Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between Bliztek, LLC (“Bliztek,” “We,” “Us”) and the Client and is incorporated into our Terms of Service for clients whose use of our Services involves the personal data of their own end users.

1. Scope and Roles

When Bliztek hosts a Client’s website, stores a Client’s files, or manages a Client’s social media accounts, We may process personal data relating to the Client’s own end users (“Client End-User Data”). For Client End-User Data, the Client is the controller and Bliztek is a processor acting on the Client’s behalf. Bliztek is an independent controller of the data it collects about its own client relationships, such as account, billing, and support information, which is governed by our Privacy Policy.

2. Processing on Documented Instructions

Bliztek will process Client End-User Data only on the Client’s documented instructions, including as set out in the Terms of Service, this DPA, and any written instructions the Client provides through the client dashboard or support channels, unless processing is required by applicable law. If a legal requirement prevents Us from following an instruction, We will inform the Client unless the law prohibits Us from doing so.

3. Confidentiality

Bliztek ensures that persons authorized to process Client End-User Data are bound by appropriate obligations of confidentiality.

4. Security

Bliztek implements and maintains appropriate technical and organizational measures designed to protect Client End-User Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of the data and the risks presented by the processing.

5. Subprocessors

The Client provides a general authorization for Bliztek to engage subprocessors to support the Services. Bliztek will provide notice of material changes to its subprocessors, such as by updating this page, and remains responsible for its subprocessors’ performance of their data protection obligations. Bliztek currently uses the following subprocessors:

6. Assistance with Data Subject Requests

Taking into account the nature of the processing, Bliztek will provide reasonable assistance to the Client in responding to requests from end users to exercise their rights under applicable data protection law, such as requests for access, correction, or deletion. If We receive such a request directly from a Client’s end user, We will forward it to the Client where We can identify the relevant Client.

7. Personal Data Breach Notification

Bliztek will notify the Client without undue delay after becoming aware of a personal data breach affecting Client End-User Data, and will provide information reasonably available to Us to assist the Client in meeting its own notification obligations.

8. Deletion or Return of Data

Upon termination of the Services, the Client has 30 days to request copies of Client End-User Data hosted or managed by Bliztek, consistent with the post-termination provisions of our Terms of Service. After that 30-day period, Bliztek will delete Client End-User Data in its possession, unless retention is required by applicable law.

9. Audits and Information Requests

Upon reasonable written request, and no more than once per year, Bliztek will make available information reasonably necessary to demonstrate compliance with this DPA, such as summaries of our security practices or responses to written security questionnaires.

10. International Transfers

Bliztek is located in the United States, and Client End-User Data is processed in the United States. Clients whose end users are located in other jurisdictions are responsible for ensuring that their use of the Services complies with any transfer requirements applicable to them.

11. Contact

For questions about this DPA, contact us at: