Data processing addendum
This data processing addendum ("DPA") forms part of the Terms of service between Weesify ("Weesify", "Processor") and the customer who owns a Weesify workspace ("Customer", "Controller"). It applies whenever Weesify processes personal data on the Customer's behalf. It is designed to meet Article 28 of the GDPR and UK GDPR and the processor requirements of the CCPA, NDPA, UAE PDPL and POPIA. It takes effect automatically; workspace owners can also accept it in workspace settings for their records.
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR. "Customer Personal Data" means personal data processed by Weesify on the Customer's behalf through the Service. "Sub-processor" means a third party engaged by Weesify to process Customer Personal Data.
2. Roles
2.1. The Customer is the controller (or a processor acting for its own controller) of Customer Personal Data. Weesify is the processor (or sub-processor).
2.2. Weesify is an independent controller for data about the Customer's account, billing, security logs and fraud prevention, which is covered by our Privacy policy.
2.3. Under the CCPA, Weesify is a "service provider". It will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship, or combine it with other data except as the CCPA permits.
3. Details of processing
| Item | Description |
|---|---|
| Subject matter | Providing the Weesify Service |
| Duration | For the term of the Terms plus the deletion period in section 11 |
| Nature and purpose | Hosting, storage, display, analytics, communications (email), commerce and checkout, course and community delivery, events and bookings, AI-assisted features, support |
| Data subjects | The Customer's visitors, subscribers, contacts, buyers, students, members, attendees, affiliates and team members |
| Categories of data | Identifiers and contact details, order and transaction data, course progress, form responses, messages, booking and attendance data, device and cookieless analytics data, any other data the Customer chooses to collect |
| Special categories | Only if the Customer chooses to collect them, in which case the Customer is responsible for a lawful basis |
4. Weesify's obligations
Weesify will:
4.1. process Customer Personal Data only on the Customer's documented instructions (these Terms, the Customer's configuration of the Service, and written instructions), unless the law requires otherwise, in which case Weesify will tell the Customer first unless the law forbids it;
4.2. tell the Customer if it believes an instruction breaks data protection law;
4.3. make sure everyone authorised to process the data is bound by confidentiality;
4.4. implement the security measures in section 6;
4.5. assist the Customer, taking into account the nature of the processing, with data subject requests, data protection impact assessments and prior consultations;
4.6. make available the information necessary to demonstrate compliance and allow audits as described in section 10.
5. Sub-processors
5.1. The Customer gives general authorisation for Weesify to use sub-processors. Weesify imposes data protection terms on each sub-processor that are at least as protective as this DPA and remains responsible for their performance.
5.2. Current categories of sub-processor:
| Category | Purpose | Typical location |
|---|---|---|
| Cloud hosting and database | Running the application and storing data | Region chosen for the deployment, with backups in the same or an adequate region |
| Object storage and content delivery | Storing and serving media and files | Global edge network |
| Email delivery | Sending transactional and marketing emails | EU / US |
| Payment processing (Stripe, Paystack, Flutterwave, PayPal) | Processing payments, payouts and fraud checks (partly as independent controllers) | Global |
| AI model providers | Generating AI output on request; no training on Customer data | US / EU |
| Error monitoring and logging | Diagnosing faults | EU / US |
| Customer support tools | Answering support requests | EU / US |
5.3. A current named list is available on request from privacy@weesify.com. Weesify will give at least 30 days' notice of a new sub-processor by email or in the app. The Customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.
6. Security measures
Weesify maintains appropriate technical and organisational measures, including:
- encryption in transit (TLS 1.2 or higher) and at rest;
- passwords stored with a strong one-way hash; two-factor authentication for accounts and mandatory for staff access;
- logical separation of each workspace's data and authorisation checks on every request;
- least-privilege, role-based staff access with audit logging;
- network protection, rate limiting and abuse detection;
- regular backups and tested restoration;
- secure development, code review, dependency updates and vulnerability management, including a responsible disclosure programme;
- cookieless analytics using daily-rotating salted hashes in place of identifiers;
- staff confidentiality agreements and security training;
- incident response procedures.
7. Personal data breaches
7.1. Weesify will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
7.2. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases.
7.3. Weesify will take reasonable steps to contain and remedy the breach and will cooperate with the Customer's own notification obligations. Notification is not an admission of fault.
8. International transfers
8.1. Weesify may transfer Customer Personal Data outside the EEA, UK, Switzerland or another country with transfer rules only with appropriate safeguards.
8.2. Where required, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated by reference, with Clause 7 (docking) included, Clause 9 option 2 (general authorisation, 30 days' notice), Clause 11 optional language omitted, Clauses 17 and 18 governed by the law of, and courts of, Ireland. The annexes are completed with the information in sections 3, 5 and 6 of this DPA.
8.3. For UK transfers, the UK International Data Transfer Addendum to the SCCs applies; for Swiss transfers, the SCCs apply with the references adapted to the Swiss FADP. For transfers subject to the NDPA, UAE PDPL or POPIA, the SCCs are used as the appropriate safeguard to the extent those laws recognise them, together with the measures in section 6.
9. Data subject requests
If Weesify receives a request from a data subject about Customer Personal Data, it will pass it to the Customer and not respond itself except to confirm the request was passed on. The Service includes tools to find, export, correct and delete contact data.
10. Audits
Weesify will answer reasonable written security and compliance questionnaires once a year and provide summaries of relevant third-party certifications or audit reports where available. If these are not enough to demonstrate compliance, or a regulator requires it, the Customer may carry out an audit on 30 days' notice, at its own cost, during business hours, subject to confidentiality and without access to other customers' data.
11. Return and deletion
On termination, the Customer can export its data for 30 days. Weesify will then delete Customer Personal Data from live systems within 30 days and from backups within a further 35 days, unless the law requires it to keep it, in which case it will be protected and processed only for that purpose.
12. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow it. If this DPA conflicts with the Terms, this DPA applies to the processing of Customer Personal Data; if it conflicts with the SCCs, the SCCs apply.
13. Contact
Processor: Weesify, the address shown on your invoice. Data protection officer: privacy@weesify.com.