Data processing agreement

This data processing agreement (“DPA”) is part of our terms of service and applies on every plan, with no need to sign anything. It sets out how Wall & Fifth (“we”, “us”), the studio that makes Dazza, processes personal data on behalf of you, the business using Dazza (“you”), as required by Article 28 of the UK GDPR and, where it applies, the EU GDPR. Enterprise customers can agree their own terms instead.

Roles

For personal data in your workspace (your customers’ messages and contact details, the conversations Dazza has for you, and anything you add to Dazza’s knowledge), you are the controller and we are your processor. For the details of the people on your team and how they use Dazza, and for running our own business, we are a controller, as set out in our privacy policy.

What we process, and why

Subject matter and purpose: providing Dazza to you: answering your customers, running the workflows and tools you set up, sending replies on the channels you connect, and showing conversations and insights to your team.
Duration: for as long as you use Dazza, and then until we delete your data as described below.
People: your customers and website visitors who talk to Dazza, and anyone named in content you add.
Personal data: names, email addresses, phone numbers and messaging IDs; message content; files customers send (photos, screenshots, PDFs), which are stored with the conversation in our database in London; the details workflows collect; signed-in customer details your systems pass to Dazza; and technical data such as the page a chat started on.
Special category data: Dazza isn’t designed for it. Don’t set up workflows that ask for it. If customers send it anyway, it’s protected like everything else.

What we promise

We will:

Process personal data only on your documented instructions, which are these terms and how you set up and use Dazza, unless the law requires otherwise (and then we’ll tell you first, unless the law forbids that). If we think an instruction breaks data protection law, we’ll tell you straight away.
Never sell your workspace’s personal data, use it for our own purposes (beyond counts that identify no one, such as how many conversations Dazza handled), or use it to train AI models. Our AI provider doesn’t train its models on it either, under the commercial terms we use it on.
Make sure everyone who can access it is bound to keep it confidential.
Keep it secure with the measures described on our security page: encryption in transit and at rest, access limited to your workspace and to the people who need it, sealed credentials, and checks enforced in code.
Only use the sub-processors listed on our security page, each under written terms that protect the data at least as well as this DPA. We stay responsible to you for what they do. We’ll give you at least 30 days’ notice of a new sub-processor, by email or in the app, and you can object. If we can’t address a reasonable objection, you can end your plan and we’ll refund any period you’ve paid for and not used.
Help you answer people who exercise their rights, such as access, correction or erasure. Dazza lets you find, export and delete a customer’s data yourself; contact us if you need more. If someone asks us directly about data in your workspace, we’ll pass the request to you rather than answer it ourselves, unless you ask us to.
Help you meet your own obligations on security, breach notification, data protection impact assessments and consulting regulators, as far as the nature of Dazza allows.
Tell you without undue delay, and within 48 hours, after we become aware of a personal data breach affecting your data: what happened, the kinds of data and roughly how many people are involved, the likely consequences and what we’re doing about it, adding details as we learn them.
Tell you if a public authority asks us for your workspace’s data, unless the law forbids it, and only hand over what the law requires.
Delete your workspace’s personal data within 90 days of your account closing, after giving you 30 days to ask for a copy, unless the law requires us to keep something. Copies in backups go as those backups expire.
Give you the information you reasonably need to show that we keep to this DPA, and allow audits by you or an auditor you appoint, at reasonable notice, no more than once a year unless a regulator requires it or there has been a breach. We may first offer documents or answers that make an audit unnecessary.

Where the data goes

Your workspace data is stored in London. Some sub-processors work outside the UK, mainly in the United States: for example, to write each reply, the conversation, including files customers send, and the relevant knowledge are sent to our AI provider. Where personal data leaves the UK or the EEA, we rely on safeguards the law recognises, such as the UK–US data bridge, the UK International Data Transfer Addendum and the EU standard contractual clauses, which are incorporated into this DPA where they’re needed.

If you connect your own AI model provider, messaging apps such as WhatsApp, Instagram, Messenger, SMS, Telegram, LINE or Viber, Slack for alerts, or your Shopify store, or send data to your own systems through event webhooks or the API, you choose those destinations and use them under your own agreements with them. Data you send to them through Dazza follows your instructions and their terms, and they aren’t our sub-processors.

Your part

You’re responsible for having a lawful basis for the personal data you ask Dazza to process, for telling your customers how it’s used (for example in your own privacy notice), and for the instructions you give through how you set Dazza up.

Liability and order

The limits of liability in our terms of service apply to this DPA. If this DPA and the terms of service disagree about personal data, this DPA wins.