Skip to content
Nuzz

Data Processing Addendum

Last updated October 25, 2026

Nuzz ("Nuzz," "we," "us," or "our") is a software platform operated by Playbooko LLC, a Tennessee limited liability company ("Company"). References to Nuzz throughout this document refer to the services offered by Playbooko LLC under the Nuzz brand.

This Data Processing Addendum ("DPA") forms part of the Nuzz Terms of Service (the "Terms") between Playbooko LLC, a Tennessee limited liability company, and the Customer. It applies when Nuzz processes Personal Data in Customer Data on the Customer's behalf. Capitalized terms not defined here have the meanings in the Terms.

1. Definitions#

  • "Data Protection Laws" means all privacy and data protection laws that apply to the processing of Personal Data under the Terms, which may include the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended ("CCPA") and other U.S. state privacy laws.
  • "Personal Data" means information in Customer Data that relates to an identified or identifiable individual, or is otherwise "personal information" or "personal data" under Data Protection Laws.
  • "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed by Nuzz.
  • "Subprocessor" means a third party that Nuzz engages to process Personal Data.
  • "Controller," "processor," "data subject," "business," "service provider" and similar terms have the meanings in Data Protection Laws.

2. Roles#

The Customer is the controller (or business) of Personal Data, and Nuzz is its processor (or service provider). Where the Customer is itself a processor for another controller, Nuzz is its subprocessor, and the Customer is responsible for obtaining that controller's authorizations.

3. Customer instructions#

Nuzz will process Personal Data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's configuration and use of the Services (including what Users take or approve) are the Customer's complete instructions. Nuzz will tell the Customer if it believes an instruction violates Data Protection Laws. The Customer is responsible for the lawfulness of its instructions and for having a lawful basis, and any required notices and consents, for the processing, including for its use of website tracking and email features.

4. Details of processing#

Annex 1 describes the subject matter, nature, purpose and duration of processing, and the types of Personal Data and data subjects.

5. Confidentiality#

Nuzz will ensure that anyone it authorizes to process Personal Data is bound by confidentiality obligations, and will limit access to those who need it to provide, secure or support the Services.

6. Security#

Nuzz will implement and maintain appropriate technical and organizational measures to protect Personal Data, including those in Annex 2. Nuzz may update these measures as long as the overall level of protection is not reduced.

7. Subprocessors#

  • Authorization. The Customer authorizes Nuzz to engage the Subprocessors listed at getnuzz.com/subprocessors.
  • Obligations. Nuzz will have a written agreement with each Subprocessor with data protection obligations no less protective than this DPA, and remains responsible for its Subprocessors' performance.
  • Changes. Nuzz will notify the Customer's workspace owner by email at least 30 days before a new Subprocessor processes Personal Data. The Customer may object on reasonable data protection grounds by emailing privacy@getnuzz.com within that period. The parties will discuss the objection in good faith; if it can't be resolved, the Customer may terminate the affected Services and receive a refund of prepaid fees for the remainder of the term.

8. Data subject requests#

Taking into account the nature of the processing, Nuzz will help the Customer respond to requests from individuals exercising their rights under Data Protection Laws. If Nuzz receives a request directly about Customer Data, it will refer the individual to the Customer and won't respond itself, unless the law requires otherwise.

9. Security Incidents#

Nuzz will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident. The notice will describe, to the extent known, the nature of the incident, the data and individuals affected, the likely consequences and the measures taken or proposed. Nuzz will take reasonable steps to contain and investigate the incident and will cooperate with the Customer's reasonable requests. Notifying the Customer isn't an admission of fault.

10. Assistance#

Nuzz will provide reasonable assistance, using information available to it, with the Customer's data protection impact assessments and consultations with supervisory authorities, where Data Protection Laws require them.

11. Deletion and return#

During the term, the Customer can export or delete Customer Data as the Services allow, or ask Nuzz to. After the Terms end, Nuzz will, at the Customer's request made within 30 days, provide an export of Customer Data. Nuzz will then delete Customer Data within 30 days, unless the law requires it to keep some. Copies in backups are deleted as the backups expire and are kept secure until then.

12. Audits#

Nuzz will make available information reasonably necessary to demonstrate its compliance with this DPA, including by answering reasonable security questionnaires no more than once a year. If Data Protection Laws require more, the Customer may audit Nuzz's compliance, at its own cost, with at least 30 days' notice, during business hours, no more than once a year, under confidentiality obligations, and in a way that doesn't disrupt Nuzz's operations or compromise other customers' data.

