Data Processing Agreement

This agreement binds Pushizo as the processor and the customer organization as the controller. It applies to personal data processed for the customer when the Terms of Use are accepted. The account holder’s own signup data is outside this agreement. That data is covered by the Privacy Policy and the KVKK notice.

Subject and duration

The subject is hosting, delivering, and reporting personal data the customer uploads to Pushizo or sends through an SDK. The duration is the period the organization uses the service, plus 30 days after deletion.

Nature and purpose

On the customer’s instructions in the dashboard, API, or SDK: subscriber records, segments, templates, campaigns, delivery, events, forms, chat, analytics, and ad sync the customer turns on. The purpose is sending messages to the customer’s own users and measuring the result. Pushizo does not use this data for its own marketing.

Data and people

The people are end users of the customer’s apps and visitors who write in the customer’s chat. Categories: identity and contact (email, phone, name), device tokens, events, message content, form and survey answers, chat text and attachments. Identifiers sent to an ad platform are SHA-256 hashes. Special-category data is not requested. The customer agrees in the Acceptable Use Policy not to upload it.

Customer duties

• Provide a lawful basis and an end-user notice.
• Send only the data that is needed.
• Accept the platform terms and consent responsibility when connecting an ad account.
• Not upload children’s data or special-category data to an ad platform.

Pushizo duties

• Process data only on documented instructions. The instructions are the dashboard, the API, this agreement, and the Subprocessors list. If an instruction appears unlawful, we tell the customer.
• Keep people who process the data under a confidentiality duty.
• Apply the security measures below.
• Update this page and the subprocessor list when a subprocessor is added.
• Help the customer with data-subject requests through the product’s delete and export tools.
• Delete data on the schedule below when the service ends.
• Notify the customer of a breach within the time the law requires.

Security

• Tenant data is separated by organization and app id.
• API keys, webhook secrets, and provider credentials are not stored or logged in plain text.
• Passwords are hashed with Argon2id.
• The dashboard session is an HttpOnly cookie. State-changing requests require a CSRF token.
• Data in transit uses TLS.

Subprocessors

The current list is on Subprocessors. A channel, ads, or payment provider the customer connects with their own account is the customer’s instruction. General authorization covers the processors on that list and the providers the customer connects.

International transfers

Data may go to a provider abroad when the customer connects that provider or turns on an AI feature. The transfer tool is the provider’s contract and the safeguards under KVKK article 9 and GDPR articles 44–49. Pushizo does not claim an adequacy decision on the customer’s behalf.

Deletion and return

When an organization or app is deleted, records wait 30 days and are then permanently removed from the database and object storage. During that period the customer may request an export. Account and invoice records we must keep by law are outside this deletion.

Audit

The customer may review the published security documents and this agreement. An on-site audit happens only for a breach investigation or a mandatory legal rule, and only if requested in writing in advance. An audit cannot reach another customer’s data.

Priority

If this agreement and the terms of use conflict, this agreement applies to the processing of personal data.