Hyzo Terms of Service

Last updated: 16 September 2026

These Terms of Service govern the use of hyzo.io, the waitlist, the beta version, and services and features made available under the Hyzo brand.

These Terms constitute terms and conditions for the provision of electronic services within the meaning of Article 8 of the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means.

1. Service Provider

The Service Provider is:

Michał Kozicki, conducting business under the name MICHAŁ KOZICKI DIGRA, entered in the Polish Central Register and Information on Economic Activity (CEIDG), Tax Identification Number (NIP) 7582288800
Address: Jaśminowa 16, 07-410 Ostrołęka, Poland
Email: hello@hyzo.io
Telephone: +1 518 730 0517

In these Terms, the Service Provider is also referred to as “Hyzo”, “we”, “us” or “our”.

2. Definitions

For the purposes of these Terms:

• Hyzo / Service means the website and functionality made available under the Hyzo brand, including features relating to projects, tasks, work organisation, content processing, integrations and AI-supported functionality, to the extent actually available to a particular User;
• User means a natural person using Hyzo on their own behalf or acting on behalf of a business or another organisation;
• Business User means a User using Hyzo in connection with business or professional activity, excluding a natural person who is entitled under applicable law to consumer-equivalent protection in a particular situation;
• Consumer means a natural person entering into an agreement with the Service Provider for purposes not directly related to their business or professional activity;
• Entrepreneur with consumer rights means a natural person entering into an agreement directly related to their business activity where the agreement is not of a professional nature for that person, to the extent applicable law grants them consumer-equivalent protection;
• Account means an individual profile enabling access to Hyzo;
• Workspace means a user or team working area within Hyzo;
• User Content means information, files, documents, projects, tasks, messages, notes, prompts, client data, data obtained through Integrations and other materials submitted to Hyzo by or on behalf of the User;
• Integration means a connection between Hyzo and a third-party service enabled by the User, for example an email provider or another tool;
• Beta means a test or pre-production version of Hyzo that may include experimental, incomplete or changing features;
• AI means functionality using artificial-intelligence or machine-learning models to analyse, generate, classify, organise or suggest information.

3. Type and scope of the Service

Hyzo is a digital tool supporting work organisation. Depending on the current version and the access granted to a particular User, the Service may include in particular:

• joining the waitlist or applying for the Beta;
• creating and managing an Account and Workspace;
• creating, storing and organising projects and tasks;
• processing documents, notes and other User Content;
• AI features supporting information organisation, task creation, context extraction or suggested next actions;
• Integrations enabled by the User;
• team collaboration features, where available;
• technical support and Service-related communications.

A description of a feature on the website, in promotional materials, a roadmap or a presentation does not mean that the feature is available in the current version. The binding scope is the functionality actually made available to the User together with the information shown when a particular feature or plan is activated.

4. Technical requirements and risks

At minimum, use of Hyzo requires:

• a device with Internet access;
• a current web browser supporting standard web technologies;
• an active email address where required for registration or communications;
• for an Integration, an active account with the relevant third-party provider and the granting of required permissions.

Use of online services involves typical risks such as phishing, account takeover, malware, unauthorised access, loss of a device, network failures or software errors. Users should keep their software up to date, protect login credentials, use strong passwords and, where available, use additional authentication mechanisms.

Hyzo may use strictly necessary cookies, local storage or similar mechanisms required to provide the Service. Other technologies are described in the Privacy Policy.

5. Who may use Hyzo

An Account may be created by a person who is at least 18 years old and has the legal capacity required under applicable law to enter into the agreement.

If a User uses Hyzo on behalf of a company, client, team or other organisation, the User represents that they are authorised to act on that entity’s behalf to the extent necessary to use the Service.

The User must provide true and current information where such information is required to use Hyzo.

6. Entering into the agreement and duration

6.1. Waitlist

The waitlist service is provided free of charge. The agreement for this service is entered into when the waitlist form is successfully submitted and may be terminated by the User at any time by contacting Hyzo or using an available unsubscribe mechanism.

