Legal / Data Processing Addendum (DPA)

Data Processing Addendum (DPA)

Version 1.0, effective 5 October 2026. Ready to sign: business customers may countersign this page or request a signed copy at team@bizlegal-ai.com.

1. Parties and roles

This addendum is between the customer ("Controller") and Moshe-Ran Dor, 100 Business Park Ln, Milton, Delaware 19968, US ("Processor"). It forms part of the Terms of Use. The Controller decides the purposes and means of processing; the Processor processes personal data only on the Controller's documented instructions to deliver the products.

2. Subject matter, duration, nature, purpose

Processing of personal data contained in input the Controller sends to a tool product, for the duration of the subscription, for the sole purpose of producing the Controller's deliverable.

3. Processor obligations

• Process only on documented instructions, including for international transfers.
• Ensure persons authorised to process are bound by confidentiality.
• Apply the security measures in section 5.
• Assist the Controller with data-subject requests and with security and impact assessments, to the extent reasonable.
• Delete or return all personal data at the end of the service (section 7).
• Make available the information needed to demonstrate compliance and allow audits on reasonable notice.

4. Subprocessors

Current subprocessors: PayPal (payments), Resend (transactional email), Cloudflare (hosting, edge), and Google (web font delivery; the font request may log your IP address). The Processor gives 30 days' notice of any change; the Controller may object on reasonable grounds.

5. Security measures

• Encryption in transit; secrets held in a managed secret store, never in source.
• Least-privilege access; signed and verified webhooks; no storage of raw secrets or card numbers.
• Deterministic, offline processing wherever possible; tool input deleted after the deliverable is produced.
• Logging of security-relevant events without personal data beyond an order reference.

6. Personal data breach

The Processor notifies the Controller without undue delay, and in any case within 72 hours of becoming aware of a personal data breach, with the information needed to meet the Controller's own notification duties, and cooperates on remediation.

7. Deletion on termination

On termination or expiry, the Processor deletes all personal data within 30 days and certifies deletion on request, unless law requires retention, in which case the data is kept confidential and not further processed.

8. International transfers

Transfers outside the Controller's jurisdiction rely on standard contractual clauses or an adequacy decision. EU representative, where required: none appointed. This service is not directed at EU/EEA residents until one is appointed.

9. Liability and law

Liability follows the Terms of Use. This addendum is governed by the laws of the State of Israel.

Signatures