Data Processing Agreement
Version 2026-09-06 · forms part of the Terms of Use for every business customer.
1. Roles
The Customer is the controller of personal data it stores on the platform (customers, contacts, orders, employees). Exiqze EOOD (ЕИК 160084395) is the processor and processes such data only on the Customer’s documented instructions, which are given through the platform itself.
2. Subject matter and duration
Hosting, storage, backup, transmission and display of the Customer’s data for the duration of the subscription and the 30-day retention period after termination.
3. Location
All production systems and backups are located in Bulgaria (EU). No personal data is transferred outside the EEA except to the sub-processors listed below, each covered by EU Standard Contractual Clauses or an adequacy decision.
4. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Stripe Payments Europe | Card payments | Ireland / US (SCC) |
| Google (Workspace, Analytics, Maps, Drive backup copy) | E-mail, analytics, maps, encrypted off-site backup | EU / US (SCC) |
| SMTP2GO | Transactional e-mail delivery | EU / NZ (SCC) |
| Twilio | SMS and voice verification | EU / US (SCC) |
| OpenRouter / model providers | AI features, only when the Customer uses them; no training on Customer data | US (SCC) |
We give 30 days’ notice of any new sub-processor; the Customer may object in writing.
5. Security measures
TLS 1.2+ on every public endpoint; two-node web tier with automatic failover; clustered database; role-based access with per-tenant isolation; daily encrypted off-site backups with a monthly restore test; disaster-recovery runbooks; vulnerability scanning; audit logs; staff bound by confidentiality.
6. Breach notification
We notify the Customer without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting its data, with the information needed for the Customer’s own notification duties.
7. Assistance and audits
We assist with data-subject requests, DPIAs and supervisory-authority enquiries. Once a year, on 30 days’ notice, the Customer may audit our compliance through a written questionnaire or an independent auditor bound by confidentiality.
8. Deletion and return
On termination the Customer can export all data for 30 days; afterwards it is deleted from production and from backups within a further 30 days, unless retention is required by law.
9. Contact
Data-protection contact: contact form. Supervisory authority: Commission for Personal Data Protection (КЗЛД), Sofia.