Data Processing Agreement
This Data Processing Agreement ("DPA") applies when you, as a creator, use Writizzy to publish a blog and manage its audience. It forms part of our Terms and Conditions and is accepted with them. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR).
1. Roles
For the personal data of your blog's audience, you are the controller and Writizzy is the processor. We process that data only to provide the service to you.
This DPA does not cover the data we process for our own purposes as controller, such as creator and reader accounts, Discover and blog recommendations. Our Privacy Policy describes that processing.
2. Description of the processing
| Data subjects | Subscribers and members of your blog (free and paid), people who comment, react or vote on your posts, and visitors of your blog |
|---|---|
| Personal data | Email address, name, subscription tier and status, sign-up source (including imports), identifiers of paid subscriptions in your own Stripe account, newsletter delivery, open and click events, comments and the name and email left with them, and visit statistics (pages viewed, referrer, country, device, browser). IP addresses are not stored in visit statistics. Claps, poll votes and comments keep a hash of the IP address to prevent duplicates and abuse |
| Special categories | None are requested. You must not use the service to collect them |
| Purposes | Hosting your blog, managing subscriptions and memberships, sending your newsletters, collecting comments and reactions, and producing statistics for you |
| Duration | As long as you use the service. Visit statistics are kept for 90 days, 12 months or the life of the blog, depending on your plan |
3. Your responsibilities
- You have a legal basis for the data you collect and the emails you send
- When you import subscribers from another platform, you have obtained their consent. Imported subscribers are flagged as such
- You answer the requests of your audience about their data, with our help (section 7)
4. Our commitments
- We process the data only on your documented instructions, which are the settings and actions you take in the service. We tell you if an instruction seems to breach data protection law
- We never sell the data and never use it for our own purposes
- Anyone authorised to access the data is bound by confidentiality
- We protect the data with the measures described in section 9
5. Sub-processors
You authorise us to use the sub-processors listed in our Privacy Policy. Each one is bound by data protection obligations equivalent to this DPA. We keep that list up to date when a sub-processor is added or replaced.
6. International transfers
We host data in the EU wherever possible. When a sub-processor operates outside the EU, we rely on the EU-U.S. Data Privacy Framework when it is certified, and keep the European Commission's Standard Contractual Clauses in place as a fallback.
7. Help with your obligations
- Requests from your audience: you can export your subscribers, remove a subscriber and delete their data from your dashboard. For anything else, contact us and we will help
- If a person contacts us directly about data we process for you, we forward the request to you
- We give you the information you reasonably need for a data protection impact assessment or a request from a supervisory authority
8. Personal data breaches
We notify you without undue delay, and no later than 48 hours after becoming aware of a breach affecting your data. The notification describes the nature of the breach, the data and people concerned, its likely consequences, and the measures taken, so that you can meet your own 72-hour deadline towards the supervisory authority.
9. Security measures
- Encryption of data in transit (TLS)
- Passwords stored as hashes, never in clear text
- Daily backups
- Hosting in the EU
- Data minimisation: IP addresses are not stored in visit statistics
10. Audits
On request, we provide the information needed to show that we comply with this DPA.
11. End of the service
You can export your subscribers before leaving. When you delete a blog or your account, the audience data of that blog is deleted immediately and permanently from our production systems. Remaining copies disappear as backups rotate. Data we must keep by law is kept only for that purpose.
12. Precedence and law
If this DPA and the Terms and Conditions conflict on data protection, this DPA prevails. It is governed by French law. For any question, contact contact@writizzy.com.