Data Processing Agreement

This Data Processing Agreement ("DPA") applies when you, as a creator, use Writizzy to publish a blog and manage its audience. It forms part of our Terms and Conditions and is accepted with them. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR).

1. Roles

For the personal data of your blog's audience, you are the controller and Writizzy is the processor. We process that data only to provide the service to you.

This DPA does not cover the data we process for our own purposes as controller, such as creator and reader accounts, Discover and blog recommendations. Our Privacy Policy describes that processing.

2. Description of the processing

Data subjects	Subscribers and members of your blog (free and paid), people who comment, react or vote on your posts, and visitors of your blog
Personal data	Email address, name, subscription tier and status, sign-up source (including imports), identifiers of paid subscriptions in your own Stripe account, newsletter delivery, open and click events, comments and the name and email left with them, and visit statistics (pages viewed, referrer, country, device, browser). IP addresses are not stored in visit statistics. Claps, poll votes and comments keep a hash of the IP address to prevent duplicates and abuse
Special categories	None are requested. You must not use the service to collect them
Purposes	Hosting your blog, managing subscriptions and memberships, sending your newsletters, collecting comments and reactions, and producing statistics for you
Duration	As long as you use the service. Visit statistics are kept for 90 days, 12 months or the life of the blog, depending on your plan

3. Your responsibilities

You have a legal basis for the data you collect and the emails you send
When you import subscribers from another platform, you have obtained their consent. Imported subscribers are flagged as such
You answer the requests of your audience about their data, with our help (section 7)

4. Our commitments

We process the data only on your documented instructions, which are the settings and actions you take in the service. We tell you if an instruction seems to breach data protection law
We never sell the data and never use it for our own purposes
Anyone authorised to access the data is bound by confidentiality
We protect the data with the measures described in section 9

5. Sub-processors

You authorise us to use the sub-processors listed in our Privacy Policy. Each one is bound by data protection obligations equivalent to this DPA. We keep that list up to date when a sub-processor is added or replaced.

6. International transfers

We host data in the EU wherever possible. When a sub-processor operates outside the EU, we rely on the EU-U.S. Data Privacy Framework when it is certified, and keep the European Commission's Standard Contractual Clauses in place as a fallback.

7. Help with your obligations

Requests from your audience: you can export your subscribers, remove a subscriber and delete their data from your dashboard. For anything else, contact us and we will help
If a person contacts us directly about data we process for you, we forward the request to you
We give you the information you reasonably need for a data protection impact assessment or a request from a supervisory authority

8. Personal data breaches

We notify you without undue delay, and no later than 48 hours after becoming aware of a breach affecting your data. The notification describes the nature of the breach, the data and people concerned, its likely consequences, and the measures taken, so that you can meet your own 72-hour deadline towards the supervisory authority.

9. Security measures

Encryption of data in transit (TLS)
Passwords stored as hashes, never in clear text
Daily backups
Hosting in the EU
Data minimisation: IP addresses are not stored in visit statistics

10. Audits

On request, we provide the information needed to show that we comply with this DPA.

11. End of the service

You can export your subscribers before leaving. When you delete a blog or your account, the audience data of that blog is deleted immediately and permanently from our production systems. Remaining copies disappear as backups rotate. Data we must keep by law is kept only for that purpose.

12. Precedence and law

If this DPA and the Terms and Conditions conflict on data protection, this DPA prevails. It is governed by French law. For any question, contact contact@writizzy.com.