Data Processing Terms

1. Introduction

These Data Processing Terms apply where a business using Payzuu provides personal information relating to its customers, contacts, staff, or other individuals and Payzuu processes that information on the business's behalf.

These Data Processing Terms form part of the Payzuu Terms of Service. For processing covered by these terms, the business is the data controller and Marek Jonak, trading as Payzuu, acts as the data processor unless applicable law requires otherwise.

2. Processing instructions

Payzuu will process personal information only on the controller's documented instructions, including instructions provided through the controller's use and configuration of the Service, unless Payzuu is required to process the information by applicable law.

If applicable law requires processing outside those instructions, Payzuu will inform the controller where legally permitted to do so.

3. Details of the processing

The subject matter of the processing is the provision of Payzuu's business, customer-management, payment-related, invoicing, receipt, document-storage, notification, and related services.

Processing may include collecting, recording, organising, storing, retrieving, displaying, transmitting, updating, and deleting information as necessary to provide the Service.

Personal information may include names, email addresses, addresses, business or contact details, customer references, payment-related records, invoices, receipts, documents, notes, and other information entered into Payzuu by the controller.

Individuals whose information may be processed include the controller's customers, prospective customers, business contacts, staff, and other individuals whose information the controller lawfully enters into the Service.

Processing continues for as long as necessary to provide the relevant Service and for any additional period required or permitted by applicable law.

4. Controller responsibilities

The controller is responsible for ensuring that personal information provided to Payzuu has been collected lawfully and that the controller has an appropriate lawful basis and any necessary notices, permissions, or consents for the processing.

The controller is also responsible for the accuracy of the information it provides, its instructions to Payzuu, and its own compliance with applicable data protection law.

5. Confidentiality

Payzuu will ensure that persons authorised to process personal information on its behalf are subject to appropriate confidentiality obligations and access personal information only where necessary for their authorised responsibilities.

6. Security

Payzuu will maintain appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Measures may include authentication, access controls, secure communications, protected storage, monitoring, backups, and other safeguards appropriate to the nature and risk of the processing.

7. Sub-processors

The controller gives Payzuu general authorisation to use third-party service providers where reasonably necessary to operate and provide the Service, including infrastructure, hosting, document-storage, email, notification, security, and payment-related providers.

Where a service provider acts as a sub-processor, Payzuu will require it to provide data protection commitments appropriate to the processing and consistent with Payzuu's obligations under these Data Processing Terms.

Where required by applicable law, Payzuu will provide reasonable notice of material changes involving sub-processors so that the controller may raise legitimate data protection concerns.

8. Individual rights

Taking into account the nature of the processing, Payzuu will provide reasonable assistance to the controller where necessary to respond to requests from individuals exercising applicable data protection rights.

Where Payzuu receives a request relating primarily to personal information processed on behalf of the controller, Payzuu may direct the individual to the controller unless Payzuu is legally required to respond directly.

9. Data protection assistance

Taking into account the nature of the processing and information reasonably available to Payzuu, Payzuu will provide reasonable assistance to the controller with applicable obligations relating to security, personal data breaches, data protection impact assessments, and consultations with supervisory authorities where required by law.

10. Personal data breaches

If Payzuu becomes aware of a personal data breach affecting personal information processed on behalf of the controller, Payzuu will notify the controller without undue delay and provide information reasonably available to Payzuu that may assist the controller in meeting its legal obligations.

11. International transfers

Where personal information processed on behalf of the controller is transferred outside the United Kingdom, Payzuu will take reasonable steps to ensure that an appropriate lawful transfer mechanism or safeguard is used where required by applicable data protection law.

12. Return and deletion of information

When the relevant Service or processing relationship ends, Payzuu will delete or return personal information processed on behalf of the controller where reasonably requested and where technically practicable, unless applicable law requires or permits Payzuu to retain the information.

Information may remain temporarily in backups or other protected systems until it is removed through normal retention and deletion processes.

13. Compliance information and audits

Payzuu will make available information reasonably necessary to demonstrate compliance with its applicable processor obligations.

Where required by applicable data protection law, Payzuu will allow for and reasonably contribute to audits or inspections relating to processing performed on behalf of the controller, subject to appropriate confidentiality, security, scope, timing, and operational safeguards.

14. Changes to these terms

We may update these Data Processing Terms to reflect changes to Payzuu, applicable law, security requirements, or the providers used to operate the Service.

Where a change materially affects the controller's data protection rights or obligations, we will take reasonable steps to provide notice.

15. Contact

Questions about these Data Processing Terms or processing carried out on behalf of a Payzuu business user can be submitted through the Payzuu Support page.

Payzuu is operated by Marek Jonak, trading as Payzuu, in the United Kingdom.