Data Processing Agreement

Last updated: 2026-10-15 · Version 2026-10-15

This agreement covers the personal data that you, our customer, put into Notiamo. It meets Article 28 of the EU General Data Protection Regulation (GDPR). It forms part of the Terms of Service and applies automatically when you use Notiamo; you do not need to sign it separately.

1. Parties and roles

• Controller: the customer who owns the Notiamo workspace (“you”).
• Processor: Veziro SASU, R.C.S. Antibes 900 603 952, 15 Chemin du Tanit, Rés. Mas de Tanit, Bât. TYR 402, 06160 Antibes, France, publisher of Notiamo (“we”).

2. Subject, duration, nature and purpose

Subject

Hosting and processing of the content of your workspace to provide Notiamo.

Duration

As long as you use Notiamo, plus the deletion period in section 10.

Nature

Storage, display, organisation, transmission by email and through the API to the people and AI agents you authorise, backup and deletion.

Purpose

Collecting and managing feedback on websites, as described in the Terms of Service.

3. Data and people concerned

People

Your team members, your clients and any other people you invite; people mentioned in comments or visible in screenshots and photos.

Data

Names, email addresses, roles, language; comments and replies; photos, screenshots and documents; page addresses, screen size and browser of the person who commented; timestamps.

Special data

Notiamo is not meant for sensitive data (health, religion, etc.). Do not upload it; if a screenshot may show it, hide it first.

4. Our obligations

• We process the data only on your documented instructions: these terms, the settings of your workspace, and the actions of the people and agents you authorise. If an instruction seems to break data protection law, we tell you.
• People at Veziro SASU who can access the data are bound by confidentiality, and only access it when needed (support you asked for, security, maintenance).
• We do not sell the data, use it for our own purposes, or use it to train AI models.

5. Security measures

• Encryption in transit (HTTPS/TLS) for the website, the API and the widget.
• Login with single-use email links (no passwords); limited login attempts; human check on login and sign-up.
• Each workspace’s data is kept apart; every request is checked against the person’s access to the workspace, client and site.
• Access tokens for AI agents are stored as hashes and can be revoked at any time.
• Database and file storage are not reachable from the internet; server access is restricted to the administrator.
• Daily database backups; deleted content is purged on a fixed schedule.
• Servers hosted in the European Union (Germany).

6. Sub-processors

You authorise us to use these sub-processors:

Each sub-processor is bound by data protection terms at least as strict as these. Transfers outside the EU rely on the EU–US Data Privacy Framework and/or standard contractual clauses. We announce a new sub-processor at least 30 days in advance by email to workspace admins and on this page. You may object for a reasonable data-protection reason; if we cannot solve it, you may cancel and get a refund of the prepaid period not yet used.

7. Helping you

• Requests from people: you can find, export, correct and delete content in the dashboard. If a person contacts us directly, we pass the request on to you without answering it ourselves.
• Impact assessments and authorities: we give you the information you reasonably need.

8. Data breaches

If we become aware of a breach that affects your data, we tell you without undue delay and at the latest within 72 hours, with what we know: what happened, what data and people are concerned, likely consequences, and what we are doing about it. We keep you informed as we learn more.

9. Audits

We make available the information needed to show that we comply with this agreement. Once a year, or after a breach, you may send us a written security questionnaire. If the answers are not enough, an independent auditor bound by confidentiality may carry out an audit, at your cost, with 30 days’ notice and without disturbing the service for other customers.

10. End of the service

When your workspace is closed, you can ask for an export of your content for 30 days. After that, we delete the content; backups are overwritten within the following 14 days. We keep only what the law requires us to keep.

11. Order of precedence

For personal data processed on your behalf, this agreement takes precedence over the Terms of Service. Liability under this agreement follows the Terms of Service.