Auftragsverarbeitungsvertrag

This Data Processing Addendum ("DPA") is between the business that uses Zellwo ("Customer", "you") and SmartWay America, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States ("Zellwo", "we"). It governs the personal data we process for you when you use Zellwo.

The DPA forms part of the Terms of Service and takes effect when you accept them. No signature is needed. If your procurement process needs a countersigned copy, write to [email protected] and we will send one.

1. Definitions

• Data Protection Law: every law that applies to the processing of personal data under this DPA, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, US state privacy laws such as the CCPA/CPRA, Canada's PIPEDA, Brazil's LGPD and Australia's Privacy Act.
• Customer Data: personal data that you, your staff, your customers or your systems put into Zellwo, or that Zellwo collects for you through the widget, email, SMS, events, connectors and web research.
• Standard Contractual Clauses or SCCs: the clauses in European Commission Decision 2021/914 of 4 June 2021.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018.
• "Controller", "processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given in the GDPR; "business", "service provider", "sell" and "share" have the meanings given in the CCPA/CPRA.

2. Roles

For Customer Data, you are the controller (or a processor acting for your own client) and we are your processor. Under the CCPA/CPRA you are the business and we are your service provider. Where you act as a processor for your own client, you confirm that your client's instructions are compatible with this DPA.

We are the controller for the data described in Part A of the Privacy Policy (your account, your staff's account data, usage logs and our own business records). That data is outside this DPA.

3. Details of the processing

4. Instructions

We process Customer Data only on your documented instructions. Your instructions are: the Terms of Service, this DPA, the settings you choose in the product, and the actions you and your staff take in the dashboard, the API and the MCP server. If we believe an instruction breaks Data Protection Law, we tell you and may pause that processing until it is resolved.

We may process Customer Data where the law we are subject to requires it; in that case we tell you before processing, unless the law forbids it.

We do not sell or share Customer Data, do not retain, use or disclose it outside the direct business relationship with you or for any purpose other than providing Zellwo, and do not combine it with personal data from other sources except as the service needs (for example, to recognise the same contact across channels). We do not use Customer Data to train AI models, and our AI providers do not either.

5. Confidentiality

Only staff who need access to Customer Data to provide, support or secure Zellwo may access it. They are bound by confidentiality obligations and trained on data protection. Access to a workspace by our staff is logged.

6. Security

We keep the following technical and organisational measures, and we may improve them, but not reduce them materially, during the term:

• encryption in transit (TLS) for every connection to Zellwo, including the widget, the API, the MCP server and our connections to subprocessors;
• encryption at rest for the credentials you connect (mailboxes, SMS accounts, API keys) and for backups;
• one database schema per workspace, so one customer's data cannot be read through another customer's workspace;
• per-staff permissions and record scopes set by you; API tokens and MCP grants limited to the permissions of the person who created them; OAuth 2.1 with per-grant limits for the API and MCP;
• logging of administrative access and of every AI call and connector call;
• AI inference by OpenAI under a zero-retention agreement;
• hosting in a data centre in Frankfurt, Germany, served through Cloudflare;
• daily encrypted backups kept 30 days;
• a vulnerability reporting address, [email protected], answered within two working days.

You are responsible for the security of your own credentials, of the systems you connect, of your staff's devices, and for choosing permissions that fit your needs.

7. Subprocessors

You authorise us to use the subprocessors listed, with their role and country, on the trust page. Each is bound by a written contract with data protection obligations no less protective than this DPA. We remain responsible to you for their performance.

Before we add or replace a subprocessor, we update the trust page and notify workspace owners by email at least 30 days in advance. You may object within those 30 days on reasonable data protection grounds by writing to [email protected]. We will then try to find a solution; if none is found within 30 days of your objection, you may terminate the affected part of the service, or the Terms, with notice, and we refund any prepaid fees for the period after termination.

8. Assistance

Data subject requests. Zellwo gives you the tools to answer most requests yourself: you can view, correct and delete a contact and everything attached to it from the dashboard or the API. For a request you cannot complete with the product, we help within 10 working days of your written request. If a data subject writes to us about Customer Data, we forward the request to you and do not act on it without your instruction unless the law requires us to.

Impact assessments and consultations. On request we give you the information about Zellwo that you reasonably need for a data protection impact assessment or for a consultation with a supervisory authority.