Joining the waitlist does not guarantee access to the Beta or to any future paid version.

6.2. Beta and free Account

The agreement for use of the Beta or a free Account is entered into when the Account is activated or an invitation is accepted and these Terms are accepted.

Where access is marked as Beta, it is provided as a non-production version for testing and evaluation for a limited period: until the date stated in the invitation or Beta communication, until testing is ended earlier, or until the Beta is replaced by a production version. A free Account that is not marked as Beta may be provided for an indefinite period unless otherwise stated at activation.

To the extent the Beta qualifies as a “data processing service” within the meaning of Regulation (EU) 2023/2854 (Data Act) and is provided for a limited period as a non-production version exclusively for testing and evaluation, the provider-switching obligations in Chapter VI of that Regulation do not apply pursuant to Article 31(2) of the Data Act. This exemption does not automatically apply to a production version of Hyzo.

6.3. Future paid plans

If Hyzo introduces a paid plan, the price, billing period, scope of the plan, payment method and renewal conditions will be presented to the User before an order is placed in the manner required by applicable law.

Any amount, limit or price shown only in a roadmap, investor presentation, prototype or material describing a future product does not constitute an offer or binding price list unless it is expressly presented to the User as a current purchase offer.

7. Accounts and security

The User is responsible for maintaining the confidentiality of login credentials and for actions performed using the User’s Account, except where they result from circumstances for which the Service Provider is liable under mandatory law.

The User should promptly notify Hyzo of suspected unauthorised access, Account takeover or another security incident.

Hyzo may temporarily restrict Account access where reasonably necessary to protect the User, other users, the Service or infrastructure, including where abuse or unlawful activity is suspected. Where possible and consistent with the purpose of the protective measure, the User will be informed of the reason and next steps.

8. Acceptable use

The User must use Hyzo in accordance with law, these Terms, generally accepted standards of conduct and the intended purpose of the Service.

In particular, the User must not:

• submit unlawful content or content infringing third-party rights;
• use Hyzo for fraud, phishing, spam, harassment, unlawful surveillance or other unlawful activity;
• upload malicious code, attempt unauthorised access, bypass security measures or intentionally disrupt the Service;
• conduct automated data extraction, mass scraping, circumvention of limits or safeguards, or use the Service in a manner that creates excessive infrastructure load, unless Hyzo has consented;
• reverse engineer, decompile or attempt to obtain protected elements of the Service, except where such rights cannot lawfully be excluded;
• use Hyzo or its outputs to create an unauthorised copy of the product, model or dataset by systematic extraction of non-public elements of the Service;
• impersonate another person or organisation;
• submit data that the User has no right to process or provide to Hyzo.

9. User Content and rights to it

The User retains all rights to User Content that belong to the User under applicable law.

The User grants Hyzo a non-exclusive right, limited in time and scope to what is necessary to provide the Service, to host, technically copy, transmit, analyse, transform and otherwise process User Content solely for the purposes of:

• providing features selected by the User;
• maintaining and securing the Service;
• technical support and troubleshooting;
• complying with legal obligations.

These Terms do not give Hyzo the right to sell User Content or use it for behavioural advertising.

If use of User Content for training AI models would go beyond performing a specific function for the User, such use requires a prior assessment of legal compliance, an appropriate legal basis and, where required, a separate notice or consent. Data obtained from Google Workspace is additionally subject to the restrictions described in Section 11.

The User represents that they hold the rights, consents and legal bases necessary to use User Content in Hyzo.

10. Personal data of third parties

Where the User uses Hyzo in a way that involves processing personal data of other individuals and independently determines the purposes and means of that processing, the User is responsible for the lawfulness of that processing as controller or other appropriate entity.

Where Hyzo processes such data on the User’s behalf, Appendix 1 — Data Processing Agreement forms part of these Terms and applies.

The User should not intentionally use Hyzo to process special categories of personal data, criminal-conviction or offence data, children’s data or other particularly protected information unless the User has an appropriate legal basis and Hyzo expressly supports that use case.

