Data processing agreement

This data processing agreement is part of the terms of use. Zwik is the processor. The customer, the podcast maker, is the controller for the personal data the customer enters in Zwik.

Zwik is a trade name of Vermetis Consulting, Chamber of Commerce 82406847, VAT NL003677605B65. Registered office: Perzikbloesem 38, 7006 MS Doetinchem.

Questions about this agreement go to [email protected].

Zwik processes personal data only to provide the podcast workspace: planning, run sheets, guests, advertisers, the team and the related email. Processing lasts while the customer uses Zwik, and afterwards for as long as it takes to return or delete the data.

The nature is hosting and showing that data to the users of that podcast. The purpose is performing the agreement: running the workspace, sending email the customer asks for, and securing the service.

The customer may enter these categories:

• Guests: name, contact details, email and notes.
• Team members: name, email and role.
• Advertisers: name, contact details, email and agreements.
• Other contacts the customer adds.

Special categories do not belong here. Do not put them in Zwik.

Zwik processes the data only on the customer’s written instructions, including use of the workspace, unless a law requires something else.

People who can see the data are bound to confidentiality. Zwik helps the customer, where reasonable, with requests from data subjects.

• Netcup, Germany, for the server.
• Mailgun (Sinch), EU region, for email.
• Mollie, the Netherlands, for payments.
• Cloudflare, United States and worldwide, for traffic and the certificate. Standard contractual clauses (SCCs) apply.

Zwik may replace a subprocessor with a comparable party. The current list is this page. The customer can object via [email protected] if the replacement clearly reduces protection.

Zwik takes appropriate measures. Passwords and backup codes are hashed. The two-factor secret is encrypted. Traffic is encrypted. Podcasts cannot see each other’s data. Access to the server is limited to administration.

Zwik notifies the customer of a personal data breach without undue delay, and in any case within 48 hours after Zwik has established the breach. The notice describes what is known, the likely consequences and the measures Zwik takes.

Zwik assists the customer with a data-subject request, a notice to the supervisory authority and a review of security, where the customer cannot do that in the workspace.

When the agreement ends, Zwik deletes the personal data or returns it, at the customer’s choice, unless a law requires retention. Backups follow the normal cycle of at most 12 months. Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, stores the nightly Google Drive copy. That copy is encrypted with rclone crypt, so Google cannot read it. We keep 30 copies. Mollie is not a sub-processor.

Once a year the customer may ask for information about compliance with this agreement. Zwik provides that in writing. An on-site audit is by arrangement, at a reasonable time, and the customer bears their own costs unless the audit shows a shortcoming.

Liability is governed by the terms of use. That limit does not affect mandatory law.