Data Processing Addendum

This DPA applies whenever you process personal data through waxTable as a controller and waxTable acts as your processor. It is incorporated into, and forms part of, the waxTable Terms of Service.

Where this Addendum and the Terms conflict on the subject of data protection, this Addendum governs.

So we're using the same words for the same things:

• Controller

  You. You decide why and how personal data is processed.

• Processor

  waxTable (a product of Buzzi AI), processing on your behalf.

• Personal data

  Any information relating to an identified or identifiable person that you place in the service.

• Sub-processor

  A third party we engage to help deliver the service.

• You are the data controller and determine the purposes and means of processing.
• waxTable acts as the data processor and processes personal data only on your documented instructions.
• Each party complies with the data-protection laws that apply to it for its role.

We process personal data only to provide the service — generating, rendering, editing, sending, and storing your documents — and only as your configuration and use of the product instruct.

We won't use your content for our own purposes, sell it, or share it for advertising. If we ever believe an instruction breaches data-protection law, we'll tell you.

We use a small, vetted set of sub-processors — infrastructure, AI model providers, and email delivery — to run waxTable. The current list is available on request.

We give at least 30 days' notice of any material change to that list so you have time to object. Every sub-processor is bound by data-protection terms at least as protective as those in this Addendum.

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256) across databases, storage, and backups.
• Row-level security on every workspace boundary, enforced at the database layer.
• Mandatory MFA for Owner and Admin roles on Business and Enterprise plans.

The full picture lives on our Security page.

If one of your customers exercises a data-protection right, we'll assist you in responding — including by providing the tools to export, correct, or delete the relevant data within the service.

Should we become aware of a personal-data breach affecting your data, here's what happens — without undue delay, in this order:

1. We confirm and containOn detection

   Our team verifies the incident, contains it, and assesses what data is affected.

2. We notify youWithout undue delay

   We tell affected controllers what we know, so you can start your own clock with confidence.

3. We help you respondThroughout

   We share detail and tooling so you can meet your own notification obligations to regulators and data subjects.

Standard Contractual Clauses are available where required for cross-border transfers. The primary processing region is configurable per workspace on Enterprise plans, so you can keep data where your obligations need it to stay.

This Addendum lasts as long as we process personal data on your behalf. On termination, you can export your data, and we'll delete or return it in line with our published retention schedule unless the law requires us to keep it.

• Export your workspace data at any time before closing the account.
• Audit and inspection rights are available to Enterprise customers on reasonable request, under NDA.