11. Third-party integrations

Integrations are enabled by the User. The User decides whether to connect Hyzo with a third-party service and approves the scope of permissions displayed by that provider.

Use of an Integration may be subject to additional terms and policies of the third-party provider. Availability of an Integration may depend on technical changes, policies, limits or decisions of that provider.

To the extent permitted by law, Hyzo is not responsible for interruptions, changes or termination of a third-party service that Hyzo does not control. This does not limit mandatory Consumer rights relating to conformity of the Service with the agreement.

Google Workspace / Gmail

During the Beta, the Gmail integration is primarily intended for the email → task workflow. After an account is connected, Hyzo may use basic Google account information and read-only access granted by the User to Gmail messages and metadata to the extent necessary to identify work-related information and turn it into tasks, project context, deadlines or other Workspace items.

The standard Beta integration is not intended to send, delete, forward or otherwise modify messages in the User’s mailbox. If a future feature requires a broader scope, Hyzo may request the additional permission when the feature is enabled.

Hyzo uses Google Workspace data in accordance with the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google Workspace is not sold, used for personalised advertising or used to create, train or improve general, shared or non-personalised AI models.

The User may revoke Hyzo’s access to the Google account through Google Account settings and, where available, by disconnecting the Integration in Hyzo.

12. AI features

Hyzo uses AI as a tool supporting work organisation. AI outputs are probabilistic and may be incomplete, inaccurate, outdated, incorrectly interpreted, duplicated or unsuitable for a particular context.

The User should verify an output before relying on it for an important decision or action. Hyzo does not replace professional legal, tax, financial, medical or other specialist advice.

The User should not use Hyzo as the sole basis for decisions producing legal or similarly significant effects on other individuals without appropriate human oversight and a lawful basis.

If the User submits third-party personal data to an AI feature, the User is responsible for having a lawful basis for that processing.

Hyzo informs Users that they are interacting with AI and identifies AI-enabled functionality to the extent required by applicable law, particularly where this is not obvious from the context.

13. Beta and experimental features

The Beta is intended for testing and development of the Service. The User acknowledges that Beta features may:

• contain errors or operate unstably;
• be temporarily unavailable;
• change more frequently than production features;
• be replaced, restricted or removed;
• have no guaranteed availability or response time unless Hyzo expressly agrees otherwise.

The User should keep an independent copy of information that is critical to the User’s business and should not treat the Beta as the sole repository for data whose loss could cause material damage.

Where a change to a digital service provided to a Consumer is governed by the Polish Consumer Rights Act, Hyzo makes changes only on the terms permitted by that Act. Legitimate reasons may include security, changes in law, technology or Integrations, abuse prevention, functionality improvements, removal of low-use features or adaptation to infrastructure changes. Changes do not limit mandatory Consumer rights.

14. Availability, maintenance and changes to the Service

Hyzo may carry out maintenance, deploy updates and temporarily restrict certain features where necessary for technical, security or product-development reasons.

For planned work with a material impact on availability, Hyzo may notify Users in advance where reasonably practicable.

The Service Provider does not guarantee uninterrupted operation of the Service unless a separate agreement or mandatory law provides otherwise.

15. Hyzo intellectual property

Subject to the User’s rights in User Content, all rights in Hyzo, including rights in code, interfaces, design, databases, marks, materials, documentation and visual elements, belong to the Service Provider or its licensors.

The User receives a limited, non-exclusive, non-transferable and revocable right to use Hyzo in accordance with these Terms for the duration of the agreement.

Providing suggestions, ideas or feedback about Hyzo does not transfer rights in User Content. The User agrees, however, that Hyzo may use general ideas, suggestions and product feedback without charge to develop the product, provided this does not require disclosure of confidential User Content or use of personal data contrary to the Privacy Policy.

16. Confidentiality of a private Beta

Where the User receives access to a non-public Beta, the User must keep confidential information that is expressly marked confidential or that, given the circumstances, should reasonably be understood as non-public information about the product, architecture, security or Hyzo plans, and must not disclose such information to third parties without Hyzo’s prior consent unless one of the exceptions below applies.

