Data Processing Addendum

Contract review draft · 27 September 2026. This proposed addendum must be completed and accepted with a customer agreement. It is not an executed DPA, an international-transfer instrument or a claim of regulatory certification.

1. Parties and scope

The parties are the customer identified in the order form and Briza Group LLC, 12955 Biscayne Blvd Ste 200 #128, Miami, FL 33181, United States. Privacy contact: info@brizagroup.com, +1 (561) 571-1121.

For customer-controlled personal data in Hafrix, the customer determines the processing purposes and instructions and Briza Group LLC provides processing services. Each party's role for its separate business-contact and account administration activities should be specified in the agreement.

2. Processing schedule

3. Documented instructions

Processing is limited to the accepted agreement, enabled workflows and the customer's documented instructions, unless applicable law requires otherwise. If an instruction appears to conflict with applicable data-protection requirements, the parties should resolve that issue before the affected processing continues. Access to a customer's data does not authorize reuse for another customer's purposes.

4. Confidentiality and safeguards

People authorized to access customer personal data must be subject to appropriate confidentiality obligations and need-to-know access. The agreed technical and organizational measures should cover identity and access, tenant separation, protected transport, storage and key management, logging, recovery, vulnerability handling and personnel procedures.

The security page describes implemented product controls and areas for further assurance. Contract schedules must identify the controls actually applicable to the deployment; proposed controls should not be represented as already implemented.

5. Subprocessors and international transfers

The executed addendum must include or reference an up-to-date subprocessor list, authorized activities, relevant locations, a change-notification process and a procedure for reasonable objections. Equivalent data-protection obligations should follow the processing chain.

The current subprocessor list is attached to the signed addendum and is also available on request; it is not published on this site. Proposed process for changes (subject to confirmation with each customer): Hafrix gives advance notice of at least 30 days before engaging a new subprocessor or replacing one that processes that customer's data, and the customer may raise a reasoned objection within that window before the change takes effect.

Any required international-transfer mechanism must be selected for the actual parties, data flows and applicable law. This draft does not incorporate standard contractual clauses by reference without completing their required details. Customer-selected external connectors and mail services must be identified separately from providers selected by Hafrix.

6. Assistance and incidents

The parties should agree how Hafrix assists with data-subject requests, relevant impact assessments and regulator enquiries, taking account of the nature of the processing. Requests concerning a customer's records should be coordinated with that customer rather than acted on without checking authority.

Within a live workspace, a customer's own administrators can already erase a former member's personal data themselves (Settings → Users, deactivate then erase); requests about any other personal data should go through the customer, which coordinates them with Hafrix under this section.

For a confirmed personal-data incident affecting customer information, the agreed process should provide notification without undue delay, an incident contact, available facts about scope and impact, containment measures and follow-up updates. The executed agreement must define operational escalation and any specific notice deadlines. This draft does not promise a response clock that has not been staffed and tested.

7. Return, deletion and assurance

At the end of service, the customer should be able to choose an agreed export or return process and give deletion instructions, subject to applicable retention obligations. The schedule must identify export formats, the active-data deletion period and when backup copies expire.

Our standard terms: on request, we deliver a full export within 10 working days as one ZIP archive. It holds a JSON file for every entity, CSV files for the main tables (equipment, jobs, maintenance, rentals), every stored file in its original form, and a manifest with checksums. The account stays available for 30 days after the contract ends, so the export can be taken. After that, the account and its stored files are deleted from production. Backup copies expire within 90 days. Security and audit logs are kept for 12 months.

The executed agreement should set out the information made available to demonstrate compliance and a proportionate audit process that protects other customers' confidentiality and service availability. External certification or independent penetration-test reports should be described only when current evidence is available.

Before signature

Complete the customer identity, processing schedule, hosting locations, subprocessor register, retention periods, incident contacts, applicable transfer provisions and technical-measures annex. Confirm the addendum's precedence over inconsistent data-processing terms in the main agreement.

Discuss your data requirements · Security overview