Assistance that goes beyond what the product and our documentation provide may be charged at our then-current rates, agreed with you in advance.

9. Personal data breach

If we confirm a personal data breach affecting Customer Data, we notify the workspace owner without undue delay and in any case within 48 hours of confirming it. The notice describes what we know: the nature of the breach, the data and data subjects likely affected, the likely consequences, the measures we have taken or propose, and a contact. We update the notice as we learn more. We do not notify your data subjects or a supervisory authority on your behalf unless you ask us to or the law requires us to.

10. International transfers

Customer Data is hosted in Frankfurt, Germany. Transfers to us in the United States, and to subprocessors outside the EU, the EEA, the UK and Switzerland, take place under the following:

• EU and EEA. The SCCs are incorporated into this DPA by reference. Module Two (controller to processor) applies where you are a controller; Module Three (processor to processor) applies where you are a processor. For both: Clause 7 (docking) is included; Clause 9 uses Option 2, general authorisation, with the 30-day notice in section 7; the optional language in Clause 11 is not included; under Clause 13 the competent supervisory authority is the one of the EU member state where you are established or, if you are not established in the EU, the one determined under Clause 13(a); under Clause 17 the clauses are governed by the law of the EU member state where you are established, or Irish law if you are not; under Clause 18 disputes go to the courts of that member state, or Ireland. Annex I is section 3 of this DPA together with the parties named above; Annex II is section 6; Annex III is the trust page.
• United Kingdom. The UK Addendum is incorporated by reference and applies to transfers under the UK GDPR, with the SCCs completed as above and the tables of the Addendum completed with the information in this DPA. Either party may end the Addendum as set out in its section 19.
• Switzerland. For transfers under the Swiss FADP, the SCCs apply with these adaptations: references to the GDPR include the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, "member state" includes Switzerland so that Swiss data subjects may sue in Switzerland, and the clauses protect data about legal entities until the FADP stops doing so.
• Data Privacy Framework. Where a subprocessor is certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, we may rely on that certification for transfers to it in addition to the SCCs.

If a transfer mechanism we rely on becomes invalid, we work with you in good faith to put another lawful mechanism in place.

11. Deletion and return

During the term you control deletion: delete a contact and everything attached to it, purge records older than a period you choose, or close the workspace. Closing the workspace deletes all Customer Data at once. Encrypted backups are purged within 30 days after deletion. Logs of AI calls and connector calls are kept 30 days.

If you want a copy of your Customer Data before closing the workspace, write to [email protected] and we will provide one in a common machine-readable format within 30 days. After the workspace is closed we cannot recover its data.

We may keep Customer Data after termination only where the law requires it, for as long as it requires, and under this DPA.

12. Audits

We make available the information needed to show compliance with this DPA: this DPA, the trust page, our documentation, and written answers to a reasonable security questionnaire once in any 12-month period. Third-party certifications or audit reports, when we hold them, are shared under confidentiality on request.

An on-site or remote inspection by you or an independent auditor bound by confidentiality is available where a supervisory authority requires it, or after a personal data breach affecting your data, or where the written information shows a material gap. It is limited to once in any 12 months, with 30 days' written notice, during business hours, at your cost, without disturbing other customers, and under a confidentiality agreement.

13. Liability

Each party's liability under this DPA, including under the SCCs where the SCCs allow it, is subject to the limitations and exclusions in the Terms of Service. Nothing in this section limits a data subject's rights under the SCCs or Data Protection Law.

14. Order of precedence and other terms

If there is a conflict: the SCCs and the UK Addendum prevail over this DPA; this DPA prevails over the Terms of Service for matters of personal data; the Terms of Service govern everything else. If part of this DPA is invalid, the rest stands.

We may update this DPA to reflect changes in Data Protection Law or in Zellwo. For a material change we notify workspace owners at least 30 days in advance as described in the Terms of Service; a change that reduces your protection takes effect only for processing after that notice period.

This DPA is governed by the law and courts chosen in the Terms of Service, except where the SCCs or the UK Addendum choose otherwise for the matters they cover.

15. Contact

Data protection matters: [email protected]. EU, EEA, UK and Swiss contact: [email protected]. Security: [email protected].