Annex to the services agreement between Znovu and the brand (hereinafter the “Agreement”).
1. General provisions
1.1 This DPA forms an integral part of the Agreement between [legal name] (hereinafter the “Provider”, the Znovu AI agency) and the brand ordering the services (hereinafter the “Customer”). It sets out how the Provider processes End Users’ personal data on behalf of the Customer and complies with the requirements of Art. 28 of Regulation (EU) 2016/679 (GDPR).
1.2 The Customer’s app, loyalty program, push notifications and customer database storage run on the SalesBox platform. Data processing at the platform level is governed by the SalesBox data processing agreement, which complies with the GDPR. The Provider delivers the services using this platform and engages SalesBox as a Sub-processor (Section 6).
1.3 Terms have the meanings given to them in the GDPR and the Agreement. With respect to End User Data, the Customer is the controller and the Provider is the processor.
1.4 In matters of personal data processing, this DPA prevails over the Agreement. A version individually signed by the Parties prevails over this one.
2. Subject matter and description of processing
| Parameter | Description |
|---|---|
| Data subjects | End Users — the Customer’s customers who use its app and website |
| Categories of data | name, phone number, email, date of birth, order history, bonus balance, participation in promotions, consent records, technical device data, push notification tokens — to the extent accessible to the Provider in the Customer’s account on the platform |
| Not processed | payment card data; special categories of data (Art. 9 GDPR) |
| Provider’s processing operations | viewing, segmentation, configuring push scenarios and the loyalty program, generating analytics and reports, pseudonymisation for AI processing |
| Purpose | providing the services under the Agreement: launching and running the Customer’s app, repeat sales through push scenarios and loyalty, acquiring new customers, weekly reporting |
| Duration | term of the Agreement + the return and deletion period (Section 9) |
3. Processing only on the Customer’s instructions
3.1 The Provider processes End User Data only on documented instructions from the Customer, including with regard to transfers outside the EEA. Such instructions are: the Agreement and this DPA; the strategy and scenarios agreed with the Customer; the Customer’s written requests.
3.2 If, in the Provider’s opinion, an instruction infringes the GDPR or other legislation, the Provider shall immediately inform the Customer and is entitled not to follow it.
3.3 End User Data must not be used for:
- the Provider’s own mailings, advertising and retargeting;
- offers of goods and services of the Provider or third parties;
- selling the data or giving access to it to advertising networks and data brokers;
- training artificial intelligence models available to the Provider’s other clients;
- exchanging data between different Customers;
- any other independent purposes of the Provider.
3.4 The following do not constitute a breach: generating aggregated statistics that do not allow identification of either an End User or the Customer, and processing upon a lawful request of public authorities — with notice to the Customer unless prohibited by law.
4. Customer’s obligations
4.1 The Customer, as controller:
- determines the legal bases for processing and obtains the necessary End User consents, including for marketing communications and advertising tracking;
- publishes its own privacy policy in the app and on its website;
- enters into an agreement and a data processing agreement with SalesBox regarding the platform, or instructs the Provider to do so on the Customer’s behalf;
- does not upload databases obtained without a legal basis;
- is solely responsible for services connected in its own name (clause 6.3).
5. Confidentiality and personnel
5.1 Access to End User Data is limited to the Provider’s employees and contractors who need it to perform the Agreement: strategist, performance specialist, analyst.
5.2 All such persons are bound by confidentiality obligations (NDA or employment contract).
5.3 Access is role-based, granted through each person’s individual account, and revoked on the day their engagement ends.
6. Sub-processors and Customer services
6.1 Provider’s Sub-processors. The Customer grants general written authorisation to engage the Sub-processors listed in Annex B. The Provider engages only providers that ensure GDPR compliance, enters into agreements with them imposing data protection obligations no less protective than those in this DPA, and is liable to the Customer for their acts as for its own.
6.2 SalesBox platform. Technical and organisational security measures, data storage location, backup and deletion at the platform level are governed by the SalesBox data processing agreement. The Provider supplies a copy of it upon the Customer’s request.
6.3 Customer services. Meta and Google ad accounts, the Firebase project, payment acquiring, SMS, messengers, email and delivery services connected in the Customer’s name are the Customer’s providers. The Provider works in them only on the Customer’s instructions and is not responsible for their acts or terms.
6.4 Changes to Sub-processors. The Provider notifies the Customer by email at least 14 days in advance of any addition or replacement of a Sub-processor. The Customer may raise a reasoned objection within this period. If the Parties fail to find a solution, the Customer is entitled to terminate the Agreement before the changes take effect.
