DPA

DRAFT — Under legal review. This text is pending Guilherme's legal review. It is published while that review is open, and it may change. It is not legal advice. A placeholder in square brackets is for counsel to complete before this notice comes down.

Parties and roles

This data processing agreement ("DPA") is between the business that holds the Nozzara account ("Customer", the controller) and [LAWYER: legal name of the contracting entity] ("Nozzara", the processor).

It covers personal data the Customer stores in the service about its own customers, suppliers, partners, and other people ("Customer Data"). For that data, the Customer decides the purposes and the means. Nozzara processes it on the Customer's instructions.

Account data, where Nozzara is the controller (the user, billing, and the audit log), is described on the Privacy page. It is outside this DPA. Where the CCPA applies to Customer Data, Nozzara is a service provider and not a third party (Civil Code sections 1798.100(d) and 1798.140).

What is processed

The Customer chooses the records: names, contact details, tax identifiers, addresses, orders, quotes, production records, and the files the Customer uploads. Nozzara processes them to provide the service the Customer configured.

Nozzara does not require the Customer to store a special category of data. The Customer will not instruct Nozzara to process data about children, or LGPD sensitive data, or CCPA sensitive personal information, unless the Customer has a lawful basis and this DPA has been updated to say so. [LAWYER: decide whether to forbid those categories outright during the beta.]

Instructions

Nozzara processes Customer Data only on documented instructions. The instructions are this DPA, the terms, and the actions people take inside the account, including what they type, upload, export, and delete.

If a law requires Nozzara to process Customer Data without the Customer's instruction, we will tell the Customer first, unless that law forbids the notice. If an instruction would, in our view, break the LGPD or the CCPA, we will tell the Customer and wait, unless the law requires us to act.

We do not sell Customer Data. We do not share it for cross-context behavioral advertising. We do not combine it with personal information we received from another customer, or that we collected as a controller, except as the service and the security of the service require. [LAWYER: this is the CCPA service-provider limit. Confirm the product does not mix tenants.]

Duration

This DPA starts when the Customer account starts and lasts while we process Customer Data. Accepting it in the product is not available in this draft. There is no consent record yet. The plan keeps working without that acceptance. The closed beta does not wait for the DPA. [LAWYER: when the Consent model exists, replace this paragraph with the click-through.]

Confidentiality

Nozzara limits access to Customer Data to people who need it to provide the service and who are bound to confidentiality. We do not use Customer Data for our own marketing.

Security

Nozzara applies measures appropriate to the risk (LGPD Article 46), including:

• a separate tenant boundary, so one account's records are not returned to another account
• passwords stored only as scrypt hashes
• an audit log that does not store raw IP addresses, passwords, or secrets
• a session cookie that is HttpOnly and SameSite=Lax
• transport protection on the public site [LAWYER: name TLS only if every public endpoint enforces it]
• access to production limited to people who operate the service [LAWYER: describe that access]

We do not describe a certification the company has not earned.

Subprocessors

Nozzara uses the following subprocessors. A subprocessor may process Customer Data only to perform the service we hired it for.

• Hostinger, for application hosting and the database. Privacy notice: https://www.hostinger.com/legal/privacy-policy. Location: [LAWYER: country or region].
• Stripe, for subscription payments the Customer pays to Nozzara. Stripe does not need the Customer's own customer records to take that subscription payment. If a billing screen sends only Nozzara's billing contact, Stripe is a subprocessor of account data, which sits under the Privacy page. [LAWYER: say clearly whether any Customer Data, as defined here, is sent to Stripe. If it is not, move Stripe out of this DPA and leave it on the Privacy page only.] Privacy notice: https://stripe.com/privacy. Data processing terms: https://stripe.com/legal/dpa.
• [LAWYER: legal name of the transactional email provider], for email the service sends, such as a quote or an account message that can contain Customer Data. Location: [LAWYER: country].

