;
• retain, use, or disclose Customer Personal Data outside the direct business relationship with you; or
• disclose Customer Personal Data to a government or law-enforcement body unless legally compelled, and we will notify you first unless prohibited.

AI providers. To generate the output you request, we send the brand, product, and campaign context needed for that generation to the AI providers in Annex III. We use those providers on terms intended to prevent them from training on your content, and we do not route subscriber contact records to them as part of normal content generation. You remain responsible for what you place into a prompt. Content creation may involve our authorised personnel and service providers processing personal data contained in briefs, images, references, drafts, and review comments. We limit access and submissions to what your instructions require; all obligations in this Addendum continue to apply, including confidentiality, sub-processor safeguards, transfers, and deletion. We do not opt Customer Personal Data into provider model training or submit it as feedback for model improvement.

You warrant and agree that:

• you have a lawful basis for collecting Customer Personal Data and for having us process it, and you have given every required notice and obtained every required consent;
• your instructions to us comply with applicable data protection law, and processing them will not put us in breach of it;
• you will not upload or sync special-category, sensitive, children's, health, biometric, genetic, precise-location, or government-identifier data, and you accept that the Services are not designed to protect data of that kind;
• you will configure the Services, manage user access, and set retention appropriately for the sensitivity of the data you bring in; and
• where you are an agency, you have each client's authority for everything you do in the Services on their behalf.

Wizel ensures that every person authorised to process Customer Personal Data — employees and contractors alike — is bound by a written confidentiality obligation before access is granted, is subject to the access controls in our Information Security Program, and has access only to what their role requires. Access is revoked within 24 hours of a person leaving or an engagement ending.

Wizel implements appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, as required by Article 32. Those measures are described in full in our Information Security Program, which forms Annex II to this Addendum and includes:

• encryption of data in transit (TLS 1.2 or higher) and at rest;
• least-privilege and need-to-know access control, with multi-factor authentication on administrative systems and unique credentials per service;
• network isolation of databases, a WAF and CDN in front of the application, and rate limiting on authentication and sensitive endpoints;
• secure development practices, dependency scanning, and risk-prioritised vulnerability remediation on defined timeframes;
• logging and monitoring of authentication and security events, with alerting;
• encrypted backups stored separately from primary systems, with tested restore procedures; and
• a defined incident response process.

We may update these measures as the Services evolve, provided the overall level of protection is not reduced.

You give Wizel general written authorisation to engage sub-processors to help provide the Services. Before a sub-processor receives Customer Personal Data, we impose data protection obligations on it that are no less protective than those in this Addendum, and we remain fully liable to you for its performance.

Our current sub-processors are listed in Annex III. We will give you at least 30 days’ notice — by email to your account address or in the Services — before adding or replacing one. If you have a reasonable data-protection objection, tell us within those 30 days and we will work in good faith to find an alternative. If we cannot, you may terminate the affected part of the Services and receive a pro-rata refund of any prepaid, unused fees.

To be notified of sub-processor changes, email privacy@wizel.ai and ask to be added to the notification list.

Wizel is based in Australia and uses sub-processors that may process data in the United States, the European Union, and elsewhere. Where Customer Personal Data protected by EU, UK, or Swiss law is transferred to a country without an adequacy decision:

• the European Commission's Standard Contractual Clauses (Decision 2021/914) are incorporated into this Addendum by reference and apply to the transfer — Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor acting for your own client;
• the UK International Data Transfer Addendum to the SCCs applies to transfers subject to UK law;
• the Swiss supplements apply to transfers subject to Swiss law, with references to the GDPR read as references to the Swiss FADP; and
• we carry out transfer risk assessments and apply supplementary measures — encryption in transit and at rest, access control, and data minimisation — where appropriate.

For the purposes of the SCCs: you are the data exporter and Wizel is the data importer; Annex I of this Addendum supplies the details of processing and the parties; Annex II supplies the technical and organisational measures; Annex III supplies the authorised sub-processors; the optional docking clause applies; and the governing law and forum are those of Ireland where the SCCs require an EU member state, and otherwise those stated in our Terms.

Australian customers: cross-border disclosure is handled in accordance with Australian Privacy Principle 8, and we take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs.

The Services give you tools to access, correct, export, and delete Customer Personal Data yourself, which is usually the fastest way to answer a data-subject request.

Where a data subject contacts Wizel directly about data we process on your behalf, we will not respond substantively — we will refer them to you and let you know, unless the law requires otherwise. Taking into account the nature of the processing, we will provide reasonable assistance with your obligation to respond to requests for access, rectification, erasure, restriction, portability, and objection, including by helping you locate or extract data where the self-service tools do not cover it. We may charge for assistance that is unreasonably burdensome or repetitive, having told you first.