7. Transfers outside the EEA
7.1 The data storage location on the platform is determined by the SalesBox data processing agreement.
7.2 Some members of the Provider’s team and certain Sub-processors may access data from outside the EEA. Such transfers are subject to the safeguards of Art. 44–49 GDPR: the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, or the provider’s certification under the EU-U.S. Data Privacy Framework.
7.3 The Provider transfers only pseudonymised data to AI services: without names or phone numbers, with encrypted identifiers. Data submitted via the API is not used to train models.
8. Security measures and assistance to the Customer
8.1 The Provider implements the technical and organisational measures pursuant to Art. 32 GDPR set out in Annex A.
8.2 Taking into account the nature of the processing, the Provider provides the Customer with reasonable assistance in fulfilling its obligations under Art. 32–36 GDPR, including with data protection impact assessments (DPIA).
8.3 Upon request, the Provider makes available the information necessary to demonstrate compliance with this DPA.
9. Return and deletion
9.1 The customer database, the app and all creatives belong to the Customer. Export of the database from the platform is carried out in accordance with SalesBox’s terms; the Provider assists the Customer in obtaining it.
9.2 Within 30 days after termination of the Agreement, the Provider deletes copies of End User Data that it stored outside the platform (reports, exports) and revokes its access to the Customer’s accounts. This does not apply to data the Provider is required by law to retain.
9.3 Upon the Customer’s written request, the Provider confirms deletion by email within 10 business days.
10. End User requests
10.1 End User requests concerning their rights (Art. 15–22 GDPR) are handled by the Customer.
10.2 If a request is received by the Provider, the Provider forwards it to the Customer within 5 business days and does not respond to it on the merits (other than informing the requester to whom the request has been forwarded).
10.3 The Provider provides reasonable assistance so that the Customer can fulfil the request within the time limits set by law.
11. Incidents
11.1 The Provider notifies the Customer by email of any personal data breach affecting the Customer’s End User Data without undue delay and no later than 48 hours after becoming aware of it, so that the Customer can notify the supervisory authority within the 72-hour period under Art. 33 GDPR. This also applies to breaches notified to the Provider by a Sub-processor.
11.2 The notification contains (to the extent the information is available, to be supplemented subsequently): what happened and when it was discovered; the categories and approximate number of End Users and records concerned; the likely consequences; the measures taken and planned; the contact details of the responsible person.
11.3 The Provider takes immediate measures to mitigate the consequences and cooperates with the Customer in notifying the supervisory authority and End Users.
11.4 Contact: privacy@znovu.ai; responsible person — Andrii Stakhov, founder.
12. Audit
12.1 Once every 12 months, the Customer may send a security questionnaire. The Provider responds within 20 business days and, where necessary, obtains responses from Sub-processors.
12.2 An on-site audit is possible following a breach affecting the Customer’s data or at the request of a supervisory authority; with at least 30 days’ notice; at the Customer’s expense.
13. Liability
13.1 The Parties’ liability under this DPA is governed by the Agreement.
13.2 The Provider is not liable for breaches caused by instructions or actions of the Customer, its employees or persons using its access credentials; by the Customer’s services (clause 6.3); or by actions with the data after its export by the Customer.
14. Term and amendments
14.1 This DPA remains in force for the term of the Agreement and until deletion of the data under Section 9 is completed.
14.2 Amendments to this DPA are published with 30 days’ notice to the Customer and may not reduce the level of data protection. An individually signed version may be amended only by mutual written agreement of the Parties.
Annex A. Provider’s technical and organisational measures
- Individual accounts. Each employee works in their own account; shared logins are not used.
- Least privilege. Access is role-based and granted only to those who need it for a specific Customer; access is revoked on the day the engagement ends.
- Two-factor authentication in all systems with access to Customer data.
- Data stays on the platform. Exports containing personal data are made only when necessary, stored in secure storage and deleted after use.
- Encryption in transit — only over secure channels (HTTPS / TLS).
- Pseudonymisation for AI. Before transfer to AI services, names and phone numbers are removed and identifiers are encrypted.
- Personnel confidentiality. Employees and contractors with access to data are bound by confidentiality obligations.
- Incident response in accordance with Section 11.
- Platform-level measures (hosting, backups, segregation of Customers’ data) — in accordance with the SalesBox data processing agreement.
Annex B. Sub-processors
| Sub-processor | Purpose |
|---|---|
| SalesBox (SALESBOX LLC) | platform for the app, loyalty, push notifications and customer database storage — under its own GDPR data processing agreement |
| AI services (including OpenAI) | preparation of creatives, texts and scenarios; pseudonymised data only |
The Provider supplies the current list of Sub-processors on request and gives notice of changes in accordance with clause 6.4.