Draft pending legal review. It is accepted when the clinic or shelter signs up.
1. Parties and purpose
This agreement is entered into between the veterinary clinic or shelter that uses Mizuu (the “Controller”) and Mizuu (the “Processor”). It is accepted when the clinic or shelter signs up and is part of their terms of use.
Purpose: Mizuu processes on behalf of the Controller the personal data that the Controller stores on the platform, only to provide the contracted service (calendar and appointments, clinical history, clients, invoices, alerts and reminders, data import from another program, animal management, applications, foster care and volunteering, and adoption contracts).
2. Data and data subjects
- Data subjects: clients and owners of the animals, adoption applicants, foster carers, volunteers and members of the Controller's team.
- Data: identification and contact details, address, animal data and history, appointments, invoices and payments, messages, adopters' identity documents (encrypted) and contract signatures.
- No special categories of data under art. 9 GDPR are processed, unless the Controller enters them on its own in free-text fields, which it must avoid.
3. Duration
It lasts as long as the Controller has an account on Mizuu. When it ends, point 11 (return and deletion) applies.
4. Controller's instructions
Mizuu processes the data only following the Controller's documented instructions: these terms, the settings the Controller chooses in its dashboard and the requests it makes in writing to [email protected]. If Mizuu believes an instruction infringes data protection rules, it will tell the Controller immediately.
Mizuu does not use this data for its own purposes, does not sell it and does not disclose it, except where legally required. Families who have their own account on Mizuu are, for the data of that account, users of Mizuu, and there Mizuu is the controller of its own processing.
5. Confidentiality
The people at Mizuu who access the data are bound to secrecy, also after they stop working with Mizuu, and only access it when they need to in order to provide the service or to handle an incident or a report.
6. Security measures (art. 32 GDPR)
- Encryption in transit (TLS) and encryption at rest of the most sensitive data (identity documents, IBAN, phone numbers and addresses) with AES-256-GCM.
- Passwords stored with Argon2id, two-factor authentication for shelter and admin accounts, lockout after failed attempts and request limits.
- Role-based permissions within the Controller's team and an audit log of sensitive actions.
- Encrypted backups and an incident management procedure.
7. Sub-processors
The Controller gives Mizuu general authorization to use these sub-processors, which process the data with guarantees equivalent to those of this agreement:
- Cloudflare (network, protection and file hosting).
- Resend (email sending).
- Google Firebase (push notifications).
- Stripe (payments).
- Google Play (subscription payment from the Android app).
- Anthropic (only if the AI vaccination record scan is used).
- OpenAI (only to turn voice notes into text).
Mizuu will notify the Controller at least 15 days in advance before adding or changing a sub-processor, and the Controller may object. If the objection prevents the service from being provided, the Controller may cancel at no cost. Transfers outside the European Economic Area are covered by the EU-US Data Privacy Framework or by standard contractual clauses.
8. Help with data subjects' rights
If a data subject asks Mizuu to exercise their rights over the Controller's data, Mizuu will forward the request to the Controller within 5 working days at most. Mizuu will help the Controller with the platform's tools (exporting, correcting and deleting data) so it can reply on time.
9. Security breaches
Mizuu will notify the Controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting its data, with the information available: what happened, what data and how many people it affects, likely consequences and measures taken. This way the Controller can notify the supervisory authority within 72 hours (art. 33 GDPR) and, if there is a high risk, the data subjects (art. 34 GDPR).
10. Other help for the Controller
Mizuu will give the Controller the reasonable information it needs to carry out impact assessments or prior consultations, when applicable.
11. Return and deletion at the end
Before cancelling, the Controller can download its data from the dashboard (export of clients, history and invoices). After cancellation, Mizuu will delete the Controller's data within 90 days at most, except for what the law requires to be kept (for example, invoices), which will be kept blocked for the legal period. The clinical history that is part of the passport of an animal with an owner on Mizuu is kept in that passport, as information about the animal.
12. Information and audits
Mizuu will make available to the Controller the information needed to show that it complies with this agreement and will allow reasonable audits, with 30 days' prior notice, once a year at most unless there is a breach, at the Controller's expense and without access to other clients' data.
13. Controller's obligations
The Controller guarantees that it has a legal basis to process the data it uploads to Mizuu (including data it imports from another program) and that it has informed its clients, applicants and volunteers. Where the rules require it, it is the one who handles data subjects' rights and who notifies breaches to the authority.
