Data Processing Addendum

This Data Processing Addendum (“DPA”) is between the business using Ziphy (“Merchant”) and Cassius-Lee Smith, a sole trader trading as Ziphy (“Ziphy”). It supplements the Terms of Service and takes priority if those terms conflict with this DPA about processing Merchant Personal Data.

This DPA applies where the Merchant is a controller, and Ziphy is its processor, or where the Merchant is itself a processor and Ziphy is its subprocessor. “Data Protection Law” means applicable UK data-protection law, including the UK GDPR and Data Protection Act 2018. Other data-protection law applies where required.

Subject matter and purpose. Providing the cancellation-prevention, failed-payment recovery, customer subscription display and factual reporting features selected by the Merchant.

Nature. Receiving, recording, organising, retrieving, comparing, displaying, transmitting, updating, restricting and deleting personal data. Customer email used in the customer list is fetched from Stripe and cached only briefly in the application process rather than written to the Ziphy database.

Duration. For the term of the Ziphy service and the limited period needed to return, delete or lawfully retain data after it ends.

Data subjects. The Merchant's customers, prospective customers where they enter a cancellation journey, and authorised users whose details form part of Merchant instructions.

Personal data. Customer and subscription references; email where required; country where available; subscription, invoice, amount, currency, payment and failure data; cancellation reasons and events; offers shown and selected; execution, recovery and retention outcomes; and related security and operational records.

Sensitive data. The service is not designed for special-category data, criminal-offence data or full payment-card details. The Merchant must not intentionally submit such data unless Ziphy has expressly agreed suitable safeguards in writing.

Ziphy will process Merchant Personal Data only on documented instructions from the Merchant, including the Terms, this DPA, the Merchant's approved settings and lawful written support requests, unless UK law requires otherwise. Where allowed, Ziphy will tell the Merchant before processing required by law. Ziphy will promptly inform the Merchant if it believes an instruction infringes Data Protection Law.

The Merchant must:

• ensure its instructions are lawful and it has a valid legal basis for the processing;
• give data subjects the required privacy information and handle their rights;
• limit submitted data to what is necessary for the service; and
• configure and use Ziphy consistently with its own customer contracts and legal obligations.

Ziphy will limit access to people who need it to provide, secure or support the service and ensure they are bound by confidentiality duties. Ziphy will not sell Merchant Personal Data or use it for advertising.

Taking account of the processing and risk, Ziphy maintains measures including:

• HTTPS/TLS for data in transit and provider-managed encryption at rest;
• Supabase authentication, server-side secret storage and restricted administrative access;
• row-level security, least-privilege database grants and merchant/account/mode isolation;
• signed-webhook verification, replay protection and durable idempotent execution records;
• bounded leases for concurrent work and a server-side switch that can block Stripe mutations;
• privacy-safe structured logs that exclude customer email, secrets and raw capability tokens; and
• provider-managed backups and tested application validation procedures.

Ziphy may update these measures as technology and risks change, without materially reducing overall protection.

The Merchant gives Ziphy general written authorisation to use the subprocessors listed at ziphy.io/subprocessors. Ziphy will impose materially equivalent data-protection duties on each subprocessor and remains responsible for their performance to the extent required by Data Protection Law.

Ziphy will give reasonable advance notice of a new or replacement subprocessor by updating that page and, for a material change, by email or in-product notice. The Merchant may object on reasonable data-protection grounds by emailing support@ziphy.io. The parties will work in good faith on a practical solution; if none is available, the Merchant may stop the affected service and terminate it.

Taking account of the nature of processing and information available, Ziphy will reasonably assist the Merchant with data-subject requests, security obligations, breach assessments, impact assessments and regulator consultations. Ziphy will not independently respond to a request about Merchant Personal Data except to direct the person to the Merchant, unless legally required or instructed by the Merchant.

Ziphy will notify the Merchant without undue delay after becoming aware of a personal-data breach affecting Merchant Personal Data. We will provide available information reasonably needed for the Merchant's assessment and notification duties and take reasonable steps to contain and remediate the incident.

Ziphy will not transfer Merchant Personal Data outside the United Kingdom except on the Merchant's documented instructions or where a lawful transfer mechanism applies. Where required, that mechanism may include UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses. The Merchant authorises transfers inherent in using the providers listed on the Subprocessors page, subject to these safeguards.

On reasonable written request, Ziphy will provide information necessary to demonstrate compliance with this DPA. If that information is insufficient, the Merchant may conduct an audit no more than once each year, unless a breach or regulator requires more, with reasonable notice, during normal business hours and without disrupting other customers or exposing their data. The Merchant bears its audit costs and auditors must be independent and bound by confidentiality.

On termination or a verified written request, Ziphy will, at the Merchant's choice, return or delete Merchant Personal Data unless law requires retention. Active operational data will normally be deleted within 30 calendar days after verification. Data retained for legal, tax, fraud, security or dispute purposes will be restricted to that purpose. Deleted data may remain beyond use in provider backups until their normal backup cycle removes it.

Separate Stripe-account records remain controlled through Stripe and are not deleted merely by closing Ziphy. The support-assisted process is described in the Privacy Policy.

Liability under this DPA is subject to the Terms of Service. This DPA ends when Ziphy no longer processes Merchant Personal Data, except for provisions that must survive. It is governed by the law and courts stated in the Terms. Contact support@ziphy.io for DPA requests.