Data Processing Agreement (DPA) — FizzUp B2B

1. Purpose and limited scope

This DPA forms part of the B2B agreement between the Customer and DB 77 CUW Sp. z o.o. (“FizzUp”) and applies only to processing where:

• the Customer acts as controller, and
• FizzUp acts as processor on the Customer's documented instructions.

The DPA does not cover the User's Private Coaching Layer, for which FizzUp acts as an independent controller under the Privacy Policy and Enterprise Terms.

The parties therefore apply a mixed model: FizzUp processes roster and status data (who was invited, who activated the account, who completed onboarding) on the Customer's behalf as processor, while the participant's private coaching data are FizzUp's own data as an independent controller and are not provided to the Customer.

2. Processing covered by the DPA

The DPA may cover:

1. Organisation Admin data supplied by the Customer;
2. lists of intended invitees, such as name, work email and organisation identifier;
3. seat assignment and administration on the Customer's instructions;
4. organisation-workspace administration data;
5. Customer Materials processed to create or deliver scenarios within the Customer organisation;
6. support processing performed on a documented Organisation Admin request;
7. organisation billing metadata to the extent the Customer is the relevant controller.

3. Processing excluded from the DPA

After the User independently activates their account, the DPA excludes in particular:

• private conversations and transcripts;
• errors, educational scoring, goals, plans and user memory;
• detailed session history;
• individualized recommendations and educational inferences;
• private recordings;
• other Private Coaching Layer data.

The Customer may not instruct FizzUp under this DPA to disclose, modify, delete or otherwise use the Private Coaching Layer as if the Customer were its controller. Data-subject rights for that layer are exercised against FizzUp in its independent-controller capacity.

4. Duration

This DPA applies for as long as FizzUp processes Entrusted Data for the Customer and for the technical period required to securely return/delete such data after the agreement ends, subject to legal-retention obligations.

5. Categories of data subjects and data

Data subjects

• Organisation Admins;
• intended invitees before/at account activation;
• employees/contractors whose data appear in Customer Materials;
• Customer contact persons.

Data

• name/account label;
• work email and organisation identifier;
• role/permissions in the organisation;
• invitation, activation and seat-assignment status;
• role and department in the organisation and onboarding-completion status;
• aggregated programme statistics (only for groups of at least 10 active people), which are not personal data about specific participants;
• personal data contained in Customer Materials;
• support data submitted by an Organisation Admin.

Special-category data are not an intended part of the DPA scope and should not be submitted in Customer Materials without prior agreement and an appropriate legal basis.

6. Nature and purpose

Operations may include collection, recording, organisation, storage, access within the workspace, deletion and other operations necessary to:

• create and administer the organisation;
• invite users and assign seats;
• provide agreed organisation functions;
• process Customer Materials;
• provide security and support.

7. Customer instructions

FizzUp processes Entrusted Data only on documented Customer instructions unless EU or Member State law requires otherwise. In that case, FizzUp informs the Customer before processing unless prohibited by law.

Instructions arise from the agreement, Order Form, Organisation Admin settings and agreed support requests.

FizzUp informs the Customer if an instruction appears to infringe the GDPR or other data-protection law and may suspend execution until clarified.

7.1 Customer rights and obligations

The Customer determines the purposes and means of processing Entrusted Data and retains the controller rights provided by the GDPR. The Customer is responsible for the lawfulness of its instructions, the appropriate legal basis, required transparency to data subjects, the accuracy of supplied data and the permission scope granted to Organisation Admins. The Customer must not instruct FizzUp to process data beyond the agreed scope without first documenting the change.

8. Personnel confidentiality

FizzUp ensures that persons authorised to process Entrusted Data are subject to confidentiality obligations and have access only to the extent required for their role.

