Draft for review. This is a starting template written for Textezy. Have a qualified lawyer review it for each market you operate in before publishing, and replace every highlighted placeholder.
Effective date: 22 October 2026
1. Scope and roles
This data processing agreement (“DPA”) forms part of the Terms of service between you (the “Customer”) and IOCOD Infotech Pvt. Ltd. (“Textezy”). It applies when Textezy processes personal data on the Customer's behalf under the EU GDPR, the UK GDPR and other applicable data protection laws.
The Customer is the controller, and Textezy is the processor.
2. Processing details
| Subject matter | Providing the Textezy SMS platform |
|---|---|
| Duration | The term of the agreement, plus any period needed for deletion or return |
| Nature and purpose | Storing contacts, sending and receiving messages, recording consent and opt-outs, reporting |
| Data subjects | The Customer's contacts, such as customers, subscribers and staff |
| Personal data | Phone numbers, names, message content, consent records, delivery and engagement data, and any custom fields the Customer adds |
| Special category data | Not intended. The Customer should not upload it without agreeing extra safeguards with us. |
3. Our obligations
Textezy will:
- Process personal data only on the Customer's documented instructions, including those given through the platform
- Make sure staff with access are bound by confidentiality
- Apply the security measures described below
- Help the Customer respond to data subject requests, through platform tools where possible
- Help the Customer with security, breach notification, impact assessments and consultations with regulators, where relevant
- Make available the information needed to show compliance, and allow reasonable audits, no more than once a year and on at least 30 days' written notice
4. Sub-processors
The Customer authorises Textezy to use sub-processors, including hosting providers and messaging and carrier partners needed to deliver messages. Textezy will put equivalent data protection terms in place with each one and remains responsible for them. Our current list is in our Privacy policy. We'll give 30 days' notice of new sub-processors so the Customer can object.
5. International transfers
Where personal data is transferred outside the UK or EEA, Textezy will use a valid transfer mechanism, such as the EU standard contractual clauses and the UK international data transfer addendum. The service is hosted on Vercel's global network, with form processing currently in India.
6. Security measures
- Encryption of data in transit and at rest
- Role-based access controls and the principle of least privilege
- Logging and monitoring of access to production systems
- Regular backups and tested recovery procedures
- Vulnerability management and regular security reviews
7. Personal data breaches
Textezy will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer data. The notice will include the information reasonably available to help the Customer meet its own obligations.
8. Deletion and return
When the agreement ends, the Customer can export its data. Textezy will then delete Customer personal data within 90 days, unless the law requires it to be kept.
To request a signed copy of this DPA, email privacy@textezy.com.