Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of the agreement between Ozma ("Processor") and the customer ("Controller") when Controller processes personal data subject to GDPR, UK GDPR, or similar laws through the Ozma Service. Contact support@ozma.app to execute a countersigned copy.

1. Scope & roles

Controller determines purposes and means of processing personal data of its end users. Ozma processes such data solely on documented instructions from Controller to provide the Service described in the Terms of Service and Privacy Policy.

2. Categories of data & subjects

• Data subjects: Controller's end users, employees, or agents as applicable
• Personal data types: identifiers, usage metadata, and content submitted in API requests as configured by Controller
• Processing activities: authentication, proxy routing, metering, logging, and support

3. Processor obligations

• Process personal data only on documented instructions
• Ensure personnel confidentiality
• Implement appropriate technical and organizational security measures
• Assist with data subject requests where technically feasible
• Notify Controller of personal data breaches without undue delay
• Delete or return personal data upon termination, subject to legal retention
• Make available information necessary to demonstrate compliance

4. Subprocessors

Controller authorizes Ozma to engage subprocessors listed in our Privacy Policy (including Stripe, Cloudflare, and Neon). Ozma will notify Controller of material subprocessor changes and offer an objection period where required by law.

5. International transfers

Where personal data is transferred outside the EEA/UK, Ozma will use Standard Contractual Clauses or other approved mechanisms.

6. Audits

Upon reasonable request, Ozma will provide summaries of security practices or third-party audit reports subject to confidentiality. On-site audits may be conducted no more than once per year with 30 days notice.

7. Liability & order of precedence

Liability caps in the main Terms apply unless mandatory law requires otherwise. This DPA prevails over conflicting privacy terms in the Terms solely regarding Processor obligations.

8. Execution

To execute: email support@ozma.app with your company name, signatory, and estimated monthly volume. We will return a countersigned PDF.