Our Data Processing Agreement ("DPA", or "Auftragsverarbeitungsvertrag" / "AVV" in Germany) sets out how PRODUCTISED LIMITED processes personal data on behalf of its customers, as Article 28 of the GDPR requires. It is available to every business customer.
How to get it
Email privacy@productised.ai with your company's legal name and address. We send the DPA ready to sign electronically.
If your organisation prefers to use its own DPA or AVV template, send it to the same address and we will review it.
Who it is for
- Businesses using Productised for themselves — you are the controller of your Leads' data, and we are your processor.
- Agencies building products for clients — you act for your client, so you are a processor and we are your sub-processor. The DPA covers this, so you can pass the same terms on to your client.
What it covers
- Instructions — we process your data only to provide the platform, on your instructions.
- No other use — we never sell your data, use it for our own purposes, or let our AI providers train on it.
- Confidentiality and security — everyone with access is bound by confidentiality, and we maintain the measures on our Security page.
- Sub-processors — the providers on our Sub-processors page, with at least 30 days' notice of changes and a right to object.
- International transfers — PRODUCTISED LIMITED is a New Zealand company, so it cannot itself be certified under the EU-US Data Privacy Framework, which is open only to US organisations. Transfers to us rely on the European Commission's adequacy decision for New Zealand. Onward transfers to our hosting in the United States rely on each provider's Data Privacy Framework certification or the EU Standard Contractual Clauses. We also attach the Standard Contractual Clauses (Module 2 or 3) to the DPA, so you can rely on them in your own agreements. The UK Addendum and Swiss terms apply too.
- Help with requests — tools to view, export and delete individual Leads, and help with data subject requests and impact assessments.
- Breach notification — we tell you within 48 hours of becoming aware of a personal data breach affecting your data.
- Deletion — you can export your data when you leave, and we delete it within 30 days.
- Audits — we provide the information you need to show compliance, and allow audits on reasonable notice.
What it attaches to
The DPA forms part of our Productised App Conditions. If the two ever conflict on a data protection matter, the DPA takes precedence.