9. Security

FizzUp implements measures appropriate to risk under Article 32 GDPR, including as appropriate:

• encrypted transport;
• access control and least privilege;
• strong administrative authentication;
• logical tenant separation;
• backup and disaster recovery;
• security logging and monitoring;
• vulnerability and patch management;
• incident-response procedures;
• provider/subprocessor management;
• secure software development and deployment processes.

Detailed TOMs may be supplied in a security annex while protecting sensitive security information.

10. Subprocessors

FizzUp may use subprocessors listed in the public provider registry. FizzUp imposes appropriate data-protection obligations on subprocessors and remains responsible to the Customer for their performance as required by Article 28 GDPR.

As of this version, Entrusted Data are processed in particular by: Railway (application and database hosting), Hostinger (sending invitation and notification emails via SMTP, and FizzUp mailboxes and domain, for correspondence with the Customer) and Stripe (Customer billing). The full registry is in “Subprocessors and Providers”.

The Customer grants general written authorisation for the use of subprocessors. FizzUp gives at least 30 days' prior notice of each intended addition or replacement of a subprocessor that will process Entrusted Data. The Customer may raise a reasonable data-protection objection. The parties will work in good faith on a reasonable solution; if none is available, the Customer may discontinue the affected feature or terminate the affected service component before the new subprocessor begins processing.

11. International transfers

FizzUp ensures a lawful transfer mechanism for Entrusted Data outside the EEA where applicable, including an adequacy decision, the EU-US DPF for an eligible recipient, or appropriate Standard Contractual Clauses with transfer assessment and supplementary measures where needed.

12. Assistance with data-subject rights

Taking into account the nature of processing, FizzUp reasonably assists the Customer through appropriate technical and organisational measures in responding to requests concerning Entrusted Data.

If FizzUp receives a request concerning only data for which the Customer is controller, FizzUp may redirect the individual to the Customer and notify the Customer.

If a request concerns the Private Coaching Layer, FizzUp handles it in its own controller capacity and does not disclose the content of the request to the Customer except where legally required.

13. Personal-data breaches

FizzUp notifies the Customer of a personal data breach affecting Entrusted Data without undue delay after becoming aware of it and provides, as information becomes available, details reasonably required for the Customer's obligations under Articles 33–34 GDPR. Information may be provided in phases as the incident analysis progresses.

A notice is not an admission of liability.

14. DPIA and prior consultation

Taking into account the nature of processing and information available to FizzUp, FizzUp provides reasonable assistance with DPIAs and prior consultation relating to Entrusted Data.

15. Audits and compliance information

FizzUp provides information reasonably necessary to demonstrate Article 28 compliance. The parties first rely on existing reports, certifications, security answers and documentation.

If insufficient, the Customer may conduct an audit no more than once per year and additionally after a material incident affecting Entrusted Data, on reasonable notice, during business hours, subject to confidentiality and without unreasonable disruption. The Customer bears its audit costs unless the audit identifies a material DPA breach by FizzUp.

16. Return and deletion of Entrusted Data

After services involving Entrusted Data end, FizzUp — at the Customer's choice where technically and legally appropriate — returns or deletes Entrusted Data and deletes existing copies except where retention is required by law.

Data removed from active systems may remain for a limited period in secured, rotating backups according to infrastructure-provider schedules and disaster-recovery procedures. They are not used for the ongoing provision of the service. Following disaster recovery, the agreed deletion instruction is re-applied to the extent technically possible and legally required.

This section does not require deletion of a User's Private Coaching Layer merely because the organisation agreement ends. That data is governed by the Privacy Policy and FizzUp–User relationship.

17. Liability and precedence

Liability relating to this DPA is subject to the limits in the Enterprise Terms/Order Form to the extent permitted by law. If there is a conflict concerning Article 28 GDPR obligations, this DPA prevails.

18. Governing law

Unless the Order Form states otherwise, this DPA follows the governing law of the main agreement, without prejudice to directly applicable GDPR provisions.

The Polish version of this DPA controls in the event of a discrepancy with the English translation unless the Order Form expressly provides otherwise.