13. International transfers#

Nuzz and its Subprocessors process Personal Data in the United States. To the extent the GDPR or UK GDPR applies to a transfer of Personal Data to Nuzz in a country without an adequacy decision, the parties agree to the Standard Contractual Clauses approved by the European Commission in Decision 2021/914 (Module Two, controller to processor, or Module Three, processor to processor, as applicable), which are incorporated by reference, with the UK Addendum for UK transfers. For those clauses: the optional docking clause applies; Clause 9 option 2 (general authorization) applies with the notice period in Section 7; the optional language in Clause 11 doesn't apply; Clauses 17 and 18 are governed by the laws, and the courts, of Ireland; and Annexes 1 and 2 of this DPA complete the clauses' annexes.

14. U.S. state privacy laws#

Where the CCPA or similar U.S. state laws apply, Nuzz is a service provider (or processor) and will:

  • Not sell or share Personal Data, as those terms are defined in those laws.
  • Not retain, use or disclose Personal Data outside the direct business relationship with the Customer, or for any purpose other than providing the Services as described in the Terms.
  • Not combine Personal Data with personal information it receives from others, except as those laws permit.
  • Comply with those laws and provide the same level of privacy protection they require, and notify the Customer if it can no longer meet its obligations.
  • Allow the Customer to take reasonable steps to stop and remediate unauthorized use of Personal Data.

15. General#

This DPA lasts as long as Nuzz processes Personal Data for the Customer. If this DPA conflicts with the Terms, this DPA controls as to the processing of Personal Data. The limitations of liability in the Terms apply to this DPA. If the Customer needs a countersigned copy, email legal@getnuzz.com.

Annex 1: Details of processing#

  • Parties. Data exporter: the Customer (controller). Data importer: Playbooko LLC (processor), Tennessee, USA, contact privacy@getnuzz.com.
  • Subject matter and nature. Providing the Services: storing, syncing, organizing, analyzing and displaying Customer Data; generating AI answers, drafts, summaries, scores and suggestions; carrying out actions Users take or approve; and the related hosting, support and security.
  • Purpose. To provide the Services to the Customer under the Terms.
  • Duration. For the term of the Terms and the deletion period in Section 11.
  • Frequency. Continuous.
  • Data subjects. The Customer's Users; the Customer's customers, prospects, contacts and business partners whose information is in the Customer's CRM or imported files; people who attend the Customer's meetings; and visitors to the Customer's websites that use Nuzz tracking.
  • Types of Personal Data. Names, business contact details (email, phone, company, job title), CRM records and their history, content of emails, calls, notes and meeting transcripts held in connected systems, calendar event details, website activity (pages, referrers, campaign tags, device type, an anonymous visitor ID, identity fields from submitted forms, content opens), and Users' prompts and conversations with the assistant.
  • Sensitive data. None intended. The Customer won't submit special categories of data or sensitive personal information unless Nuzz agrees in writing.

Annex 2: Technical and organizational measures#

  • Encryption. Data is encrypted in transit with TLS. Stored data is encrypted at rest by our database and storage provider. Access tokens for connected services are additionally encrypted with AES-256-GCM.
  • Access control. Users sign in through Google or single-use email links. Sessions use random tokens stored only as hashes, in secure, HTTP-only cookies. Within a workspace, role-based permissions limit who can connect integrations and change settings. Workspaces are logically separated, and every request is scoped to the signed-in user's workspace.
  • Human approval. Changes proposed by the AI assistant, and emails it drafts, require a User's approval. Changes are recorded in a change log with the person responsible.
  • Least privilege for integrations. Nuzz requests the narrowest permissions it needs (for example, send-only access to Gmail and read-only access to calendars).
  • Internal access. Access to production systems and Customer Data is limited to authorized personnel who need it, through individual accounts. In-app staff access is limited to named staff accounts with verified email addresses.
  • Infrastructure. Hosting and databases run on established cloud providers in the United States. Production configuration and secrets are kept out of source code.
  • Application security. Security headers, protection against cross-site requests, input validation and rate limits on sign-in and public endpoints.
  • Backups and availability. The database provider keeps point-in-time backups.
  • Incident response. Security reports go to security@getnuzz.com; incidents are handled under Section 9.
  • Subprocessors. Chosen for their security practices and bound by written agreements.