Data processing agreement

Version 2026-11-10.

1. Parties and subject

1.1 This agreement is between an organization using hiza Business (the controller) and the operator of hiza named in the imprint (the processor). An owner accepts it for the organization when creating it, and again when it changes. 1.2 It covers the personal data hiza processes for the organization: its conversations, internal notes, tags, saved replies, the record of who handles what, and its audit log.

2. Nature, purpose and duration

2.1 Hiza stores and delivers the organization's conversations so its people can answer them, and keeps the organization's inbox state, including the chat on the organization's websites. 2.2 Data subjects: the organization's people, the people of the organizations it talks to, and visitors of its websites who use the chat. Categories: names, usernames and photos from Coredo Account; message content and photos; notes; for website visitors, what the website signs about its signed-in customers (an id, email and name), what the visitor gives (a name, an email address for replies), the page they wrote from; and the times and ids of actions. 2.3 For as long as the organization exists, then as in §6; a website visitor's details 90 days after their last visit. 2.4 The organization tells its website's visitors about the chat in its own privacy notice. 2.5 Apps the organization registers and connects (Business → Apps) act on its instructions: hiza processes what they send, the people they add to its conversations by their Coredo Account id (and an email address for one invitation, kept at most 90 days until they sign in), and sends the apps the events and content the organization granted them. What an app does with that data on its own side is the organization's responsibility.

3. Instructions

3.1 Hiza processes the data only on the organization's documented instructions: these terms, its settings (for example how long conversations are kept) and what its people do in hiza. 3.2 Hiza tells the organization if it thinks an instruction breaks data protection law.

4. Confidentiality and security

4.1 Everyone at hiza who can access the data is bound to confidentiality. 4.2 The measures (Art. 32) are those described for hiza as a whole: encrypted connections, files encrypted each with its own key, encrypted backups, access by role inside the organization with every access checked on the server, an audit log, and logs that never hold message content. Conversations are cloud chats, not end-to-end encrypted. 4.3 Hiza tells the organization without undue delay after becoming aware of a personal data breach affecting its data.

5. Sub-processors

5.1 The organization agrees to the sub-processors below. Hiza tells owners in hiza at least 30 days before adding or replacing one; the organization may object, and if no solution is found, end the agreement. 5.2 Hiza binds each sub-processor to the same obligations.

• Hetzner Online GmbH, Germany: servers, storage and backups (in the EU).
• Coredo Account and Crate, run by the same operator: sign-in and the profile shown in hiza; storage accounting for originals.
• An email provider (to be named before it is used), only if the organization lets website visitors receive replies by email: sending those emails.

6. Rights, deletion and return

6.1 Hiza helps the organization answer requests from data subjects: its owners can download everything it holds at any time (Settings → Data). 6.2 When the organization is deleted, its data goes at once, except conversations with another organization, which stay for that one. Backups age out within 45 days. 6.3 Hiza makes available what is needed to show compliance with Art. 28 and allows for audits, by documents first.

7. Where data is processed

7.1 In the European Union. A transfer outside it needs the organization's instruction and Chapter V safeguards.