1. Roles
Where Wizlix processes personal data on your behalf through Flozari (for example, the Instagram and Facebook contacts you communicate with through the product), you act as the Data Controller and Wizlix acts as the Data Processor. For your own account data, Wizlix is the Controller.
2. Subject matter & duration
Subject matter: processing of personal data necessary to provide the Flozari messaging-automation service. Duration: for as long as your Flozari account is active, plus the legally required retention periods stated in our Privacy Policy.
3. Nature and purpose of processing
- Receiving comments and direct messages from Meta platforms.
- Generating and sending automated replies and follow-ups.
- Logging activity for analytics, troubleshooting, and abuse prevention.
- Generating AI suggestions and reply drafts.
4. Categories of data subjects
Your followers and the Instagram/Facebook users who interact with your account, plus your authorized team members.
5. Categories of personal data
- Identifiers: Instagram/Facebook user IDs, usernames, display names, profile pictures.
- Communications: comment text, direct-message text, media attachments.
- Optional contact details captured by your flows: email and phone number.
- Metadata: timestamps, message IDs, event types.
6. Security measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256) via our infrastructure provider.
- Row-Level Security on every customer-data table.
- Principle of least privilege for service-role access.
- Rate limiting, audit logs, and webhook signature verification.
- Annual review of access controls and recovery procedures.
7. Third-party services
A current list of authorised third-party services is published at /legal/sub-processors. We will give 30 days' notice before engaging a new third-party service that handles personal data.
8. International transfers
Where personal data is transferred outside the EEA, UK, or India, we rely on Standard Contractual Clauses (SCCs) and equivalent transfer mechanisms put in place by our third-party service providers.
9. Data subject rights & assistance
Wizlix provides self-service tools through Flozari so you can fulfil data-subject requests: account-data export and account deletion are available from Settings → Security. For requests we cannot fulfil automatically, contact support@flozari.com and we will respond within 30 days.
10. Breach notification
We will notify you without undue delay (and in any case within 72 hours where feasible) after becoming aware of a personal-data breach affecting your data.
11. Deletion or return of data
On termination of your account, Wizlix will delete or return personal data within 30 days, except where retention is required by law.
12. Contact
For an executed copy of this DPA with Wizlix Technologies Private Limited, email support@flozari.com with your company name and your Data Protection contact.