This obligation does not apply to information that was already lawfully public without breach of these Terms, was lawfully obtained from another source without a confidentiality obligation, or must be disclosed under applicable law.

17. Fees and future subscriptions

The applicable payment conditions are those shown to the User directly before purchase.

If a plan renews automatically, information about renewal frequency, price and cancellation will be provided before the agreement is entered into. Hyzo will not treat use of the Beta itself as consent to begin a paid subscription.

Any future subscription-price changes may be made only in accordance with the agreement, applicable law and information provided to the User with appropriate advance notice.

18. Consumer rights and conformity of the digital service

Nothing in these Terms limits rights granted to Consumers or Entrepreneurs with consumer rights by mandatory law.

Where provisions of the Polish Consumer Rights Act concerning digital services apply to Hyzo, Hyzo is liable for conformity of the Service with the agreement under those provisions. Such protection may also apply where a Consumer does not pay a price but provides personal data in exchange for a digital service, subject to statutory exceptions.

If the digital Service is not in conformity with the agreement, the Consumer may use remedies provided by law, including requesting that the Service be brought into conformity and, in cases specified by law, making a declaration to reduce the price or withdraw from the agreement.

To the extent required by law, Hyzo provides updates, including security updates, necessary to maintain conformity of the digital Service with the agreement for the required period.

Where, following withdrawal or termination, law gives the Consumer a right to retrieve content other than personal data that the Consumer provided or created while using Hyzo, Hyzo will make such content available upon request, free of charge, without unjustified hindrance, within a reasonable time and in a commonly used machine-readable format, subject to statutory exceptions.

19. Consumer right of withdrawal

A Consumer entering into a distance contract generally has the right to withdraw from it within 14 days without giving a reason unless a statutory exception applies.

If a Consumer requests that a paid service begin before expiry of the withdrawal period, the legal consequences of that request and any obligation to pay a proportionate amount will follow the Polish Consumer Rights Act and the information provided to the Consumer before entering into the agreement.

If Hyzo later supplies paid digital content not supplied on a tangible medium in circumstances where the right of withdrawal may be lost, that right will be lost only after all requirements of applicable law have been met, including obtaining the required prior consent and acknowledgement from the Consumer.

A withdrawal statement may be sent to hello@hyzo.io or to the Service Provider’s postal address. A model withdrawal form appears in Appendix 2. Use of the model form is optional.

20. Complaints

Complaints concerning Hyzo may be submitted to hello@hyzo.io.

Where possible, a complaint should include information allowing the Account to be identified, a description of the issue, when it occurred and the requested solution. Missing information does not deprive a Consumer of statutory rights, but may make diagnosis more difficult.

Hyzo responds to complaints without undue delay and, for Consumers, within the period required by applicable law, including 14 days where such a period applies.

21. Suspension and termination

A User may stop using the free Service at any time by deleting the Account where that functionality is available or by contacting Hyzo.

For any future paid plan, cancellation rules and the effect of cancellation for the current billing period will be presented before purchase.

Hyzo may suspend or terminate the agreement with immediate effect where the User:

• materially breaches these Terms and does not remedy the breach within a reasonable period after being requested to do so, where the breach can be remedied;
• uses the Service unlawfully, in a way that threatens security or infringes third-party rights;
• takes action that may damage infrastructure or compromise the security of other users;
• fails to pay due fees after notice, where the User is on a paid plan.

Where immediate action is required for security, legal or third-party-protection reasons, suspension may occur without prior notice.

For Consumers, these rights are exercised in accordance with mandatory law and do not deprive Consumers of statutory remedies.

22. Liability — general rules

Hyzo is liable to Consumers and Entrepreneurs with consumer rights to the extent required by mandatory law. Nothing in these Terms excludes liability that cannot legally be excluded or limited.

The User is responsible for how information and outputs obtained through Hyzo are used, including AI-generated outputs, subject to Hyzo’s liability under applicable law.

