Data Processing Agreement

The Customer is the controller and Messy is the processor of the personal data contained in Customer Content (the “Customer Personal Data”). Where the Customer is itself a processor for a third party, Messy acts as sub-processor. This DPA applies to processing carried out by Messy to provide the Service, as described in Annex 1.

Messy will process Customer Personal Data only on the Customer’s documented instructions, including as set out in the Terms, this DPA, and the Customer’s configuration and use of the Service, unless required to act otherwise by EU or member-state law (in which case Messy will inform the Customer first, unless the law prohibits it). Messy will notify the Customer if, in its opinion, an instruction infringes data-protection law.

The Customer warrants that it has a lawful basis and all necessary consents and notices to collect the Customer Personal Data and to have it processed through the Service, that its instructions are lawful, and that it is responsible for the accuracy and legality of the Customer Personal Data.

Messy ensures that persons authorised to process the Customer Personal Data are bound by confidentiality obligations and process the data only as needed to provide the Service.

Taking account of the state of the art, costs, and the nature and risks of processing, Messy implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex 2 (Article 32 GDPR).

The Customer gives Messy general authorisation to engage sub-processors to provide the Service. Messy will: (a) maintain a current list of sub-processors and make it available on request; (b) impose data-protection obligations on each sub-processor no less protective than those in this DPA; and (c) remain liable to the Customer for its sub-processors’ performance. Messy will give the Customer reasonable notice of any intended change of sub-processor, and the Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected Service.

Taking into account the nature of the processing, Messy will assist the Customer, by appropriate measures and so far as possible:

• to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection);
• to ensure compliance with its security, breach-notification, data-protection-impact-assessment, and prior-consultation obligations (Articles 32 to 36).

Where the Customer’s requests exceed what the Service provides by self-service and require material effort, Messy may charge a reasonable fee.

Messy will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer Personal Data, and provide the information reasonably available to help the Customer meet its own notification obligations. Messy’s notification is not an acknowledgement of fault or liability.

On termination of the Service, and at the Customer’s choice, Messy will delete or return the Customer Personal Data and delete existing copies within a reasonable period, unless EU or member-state law requires storage. The Customer can also export its data through the Service before termination. Routine backups are deleted on their normal cycle.

Messy will make available information reasonably necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates. To protect confidentiality and other customers, audits will be on reasonable prior notice, no more than once per year (unless required by a supervisory authority or following a breach), during business hours, subject to confidentiality, and Messy may satisfy audit requests by providing existing reports, certifications, or a questionnaire response.

Messy will not transfer Customer Personal Data outside the EEA except where an adequacy decision applies or appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses, which the parties agree are incorporated by reference where required for a given transfer.

Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Terms of Service. This DPA does not expand either party’s liability beyond those limits, except to the extent the GDPR mandates otherwise.

This DPA takes effect when the Customer accepts the Terms and continues while Messy processes Customer Personal Data. If there is a conflict between this DPA and the Terms on the subject of data protection, this DPA prevails.

• encryption of data in transit (TLS), and provider credentials that are never disclosed through the API or interface once stored;
• access controls, least-privilege access, and passwordless authentication for the application;
• per-environment isolation and scoped API keys;
• network protections, request filtering, and rate limiting against abuse;
• logging and monitoring of access and activity;
• regular backups and a documented restore process;
• vulnerability management and dependency, secret, and infrastructure scanning; and
• confidentiality obligations and security expectations for personnel and sub-processors.

Messy currently engages the following sub-processors; an up-to-date list with their roles and locations is available on request at privacy@messy.sh:

• Hetzner Online GmbH (Germany): servers and managed PostgreSQL database hosting (European Union);
• Cloudflare: DNS, CDN, and TLS;
• Stripe: subscription billing and invoicing;
• Amazon Web Services (Amazon SES): email delivery;
• Twilio: SMS delivery;
• Meta Platforms (WhatsApp Cloud API): WhatsApp delivery; and
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): mobile and web push delivery.

On Bring-Your-Own-Keys plans the messaging providers are accessed using the Customer’s own provider accounts.

Questions about this DPA: privacy@messy.sh, The Empire Holding B.V., Coolhaven 238A, Rotterdam, the Netherlands.