Data Processing Agreement

1. Introduction

This Data Processing Agreement (“DPA”) supplements the Uzvera Terms of Service and Privacy Policy. It governs the processing of personal data that Uzvera processes on behalf of its business customers (“Customer”) in connection with the Uzvera platform.

This DPA applies where Uzvera acts as a data processor and the Customer acts as a data controller in relation to personal data processed through the Service.

2. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person processed through the Service.
• “Processing” means any operation performed on Personal Data, including storage, use, transfer, or deletion.
• “Sub-processor” means any third party engaged by Uzvera to process Personal Data on behalf of the Customer.

3. Scope & Nature of Processing

Uzvera processes Personal Data solely to provide the Service as described in the Terms of Service. The categories of data processed may include:

• User names and email addresses of Customer’s team members
• Device, server, and website identifiers added by the Customer
• Session and audit log data generated through use of the Service
• IP addresses and browser information of Customer’s users

4. Uzvera’s Obligations as Processor

Uzvera shall:

• Process Personal Data only on documented instructions from the Customer (i.e., to provide the Service).
• Ensure that authorized personnel are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures.
• Assist the Customer in responding to data subject rights requests where technically feasible.
• Notify the Customer of any confirmed personal data breach without undue delay.
• Delete or return Personal Data upon termination of the Service, subject to legal retention obligations.

5. Customer’s Obligations as Controller

The Customer shall:

• Ensure a lawful basis exists for processing Personal Data through the Service.
• Obtain any necessary consents from device users, employees, or end users before enrolling devices or enabling remote access.
• Provide appropriate privacy notices to data subjects.
• Not instruct Uzvera to process Personal Data in a manner that violates applicable law.

6. Sub-processors

Uzvera may engage sub-processors to assist in delivering the Service (e.g., cloud hosting providers, email delivery services). We will maintain an up-to-date list of sub-processors and notify Customers of any intended changes, giving reasonable opportunity to object.

To request the current list of sub-processors, contact privacy@uzvera.com.

7. International Transfers

Uzvera is based in Pakistan. If Personal Data is transferred internationally, we will ensure appropriate safeguards are in place in accordance with applicable data protection law.

8. Audit Rights

Uzvera will provide information reasonably necessary to demonstrate compliance with this DPA. Customers may request an audit (with reasonable notice and at their own expense) no more than once per calendar year.

9. Duration & Termination

This DPA remains in effect for as long as Uzvera processes Personal Data on behalf of the Customer. Upon termination of the Service agreement, Uzvera will delete or return Personal Data within 30 days, unless legal retention obligations apply.

10. Contact

For DPA inquiries or to execute a signed DPA for enterprise contracts, contact: privacy@uzvera.com