23. Liability to Business Users

The following limitations apply only to Business Users and only to the maximum extent permitted by law.

Hyzo is not liable for loss of profit, revenue, business opportunity, business interruption or indirect loss arising from use of the Service unless such liability cannot be excluded under mandatory law.

Hyzo’s aggregate liability to a Business User for all events connected with the Service during the 12 months preceding the event giving rise to liability is limited to the higher of:

1. the total fees actually paid by that Business User to Hyzo for the Service during that period; or
2. PLN 1,000.

The limitation does not apply to damage caused intentionally. With respect to contractual provisions concerning access to and use of data, it also does not apply where its application would be prohibited as an unfair contractual term under Article 13 of Regulation (EU) 2023/2854 (Data Act), including to the extent liability for gross negligence cannot be limited. The limitation also does not apply in any other case where liability cannot be restricted under mandatory law.

A Business User is responsible for maintaining independent copies of information critical to its business unless a separate agreement expressly provides otherwise.

24. Third-party claims caused by a Business User

If a third party brings a claim against Hyzo directly arising from unlawful content supplied by a Business User, lack of rights to that content, or the Business User’s knowing use of the Service in breach of law or these Terms, the Business User will reimburse Hyzo for reasonable and documented costs and losses to the extent they arise from circumstances for which the Business User is responsible.

Hyzo will notify the Business User of such a claim without undue delay and allow reasonable cooperation in the defence where this is not contrary to law, Hyzo’s legitimate interests or confidentiality obligations.

This section does not apply to Consumers.

25. Reporting illegal content and abuse

Content or activity that may violate law, third-party rights or Hyzo security may be reported electronically to hello@hyzo.io. Where Regulation (EU) 2022/2065 (Digital Services Act) applies to a particular Hyzo function, this address also serves as an electronic point of contact to the extent required by that Regulation.

A notice concerning potentially illegal content should, to the extent appropriate to the Service and required by law, include:

• a sufficiently precise indication of the content, Account, project or other location of the information concerned;
• reasons why the reporting party considers the information or activity illegal;
• contact details of the reporting party where required or necessary to handle the matter, subject to statutory exceptions;
• a statement that the reporting party believes in good faith that the information and allegations in the notice are accurate and complete, where required by applicable law.

Where required by law, Hyzo will acknowledge receipt, process the notice in a timely, diligent, objective and non-arbitrary manner, and inform the reporting party of the decision and available redress mechanisms.

Hyzo may remove content, restrict access to it, suspend an Account or take other proportionate measures where there is a legal or contractual basis for doing so. Where law requires a statement of reasons to be provided to the User, Hyzo will provide it to the required extent unless law permits an exception.

26. Changes to these Terms

Hyzo may amend these Terms for important reasons, including:

• changes in law or its interpretation;
• changes to features, technology, Integrations or the model for providing the Service;
• a need to improve security or prevent abuse;
• introduction of new plans, features or billing methods;
• reorganisation of the entity operating Hyzo.

An amendment may not violate accrued User rights or deprive a Consumer of protection arising from mandatory law.

Where an amendment materially affects an ongoing agreement, Hyzo will provide appropriate advance notice in a form allowing the information to be retained. Where applicable law gives a Consumer a right to terminate because of a change to a digital service, Hyzo will respect that right.

27. Transfer of the Hyzo project to a company or another entity

The Hyzo project may in the future be contributed to a company, sold, reorganised or transferred to another entity in connection with an investment or business reorganisation.

Hyzo may assign contractual rights to a legal successor or entity acquiring the project where legally permitted. Transfer of obligations will take place in accordance with applicable law and, where the User’s consent is required, that consent will be obtained.

A change in the entity providing the Service does not by itself deprive a Consumer of statutory rights.

28. Governing law and disputes

These Terms and agreements entered into with Hyzo are governed by Polish law, subject to mandatory provisions of applicable law.

