Data processing addendum
Last updated September 7, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of service between the customer ("Customer") and Vipilink LLC ("Parzify") and applies where Parzify processes personal data on Customer's behalf. A signed copy on Customer paper is available on request at hello@parzify.com.
1. Roles
Customer is the controller of personal data it sends to the Service; Parzify is the processor and acts only on Customer's documented instructions, which are the Terms, this DPA and Customer's configuration of the Service.
2. Scope of processing
| Subject matter | Provision of an organisational chart and people directory. |
|---|---|
| Duration | The term of the agreement plus the deletion period below. |
| Nature and purpose | Hosting, storage, display and synchronisation of directory data from Customer's identity provider. |
| Categories of data | Business contact and organisational data: name, work email, title, department, location, manager, optional photo and bio, sign-in and audit records. |
| Data subjects | Customer's employees, contractors and advisors that Customer assigns to the Service. |
3. Parzify's obligations
- Process personal data only on Customer's instructions and inform Customer if an instruction appears to infringe applicable law.
- Ensure personnel with access are bound by confidentiality.
- Implement the technical and organisational measures described on the security page, including encryption in transit and at rest, per-tenant isolation, access control with multi-factor authentication for administrators, logging, and tested backups.
- Assist Customer with data subject requests, security assessments and impact assessments to the extent reasonably possible.
- Notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer's data.
- Delete or return personal data at the end of the agreement and delete remaining copies within 90 days, unless law requires retention.
- Make available information necessary to demonstrate compliance and allow audits by Customer or an independent auditor, on reasonable notice and no more than once a year unless required by a supervisory authority.
4. Subprocessors
Customer authorises the subprocessors below. Parzify will give at least 30 days' notice of additions by email to company administrators; Customer may object on reasonable grounds, in which case the parties will work in good faith to resolve the objection.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. | Hosting, database, backups | United States (us-east-2) |
| Google LLC (Google Workspace) | Transactional email (verification, password reset) | United States |
| Docker, Inc. (Docker Hub) | Storage of application release images (no customer data) | United States |
| Cloudflare, Inc. | DNS for parzify.com and hosting of this marketing website (no customer data) | United States |
5. International transfers
Data is stored in the United States. Where Customer is established in the EEA, UK or Switzerland, the parties rely on the European Commission's Standard Contractual Clauses (Module Two, controller to processor), which are incorporated by reference and signed on request, together with the UK Addendum where applicable.
6. Liability
Each party's liability under this DPA is subject to the limitations in the Terms of service.
Vipilink LLC · hello@parzify.com