This Data Processing Addendum ("DPA") forms part of your subscription agreement with Mewayz, Inc. ("Processor") and governs Mewayz's processing of personal data on behalf of you ("Controller") in providing the Mewayz platform.
Where required by law, this DPA implements the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for transfers from EEA, the UK Addendum to the SCCs for UK transfers, and the Swiss FADP for Swiss transfers.
For Customer Content (data you upload into the platform), you are the Controller and Mewayz is the Processor. We process Customer Content only on documented instructions from you, namely your use of the service and any further written instructions.
For Account & Billing data (your admin user account, billing details, usage telemetry from your admin team), Mewayz is the Controller and these activities are governed by the Privacy Policy.
We will: process Customer Content only as instructed; ensure persons authorised to process it are bound by confidentiality; implement technical and organisational measures appropriate to the risk; assist you with data subject requests and DPIAs; and notify you without undue delay if we believe an instruction infringes data protection law.
You authorize us to engage the sub-processors listed at our trust portal. We will: ensure each sub-processor is bound to materially equivalent data protection terms; remain fully liable for their performance; and notify you at least 30 days before adding a new sub-processor so you may object.
Where Customer Content moves outside the region you selected at signup, we ensure an appropriate transfer mechanism: SCCs (with UK Addendum where applicable), Adequacy Decisions, or Binding Corporate Rules. For US transfers, we participate in the EU-US, UK-US, and Swiss-US Data Privacy Frameworks.
We maintain a written information security program. Controls include: a self-hosted operating stack on infrastructure we operate; multi-tenant isolation of customer data enforced at the framework level; encryption at rest (AES-256) and in transit (TLS 1.3); MFA enforcement for admin access; least-privilege access; Cloudflare edge protection; and continuous monitoring. Full description in our Security page.
We will notify you of a Personal Data Breach within 72 hours of becoming aware, including the nature of the breach, affected categories of data, likely consequences, and measures taken or proposed.
We provide in-product self-service tools for the most common rights (access, deletion, export). For requests not addressable through the product, we will assist you at no additional charge for the first request per data subject per year.
Upon termination of the subscription, we will, at your choice, return or delete Customer Content within 30 days. The export button in Settings provides a complete machine-readable copy. Backups age out at 35 days; audit-log metadata is retained for 7 years per legal obligation.
You may audit our compliance with this DPA: by reviewing the description of our security architecture and our sub-processor list (available under MNDA); or by on-site audit during business hours with 30 days' notice, no more than once per 12 months unless required by your supervisory authority.
The DPA is auto-signed when you accept these Terms during signup. You can request a counter-signed copy at any time from [email protected].