The choice of Polish law does not deprive a Consumer of protection granted by provisions that cannot be excluded by agreement and that would otherwise apply under applicable private international law, including for Consumers resident in other countries.

Disputes with Business Users will be submitted to the court having territorial jurisdiction over the place where the Service Provider conducts its business as indicated in CEIDG, unless mandatory law provides otherwise.

For Consumers, jurisdiction is determined by applicable law, and these Terms do not limit a Consumer’s right to bring proceedings before a court having jurisdiction under consumer-protection rules.

Consumers may also use out-of-court consumer dispute-resolution mechanisms where available under applicable law. In Poland, information is available from municipal and district consumer ombudsmen and the relevant consumer-protection authorities.

29. Language versions

These Terms may be made available in Polish and English. Both versions are intended to describe the same rights and obligations. In the event of an interpretative discrepancy, the Polish version is the source version to the extent permitted by mandatory law. This does not deprive a Consumer of protection granted by legal provisions that cannot be excluded by agreement.

30. Final provisions

If a provision of these Terms is invalid or unenforceable, the remaining provisions remain in force to the extent permitted by the nature of the legal relationship.

Failure by Hyzo to exercise a right in a particular case does not constitute a waiver of that right in the future.

The current Terms are made available to the User before the agreement is entered into in a form that allows them to be saved, reproduced and retained.

Contact: hello@hyzo.io

Appendix 1 — Data Processing Agreement (DPA)

This Appendix applies where, in connection with provision of Hyzo, the User is a controller of personal data and Hyzo processes that data on the User’s behalf as a processor within the meaning of Article 28 GDPR.

A.1. Parties and precedence

The data controller is the User or the entity on whose behalf the User uses Hyzo (“Data Controller”).

The processor is Michał Kozicki, MICHAŁ KOZICKI DIGRA, entered in CEIDG, NIP 7582288800, Jaśminowa 16, 07-410 Ostrołęka, Poland (“Processor”).

In the event of a conflict between this Appendix and another part of the Terms with respect to processing personal data on behalf of the Data Controller, this Appendix prevails.

A.2. Subject matter and duration of processing

The subject matter of the processing is personal data contained in User Content to the extent necessary to provide Hyzo.

Processing continues for the duration of the agreement for use of Hyzo and for a technically justified period necessary to return or erase data in accordance with this Appendix and applicable law.

A.3. Nature and purpose of processing

Processing may include, in particular, storage, organisation, reading, retrieval, analysis, transformation, transmission, security, creation of technical copies and deletion of data for the purposes of:

• providing project and task functionality;
• processing documents, notes and other User Content;
• performing AI features selected by the User;
• operating Integrations enabled by the User;
• providing security, continuity and technical support for the Service.

A.4. Categories of data subjects and types of personal data

Depending on how Hyzo is used, personal data may concern in particular:

• Users and members of their teams;
• the User’s clients, contractors and collaborators;
• employees or representatives of the User’s clients;
• senders, recipients and participants in communications contained in data submitted by the User;
• other individuals mentioned in documents, notes, tasks or other User Content.

Types of data may include identification and contact details, professional and project data, content of communications, documents, notes and tasks, technical metadata and other data provided by the Data Controller.

The Service is not intended by default for deliberate processing of special categories of personal data, data relating to criminal convictions or offences, or children’s data. The Data Controller should use Hyzo for such processing only where lawful and expressly supported by the relevant feature.

A.5. Instructions of the Data Controller

The Processor processes personal data only on documented instructions from the Data Controller, including with regard to transfers to a third country or international organisation, unless Union or Member State law requires the Processor to process the data. In that case, the Processor will inform the Data Controller of that legal requirement before processing unless the law prohibits such information on important grounds of public interest.

Documented instructions include, in particular, actions taken by the Data Controller in the Hyzo interface, Integration configuration, instructions submitted to AI features, Account settings and instructions provided to the Processor electronically.

The Data Controller is responsible for ensuring that its instructions comply with law, that it has a lawful basis for processing personal data entrusted to the Processor and that it performs controller obligations that cannot be transferred to the Processor.

