Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between TMZ SOFTWARE S.R.L. ("Processor") and the customer publisher ("Controller") for the Naratica publishing platform (the "Service"). It applies when Processor processes personal data on behalf of Controller in the course of providing the Service.

1. Parties and roles

Controller determines the purposes and means of processing personal data of readers, editors, and other end users of Controller's publication. Processor provides the Service and processes that data only on documented instructions from Controller, including this DPA and the applicable order.

Processor details: see Imprint. Contact for privacy: contact@naratica.com.

2. Subject matter and duration

Processing consists of hosting, storing, transmitting, and displaying content and account data as needed to run Controller's Naratica instance (website, admin, optional mobile apps, notifications, analytics, subscriptions). Duration matches the term of the Service agreement, plus a reasonable wind-down for export and deletion.

3. Nature and purpose of processing

• Operate the CMS, public site, and related features configured by Controller
• Authenticate editors and readers; send transactional messages and push notifications
• Process subscription and payment-related metadata via payment subprocessors
• Provide support, security monitoring, and backups

4. Types of personal data and data subjects

May include names, email addresses, account credentials (hashed), IP addresses, device identifiers, reading preferences, subscription status, payment references (not full card data, which is handled by payment providers), and content that Controllers or readers submit. Data subjects include Controller's staff, contributors, and readers/subscribers.

5. Processor obligations

Processor shall:

• Process personal data only on Controller's documented instructions, unless required by EU or Member State law
• Ensure persons authorised to process personal data are bound by confidentiality
• Implement appropriate technical and organisational security measures (Art. 32 GDPR)
• Engage subprocessors only under Art. 28 GDPR terms; the public list is at /subprocessors
• Assist Controller with data subject requests, DPIAs, and breach notification without undue delay
• Delete or return personal data after the end of the Service, at Controller's choice, except where law requires retention
• Make available information necessary to demonstrate compliance and allow audits as reasonably agreed

6. Subprocessors

Controller authorises Processor to use the subprocessors listed at naratica.com/subprocessors. Processor will give notice of intended changes as stated on that page. Objection rights are exercised by emailing contact@naratica.com within the notice period.

7. International transfers

Primary Service hosting is in the European Union. Where a transfer outside the EEA/UK is required, Processor will ensure an adequacy decision applies or Standard Contractual Clauses (or equivalent) are in place.

8. Security

Measures include TLS in transit, access controls, EU-resident production data stores for the standard offering, backups, and logging appropriate to the Service. Enterprise customers may agree additional controls in writing.

9. Breach notification

Processor will notify Controller without undue delay after becoming aware of a personal data breach affecting Controller's data, with information reasonably available to help Controller meet Art. 33/34 GDPR duties.

10. Liability and precedence

Liability allocation follows the main Service agreement. If there is a conflict between this DPA and other documents regarding data protection, this DPA prevails for processing matters.

11. Governing law

This DPA is governed by Romanian law and GDPR. Execution may be by order reference, e-sign, or counter-signature of this document.

12. How to execute

Request a countersigned PDF at contact@naratica.com, or download the PDF from this page and return a signed copy. Enterprise onboarding includes DPA execution by default.