Skip to main content
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Bizcust Limited (“Processor”, “we”, “us”, or “our”) and the customer (“Controller” or “Customer”) using Bizcust (the “Service”). This DPA governs the processing of Personal Data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

​
1. Definitions

For the purposes of this DPA: Personal Data
Any information relating to an identified or identifiable natural person. Processing
Any operation performed on personal data, including collection, storage, use, disclosure, or deletion. Controller
The entity that determines the purposes and means of processing personal data. Processor
The entity that processes personal data on behalf of the Controller. Data Subject
An identified or identifiable individual whose personal data is processed.

​
2. Scope of Processing

This DPA applies when the Customer uploads, stores, or processes personal data using the Service. The Company acts as a Data Processor and processes personal data solely on behalf of the Customer. The Customer acts as the Data Controller.

​
3. Processing Instructions

The Processor shall process personal data only:
  • in accordance with the Customer’s documented instructions
  • as necessary to provide the Service
  • as required by applicable law
If applicable law requires processing beyond the Customer’s instructions, the Processor will inform the Customer unless legally prohibited.

​
4. Categories of Data Subjects

Personal data processed under this DPA may include:
  • users of the Customer’s services
  • employees or contractors
  • customers or clients
  • other individuals whose data is submitted to the Service

​
5. Types of Personal Data

Depending on how the Service is used, personal data may include:
  • names
  • email addresses
  • user identifiers
  • communication content
  • IP addresses
  • metadata and usage information
The Customer determines what personal data is submitted to the Service.

​
6. Security Measures

The Processor implements appropriate technical and organizational measures to protect personal data. These measures may include:
  • encryption in transit
  • access control systems
  • monitoring and logging
  • infrastructure security practices
  • vulnerability management
Security measures are designed to protect against:
  • unauthorized access
  • accidental loss
  • alteration
  • disclosure of personal data

​
7. Confidentiality

The Processor ensures that personnel authorized to process personal data:
  • are bound by confidentiality obligations
  • receive appropriate data protection training

​
8. Subprocessors

The Processor may engage third-party subprocessors to operate the Service. Subprocessors may provide services such as:
  • cloud hosting
  • infrastructure
  • monitoring
  • analytics
  • email delivery
The Processor ensures that subprocessors are bound by data protection obligations consistent with this DPA. A list of subprocessors may be provided upon request.

​
9. International Data Transfers

Personal data may be transferred to countries outside the European Economic Area (EEA). When such transfers occur, the Processor ensures appropriate safeguards, such as:
  • Standard Contractual Clauses (SCCs)
  • adequacy decisions by the European Commission
  • other legally approved mechanisms

​
10. Data Subject Rights

The Processor shall assist the Controller in fulfilling data subject requests, including:
  • access requests
  • correction requests
  • deletion requests
  • data portability requests
  • restriction or objection requests
The Controller remains responsible for responding to such requests.

​
11. Data Breach Notification

In the event of a personal data breach, the Processor shall:
  • notify the Controller without undue delay
  • provide relevant information about the breach
  • cooperate in investigating and mitigating the breach

​
12. Data Retention and Deletion

Upon termination of the Service or upon Customer request, the Processor shall:
  • delete personal data
  • or return personal data to the Customer
unless retention is required by applicable law.

​
13. Audits

The Controller may request reasonable information to verify the Processor’s compliance with this DPA. Such requests must:
  • be reasonable in scope
  • not compromise the security of other customers
  • occur with reasonable notice

​
14. Liability

Each party’s liability under this DPA shall be subject to the limitations set forth in the Terms of Service. Nothing in this DPA limits liability where such limitation is prohibited by applicable law.

​
15. Governing Law

This DPA shall be governed by the laws of USA, unless otherwise required by GDPR.

​
16. Contact Information

If you have questions regarding this DPA, contact us: Email: [email protected] Company: Bizcust Limited Address: -