If the Processor considers an instruction to infringe the GDPR or other applicable data-protection law, the Processor will inform the Data Controller unless prohibited by law.

A.6. Confidentiality and security

The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

The Processor implements appropriate technical and organisational measures required by Article 32 GDPR, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the risks to the rights and freedoms of natural persons.

On a justified request from the Data Controller, the Processor may provide a description of relevant measures to the extent this does not compromise Hyzo security, other customers’ confidentiality or trade secrets.

A.7. Subprocessors

The Data Controller gives the Processor general authorisation to engage subprocessors where necessary to provide Hyzo, including providers of infrastructure, hosting, databases, storage, security, communications and AI models.

The Processor will ensure that each subprocessor is subject to data-protection obligations providing the level of protection required by Article 28 GDPR. The Processor remains liable to the Data Controller for performance of the subprocessor’s data-protection obligations to the extent required by Article 28(4) GDPR.

The Processor will inform the Data Controller of an intended addition or replacement of a subprocessor in a manner allowing the Data Controller to raise a reasoned objection before the new subprocessor begins processing, for example by email to the Account owner or through an in-Service notice.

If the objection cannot reasonably be resolved, the parties may discontinue use of the feature requiring that subprocessor or, where necessary, terminate the relevant part of the agreement.

A.8. Transfers outside the EEA

The Processor may use subprocessors outside the EEA only where an appropriate mechanism under Chapter V GDPR is used, including an adequacy decision or Standard Contractual Clauses together with supplementary safeguards where required.

A.9. Assistance to the Data Controller

Taking into account the nature of processing and the information available to the Processor, the Processor will provide reasonable assistance to the Data Controller with:

• responding to requests by data subjects;
• obligations concerning security of processing;
• data protection impact assessments and prior consultation with a supervisory authority where required;
• information necessary to demonstrate compliance with Article 28 GDPR.

Where a request for assistance goes beyond standard Service support and creates a material additional workload, the parties may agree reasonable costs for that assistance, except where the need for assistance results from the Processor’s breach of its obligations.

A.10. Personal data breaches

The Processor will notify the Data Controller without undue delay after becoming aware of a personal data breach affecting data processed on the Data Controller’s behalf and will provide information available to the Processor that is reasonably necessary for the Data Controller to comply with its GDPR obligations.

A.11. Deletion or return of data

After the end of the provision of the Service, the Processor will, at the Data Controller’s choice, delete or return the personal data and delete existing copies unless Union or Member State law requires further storage.

Data contained in backups may remain until the relevant backup is overwritten or expires under the backup cycle, provided that during that period it remains protected under this Appendix and is not used for other purposes.

A.12. Audits and compliance information

The Processor will make available to the Data Controller information necessary to demonstrate compliance with Article 28 GDPR.

Where documentation and standard information made available by the Processor are insufficient, the Data Controller may request an audit within a reasonable scope. The audit should be preceded by at least 30 days’ notice, take place during business hours, avoid unreasonable disruption to Hyzo and not compromise confidentiality or security of other users.

As a rule, an audit should not occur more than once per year unless a material incident has occurred, a supervisory authority requires more frequent review, or objective circumstances indicate a material breach.

The Data Controller bears the cost of the audit unless the audit establishes a material breach of the Processor’s obligations.

Appendix 2 — Model withdrawal form

(This form may be used but is not mandatory. The fields below are completed by the Consumer.)

To:
Michał Kozicki, MICHAŁ KOZICKI DIGRA
Jaśminowa 16, 07-410 Ostrołęka, Poland
hello@hyzo.io
+1 518 730 0517

I/We(*) hereby give notice that I/We(*) withdraw from my/our(*) contract for the following service:

..............................................................................

Date of conclusion of the contract:

..............................................................................

Name of Consumer(s):

..............................................................................

Address of Consumer(s):

..............................................................................

Date:

..............................................................................

Signature of Consumer(s) — only if this form is submitted on paper:

..............................................................................

(*) Delete as appropriate.