Data processing agreement

This data processing agreement ("DPA") is part of the terms of service between you (the "Customer") and RINCOT TECHNOLOGY LTD., the company that operates the ioZen brand (Business Number 796518827, 22922 132 Ave, Maple Ridge, BC V4R 2R2, Canada; "ioZen", "we" or "us"). It applies whenever we process personal data on your behalf while providing the Service.

By accepting the terms, you accept this DPA. If you need a signed copy, write to hello@iozen.ai.

If your account existed before October 29, 2026, this DPA applies to you from November 28, 2026; until then, the version you accepted applies.

1. Definitions and roles

"Personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given by the data protection law that applies, such as the GDPR, Brazil's LGPD, Ecuador's LOPDP, Colombia's Law 1581, Mexico's LFPDPPP, Chile's Law 19.628 and Law 21.719, Canada's PIPEDA, and the CCPA ("Data Protection Law"). "Customer Personal Data" means the personal data we process for you through the Service. "Subprocessor" means a provider we engage that processes Customer Personal Data.

You are the controller of Customer Personal Data (the "responsable"), and ioZen is your processor (the "encargado"). Under the CCPA, ioZen is your service provider: we don't sell or share Customer Personal Data, and we don't use it for any purpose other than providing the Service to you.

2. What we process

• Subject matter: providing the Service under the terms.
• Duration: while the terms are in force, plus the deletion period in section 11.
• Nature and purpose: collecting, storing, organizing, displaying, analyzing (including with AI), sending and deleting data to run FlowApps, Intake Bots, Process Boards, the Contact Center, WhatsApp conversations, case distribution, attribution and conversion sending, and connections to the apps you choose, as you configure them.
• Types of personal data: decided by you. Typically names, email addresses, phone numbers, answers to your questions, uploaded files, messages, approximate location, device and browser data, and advertising identifiers. Special categories only if you choose to collect them.
• Data subjects: decided by you. Typically your clients and prospective clients, the people who write to your WhatsApp numbers, and your team members.

3. Your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are these terms, this DPA, and what you configure in the Service, such as the questions you ask, the channels you connect, the AI features you turn on, the ad platforms and apps you connect, and the data you delete. If the law requires us to process it otherwise, we'll tell you before we do, unless the law forbids it. If we believe an instruction breaks Data Protection Law, we'll tell you.

4. Confidentiality

We give access to Customer Personal Data only to staff and contractors who need it to provide or support the Service, and only after they commit to confidentiality.

5. Security

We maintain technical and organizational measures appropriate to the risk, including:

• HTTPS for every connection, and encryption of stored data at rest by our providers.
• Isolation of each workspace, with the database denying direct access by default (row-level security).
• Private fields stored apart from the rest of the case, encrypted fields in Supabase Vault, and a log of every read of either.
• Encryption of ad platform credentials (AES-256-GCM), and API keys stored only as hashes.
• Roles (owner, admin, member), and the option to limit members to the cases assigned to them.
• Rate limiting, and signature checks on incoming webhooks.
• Activity logs of changes to Intake Bots, workspaces and members.

We may update these measures as long as the overall level of protection doesn't go down.

6. Subprocessors

You authorize the subprocessors listed in section 8 of our privacy policy. We bind each one by contract to data protection obligations no less protective than this DPA, and we remain responsible to you for their work.

We update that list at least 30 days before a new subprocessor starts processing Customer Personal Data, except in an emergency, in which case we tell you as soon as we can. Write to hello@iozen.ai to receive these updates by email. You may object on reasonable data protection grounds within 30 days; if we can't address the objection, you may end the affected part of the Service and we'll refund any prepaid fees for it.

The apps, ad platforms and systems you connect yourself (section 8 of the terms) are not our subprocessors. They receive data on your instruction and under their own terms.

7. Requests from individuals

The Service lets you find, correct, export and delete Customer Personal Data. If you need more help to answer a request from a data subject, we'll give it. If a data subject writes to us about Customer Personal Data, we'll pass the request to you without undue delay and won't answer it ourselves, except to tell them we've done so.

8. Assessments and authorities

We give you the information you reasonably need for data protection impact assessments and for consultations with a data protection authority about the Service.

9. Personal data breaches

We notify you without undue delay, and within 48 hours of becoming aware of a personal data breach that affects Customer Personal Data. The notice describes, as far as we know at that point, what happened, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures we've taken or propose. We add details as we learn them, and we help you meet your own duty to notify authorities and data subjects.

10. International transfers

Customer Personal Data is stored in the United States, and some subprocessors process it in other countries. Where Data Protection Law of the European Economic Area, the United Kingdom or Switzerland applies to a transfer to ioZen, the European Commission's Standard Contractual Clauses (Module 2, controller to processor) are incorporated into this DPA, with the UK addendum and the Swiss adjustments where they apply. Where another law requires a specific transfer mechanism, such as the standard contractual clauses approved by Brazil's ANPD, we'll put it in place on request.

11. Deletion and return

You can export contacts, cases and records from the Service at any time. When you delete a workspace, it can be restored for 30 days and is then permanently deleted, including its files and encrypted values. When your access ends, you have 30 days to export Customer Personal Data, after which we delete it, unless the law requires us to keep part of it. Copies in backups drop out as the backups rotate and are never restored to the Service. We confirm deletion in writing on request.

12. Audits

Once a year, on 30 days' written notice, you can ask us for the information you need to verify that we comply with this DPA, and we'll answer, for example by completing a reasonable security questionnaire. If that isn't enough, or a data protection authority requires it, you or an independent auditor bound by confidentiality may audit the parts of the Service that process Customer Personal Data, at your cost, at a time agreed in advance and without disrupting the Service or other customers' data.

13. Your obligations

You are responsible for having a legal basis, and consent where the law requires it, for the processing you instruct, including contacting people on WhatsApp or by email, adding ad pixels to Intake Bots, sending conversions to ad platforms and sending data to the apps you connect. You give data subjects the notices Data Protection Law requires, including that you use ioZen and that their data travels to the United States. You don't instruct us to process data in breach of the law.

14. Liability, term and precedence

Each party's liability under this DPA is subject to the limitations in section 12 of the terms, except where Data Protection Law doesn't allow it. This DPA applies while we process Customer Personal Data, and its confidentiality, security and deletion obligations survive the end of the terms. If this DPA and the terms conflict on the processing of personal data, this DPA prevails; if the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail. This DPA is published in English and Spanish; if the two versions differ, the English version prevails.

15. Contact

• Email: hello@iozen.ai
• Person responsible for privacy: Jacobo Moreno, CEO
• RINCOT TECHNOLOGY LTD. (Business Number 796518827), 22922 132 Ave, Maple Ridge, BC V4R 2R2, Canada