Wizel will notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data — sooner where we can, so that you can meet your own 72-hour regulator deadline.

Our notification will include, to the extent known:

• the nature of the breach, including the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures taken or proposed to address it and mitigate harm; and
• a contact point for further information.

Where we cannot provide all of that at once, we will provide it in phases without further undue delay. We will cooperate with you and take reasonable steps to help you investigate, mitigate, and remediate, and will not make a public statement identifying you without your consent unless legally required.

As an Australian entity we also assess breaches under the Notifiable Data Breaches scheme and will notify the OAIC and affected individuals where the scheme requires it of us.

You are responsible for notifying your own regulators and data subjects where you are the controller, and for any breach arising from your own systems, credentials, or connected platforms.

Taking into account the nature of the processing and the information available to us, Wizel will provide reasonable assistance with your data protection impact assessments and any prior consultation with a supervisory authority relating to your use of the Services. In most cases this Addendum, our Privacy Policy, and our Information Security Program contain what a DPIA needs; ask us at privacy@wizel.ai if you need more.

You can export and delete Customer Personal Data at any time using the Services.

On termination or expiry, we keep your Customer Content available for export for 30 days. After that — or sooner if you ask us in writing — we will delete Customer Personal Data from our production systems within a further 30 days, and it will age out of encrypted backups on our normal rolling backup cycle, which does not exceed 90 days. We will confirm deletion in writing on request.

We may retain Customer Personal Data where law requires it, and we may retain aggregated, de-identified data that cannot be linked back to you, your customers, or any individual. Anything retained stays protected by this Addendum and is processed only for the purpose that required its retention.

Wizel will make available the information reasonably necessary to demonstrate compliance with Article 28 — including this Addendum, our Information Security Program, our sub-processor list, and responses to a reasonable security questionnaire — at no charge, once per year and additionally after a personal data breach affecting your data.

Where a documentary response genuinely does not satisfy a requirement of applicable law, you (or an independent auditor bound by confidentiality and not a competitor of Wizel) may audit our compliance, on at least 30 days’ written notice, no more than once per year, during business hours, in a way that does not disrupt the Services or compromise another customer’s confidentiality or data. You bear the cost of that audit unless it reveals a material breach by us.

Where the California Consumer Privacy Act as amended by the CPRA, or a comparable US state privacy law, applies to Customer Personal Data, Wizel acts as a service provider (or processor) and not as a third party. We:

• will not sell or share personal information, as those terms are defined in that law;
• will not retain, use, or disclose personal information for any purpose other than performing the Services for you, or as otherwise permitted by that law;
• will not retain, use, or disclose personal information outside the direct business relationship between us;
• will not combine personal information received from you with personal information received from anyone else, except as that law permits;
• will comply with the obligations that law places on a service provider and provide the same level of privacy protection it requires; and
• will notify you if we determine we can no longer meet those obligations, and will let you take reasonable steps to stop and remediate unauthorised use.

You may take reasonable and appropriate steps to confirm we are using personal information consistently with your obligations under that law, using the mechanism in section 12.

Each party’s liability under this Addendum is subject to the exclusions and limitations of liability in our Terms of Service. Nothing in this Addendum limits a data subject’s rights under applicable data protection law, or either party’s liability to a supervisory authority.

If there is a conflict, the Standard Contractual Clauses prevail over this Addendum for the transfers they cover, this Addendum prevails over the Terms of Service and the Privacy Policy for the processing of Customer Personal Data, and the Terms of Service govern everything else. This Addendum terminates automatically when the Terms terminate and the retention periods in section 11 expire.

Annex I — Details of processing

Parties and competent authority. Data exporter: the Customer, whose identity and contact details are those on its Wizel account, acting as controller (or as processor for its own clients). Data importer: Doan Than trading as Wizel, of New South Wales, Australia, contactable at privacy@wizel.ai, acting as processor. The frequency of transfer is continuous for the duration of the subscription or agreed service order. Where the SCCs require a competent supervisory authority, it is that of the EEA member state in which the data exporter is established, or the Irish Data Protection Commission where the exporter is not established in the EEA.

Annex II — Technical and organisational measures

The measures described in section 5 above and set out in full in our Information Security Program, which is incorporated here by reference.

Annex III — Sub-processors

The providers below help us deliver the Services. The last column says whether that provider can receive personal data — either your end customers’ or your own users’ — limited personal data included in creative materials, or only brand, catalogue, and infrastructure data.

Limited. AI providers may receive personal data included in the inputs and outputs needed for the requested work, such as names, images of people, testimonials, and review comments. Content creation does not authorise sending entire subscriber lists or unrelated customer records to these providers. Provider retention and international transfers remain subject to this Addendum; using a service provider does not create a separate exception.