We will tell the account email before we add or replace a subprocessor that processes Customer Data. The notice period is [LAWYER: number of days, draft suggestion 15]. The Customer may object on a reasonable data-protection ground. If we cannot offer a reasonable alternative, the Customer may stop the affected processing or cancel, and we will not treat that cancellation as a breach. [LAWYER: the product does not yet send this notice. Publish it only when the notice exists.]

The current list is this section. We do not authorize a provider who is not listed.

International transfers

Customer Data may be processed in the countries of the subprocessors. [LAWYER: name them.]

For a transfer of personal data from Brazil, Nozzara and the Customer will use a mechanism in LGPD Article 33. The mechanism this DPA is written for is the ANPD standard contractual clauses (Resolution CD/ANPD No. 19 of 23 August 2024), incorporated in full and without changing the clause text, between the exporter and the importer. [LAWYER: attach Annex II of that resolution as a schedule. Do not summarize the clauses in place of the official text.]

Until those clauses are attached, this draft does not claim the transfer is already covered.

Assistance

Nozzara will help the Customer answer a data-subject request, taking into account how the service works.

• Access and portability: an account administrator can generate the ZIP export of that account. The export does not include password hashes or session tokens.
• Correction: the Customer corrects records in the product.
• Deletion: this draft does not delete Customer Data. The Customer emails the privacy contact. Downgrade, the end of a trial, and suspension do not delete it.

When a request record exists in the product, we will help through that record. Until then, email is the channel. We will not answer the data subject ourselves where the Customer is the controller, unless the Customer instructs us to, or the law requires us to.

Incidents

If we confirm a security incident that affects Customer Data, we will notify the Customer without undue delay and, where feasible, within 72 hours after confirmation. The notice will describe, to the extent we know it, what happened, the categories of data, the likely consequences, and the measures taken. We will not name a person in a public log.

The Customer, as controller, decides whether to notify the ANPD and the data subjects under LGPD Article 48, using what we provide. [LAWYER: 72 hours mirrors a common contractual standard. The LGPD itself tells the controller to notify in a reasonable time. Confirm the number.]

Return and deletion

At the end of the service, the Customer may export Customer Data while the export is still available. This draft does not delete Customer Data when the account ends, when a trial ends, when a plan is lowered, or when the account is suspended.

[LAWYER: set the deletion window for a later version, for example 30 days after closure, with a longer keep for backups and for records the law requires. Do not publish a deletion promise this build does not keep. Do not delete customer data on downgrade, trial end, or suspension.]

Audits

The Customer may ask, no more than once in 12 months, for reasonable written information about our compliance with this DPA, unless a confirmed incident or a regulator requires a further question. We may answer with a written summary. We are not offering an on-site audit in this draft. [LAWYER: decide if a regulator audit must be allowed on site.]

CCPA service provider terms

Where Customer Data is personal information under the CCPA, Nozzara will:

• process it only for the business purposes in this DPA and the terms
• not sell it or share it
• not retain, use, or disclose it outside the direct business relationship, except as the law allows
• not combine it with personal information from other sources except to provide and secure the service
• tell the Customer if we decide we can no longer meet these duties
• let the Customer take reasonable steps to stop and remediate unauthorized use
• certify that we understand these restrictions and will comply with them

Those duties are the contract terms Civil Code section 1798.100(d) requires. [LAWYER: compare them to the current regulation, title 11, section 7051, before publication.]

Liability

Liability under this DPA follows the liability section of the terms, including the cap and the Brazilian consumer carve-out. A term that the LGPD does not allow a controller or a processor to waive, in favor of a data subject, is not waived here.

Acceptance and download

The Markdown file of this page is the draft the Customer can download. It is the same text, including this draft notice. Clicking download does not accept the DPA. The plan keeps working.

Precedence

If this DPA conflicts with the terms on a privacy or processing point, this DPA controls. The ANPD standard clauses, once attached, control over this DPA on a transfer from Brazil. The Portuguese text controls for a Brazil account, and the English text controls for a United States account.

Notices under this DPA go to the privacy contact on the Privacy page, and to [LAWYER: legal notice email].