Data Processing Addendum (DPA)

1) Roles of the Parties

The Customer acts as the Data Controller. Message Wizard Limited acts as the Data Processor when processing personal data on behalf of the Customer.

2) Scope & Purpose of Processing

Message Wizard processes personal data solely to provide the Services, including receiving, parsing and structuring emailed purchase orders and attachments.

3) Types of Data & Data Subjects

• • Names, email addresses and business contact details
• • Purchase order content and attachments
• • Technical metadata and logs

4) Processing Instructions

Message Wizard will process personal data only on documented instructions from the Customer or as required by law.

5) No AI Training on Customer Data

6) Security Measures

• • Tenant-isolated data storage
• • Encryption in transit and at rest
• • Role-based access controls
• • Audit logging and monitoring

7) Sub-processors

Message Wizard may engage sub-processors for infrastructure, email delivery and AI processing. All sub-processors are contractually bound to GDPR-compliant safeguards.

8) Data Location & Transfers

Data is hosted primarily in the United Kingdom (Azure UK region). Any international transfers use appropriate safeguards.

9) Data Subject Rights

Message Wizard will assist the Customer in responding to data subject access, deletion and correction requests.

10) Data Retention & Deletion

Default data retention is 90 days unless configured otherwise. Upon termination, Customer Data will be deleted or returned.

11) Audits

Upon reasonable request, Message Wizard will provide information necessary to demonstrate compliance with this DPA.

12) Liability

Liability under this DPA is subject to the limitations set out in the Terms & Conditions.