Data Processing Addendum
Last updated August 26, 2026
This Data Processing Addendum ("DPA") supplements the Terms of Service between you ("Customer") and Anar Alishov, prowadzący działalność gospodarczą pod firmą zmist (a Polish sole proprietorship / JDG) ("zmist") and applies where zmist processes personal data on Customer's behalf under Regulation (EU) 2016/679 ("GDPR"). If you need a countersigned copy, email support@zmist.co.
1. Roles
For personal data Customer or its users submit to the Service, Customer is the controller and zmist is the processor. zmist processes that data only on Customer's documented instructions, which the Terms and Customer's use of the Service constitute.
2. Subject matter and duration
Subject matter: provision of the Service described in the Terms. Duration: for as long as Customer has an account, plus the deletion periods described in the Privacy Policy.
3. Nature and purpose of processing
Storing, relaying, and displaying channel messages, templates, reports, and account/profile data so the Service functions; sending transactional email; securing the Service.
4. Categories of data and data subjects
Data subjects: Customer's authorised users and anyone whose information they choose to send into a channel. Categories: account identifiers (email, nickname), profile details the user provides, and the content and metadata of messages, signals, templates, and reports.
5. Confidentiality
zmist ensures that people authorised to process the personal data are bound by an obligation of confidentiality.
6. Security
zmist maintains technical and organisational measures appropriate to the risk, including encryption of data in transit, hashed credentials, access controls, session revocation on sign-out, redaction of credentials and personal data from server logs, and hosting within the European Union.
7. Sub-processors
Customer authorises zmist to engage the sub-processors listed at zmist.co/subprocessors. zmist imposes data-protection obligations on each sub-processor no less protective than those in this DPA and remains liable for their performance. zmist will update that page before adding a sub-processor; Customer may object on reasonable data-protection grounds by emailing support@zmist.co.
8. Data subject rights
The Service provides self-serve export and deletion tools that let Customer respond to access, portability, and erasure requests directly. zmist will additionally assist Customer, taking into account the nature of processing, in responding to data-subject requests it cannot fulfil through those tools.
9. Personal data breach
zmist notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer's data, with the information Customer reasonably needs to meet its own notification obligations.
10. International transfers
Where a sub-processor processes personal data outside the EEA, the transfer is governed by the EU Standard Contractual Clauses or another valid transfer mechanism.
11. Deletion and return
On termination, or on Customer request, zmist deletes Customer's personal data in line with the Privacy Policy's retention and deletion sections, except where retention is required by law.
12. Audits
zmist makes available the information necessary to demonstrate compliance with this DPA and contributes to audits conducted by Customer or an auditor it mandates, subject to reasonable confidentiality and frequency limits.