Data Processing Agreement

Last updated: 18 July 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Refros Solutions B.V. ("Cwaize", "we", "us", the "Processor") and the customer using the Cwaize service (the "Customer", the "Controller"). It governs the processing of personal data that Cwaize carries out on the Customer's behalf when the Customer uses the Cwaize service, in particular the embeddable widget.

This DPA applies where, and to the extent that, Cwaize processes personal data as a processor on behalf of the Customer within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). Where Cwaize acts as a controller in its own right, its own Privacy Policy applies, not this DPA.

To request a signed copy of this DPA, contact support@cwaize.com.

1. Roles of the parties

The Customer is the controller and Cwaize is the processor in respect of the personal data processed through the Cwaize service on the Customer's behalf ("Customer Personal Data").

The Customer determines the purposes and means of the processing. Cwaize processes Customer Personal Data only to provide the service and only in accordance with this DPA and the Customer's documented instructions.

Where Customer Personal Data relates to the Customer's own website visitors — for example, the questions those visitors submit through the widget — the Customer is the controller for that data, and Cwaize processes it as processor. The Customer is responsible for establishing a lawful basis for that processing and for meeting its own obligations as controller, including providing any required information to its website visitors.

2. Details of the processing

Subject matter and duration. Cwaize processes Customer Personal Data for the duration of the Customer's use of the service, and afterwards as set out in "Deletion of data" below.

Nature and purpose. Cwaize processes Customer Personal Data in order to provide the Cwaize service: to store and analyse the Customer's videos and knowledge content, to generate answers to questions asked through the widget, and to provide the Customer with analytics on the questions their audience asks.

Categories of data subjects. The Customer's website visitors who interact with the widget, and any individuals appearing or heard in the videos the Customer uploads.

Categories of personal data. The text of questions submitted through the widget and the answers generated; a short-lived session identifier; coarse technical information such as country (at country level) and device type; and any personal data contained in the videos or knowledge content the Customer chooses to upload.

Cwaize does not intend or require the processing of special categories of personal data. The Customer is responsible for the content it uploads and for the questions its configuration allows.

3. Processing on instructions

Cwaize processes Customer Personal Data only on the Customer's documented instructions, including as set out in this DPA and the Terms of Service, unless required to do otherwise by EU or Member State law. If Cwaize is required by law to process data beyond the Customer's instructions, it will inform the Customer of that legal requirement before processing, unless the law prohibits it.

Cwaize will inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

4. Confidentiality

Cwaize ensures that the persons authorised to process Customer Personal Data are bound by an appropriate duty of confidentiality, whether by contract or by a statutory obligation. Cwaize limits access to Customer Personal Data to those who need it to provide the service.

5. Security

Cwaize implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the nature of the processing and the state of the art. These measures include:

• encryption of personal data in transit and at rest;
• access controls that restrict each account to its own data and prevent access between customers;
• a private storage environment for uploaded videos;
• controls governing where and how the widget may be used; and
• measures to preserve the confidentiality, integrity, and availability of the service.

Cwaize reviews and updates its security measures as appropriate over time. No changes will materially reduce the overall level of security during the term.

6. Sub-processors

The Customer provides general authorisation for Cwaize to engage sub-processors to process Customer Personal Data in order to provide the service. Cwaize imposes on each sub-processor data protection obligations equivalent to those set out in this DPA, and remains fully liable to the Customer for the performance of each sub-processor's obligations.

Cwaize currently uses the following sub-processors:

Cwaize will inform the Customer of any intended addition or replacement of a sub-processor, giving the Customer the opportunity to object on reasonable data protection grounds. Business customers may request to be notified of such changes by contacting support@cwaize.com. If the Customer objects and the parties cannot resolve the matter, the Customer may terminate the affected service.

7. Assistance with data subject requests

Taking into account the nature of the processing, Cwaize assists the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests from data subjects exercising their rights under the GDPR.

If Cwaize receives a request directly from a data subject relating to Customer Personal Data, it will not respond to the request itself except on the Customer's instructions or as legally required, and will inform the Customer of the request.

8. Personal data breaches and impact assessments

Breach notification. Cwaize notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will include the information reasonably available to Cwaize to help the Customer meet its own breach notification obligations.

Assistance. Taking into account the nature of the processing and the information available to Cwaize, Cwaize assists the Customer in ensuring compliance with its obligations relating to the security of processing, personal data breach notification, and data protection impact assessments and prior consultation, where applicable.

9. Deletion of data

On termination of the service, Cwaize deletes Customer Personal Data processed on the Customer's behalf, unless EU or Member State law requires it to be retained. The Customer may also delete its account and content at any time through the service, which removes its sites, videos, and knowledge base.

Data export or return of Customer Personal Data in a structured format is not provided as part of the service. The Customer is responsible for retaining any of its own content it wishes to keep before terminating the service.

10. Audits

Cwaize makes available to the Customer the information reasonably necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR and this DPA.

The parties agree that this obligation is satisfied by Cwaize providing relevant information and documentation on the Customer's reasonable written request. This DPA does not entitle the Customer to conduct on-site inspections or to access Cwaize's systems, servers, or infrastructure, except where an on-site audit is specifically required by a supervisory authority with jurisdiction, in which case it will be conducted on reasonable prior notice, during business hours, and in a manner that does not compromise the security or confidentiality of other customers' data.

11. International transfers

Customer Personal Data is stored within the European Union. Where a sub-processor is located outside the European Economic Area, the transfer is carried out under an appropriate transfer mechanism as set out in the sub-processor table above — either the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

If a transfer mechanism relied upon ceases to provide a valid legal basis, Cwaize will take appropriate steps to ensure transfers continue on an alternative lawful basis, or will cease the affected transfer.

12. Term

This DPA takes effect when the Customer begins using the service and remains in force for as long as Cwaize processes Customer Personal Data on the Customer's behalf. The provisions of this DPA that by their nature should survive termination will continue to apply until all Customer Personal Data has been deleted.

13. Governing law

This DPA is governed by the laws of the Netherlands and forms part of the Terms of Service between the parties. In the event of a conflict between this DPA and the Terms of Service in respect of the processing of Customer Personal Data, this DPA prevails.

Contact

For any question regarding this DPA, or to request a signed copy:

Refros Solutions B.V.
Email: support@cwaize.com
Verdunplein 17, Unit C5986, 5627 SZ Eindhoven, The Netherlands
Chamber of Commerce (KvK): 96725648