Data Processing Agreement

This Data Processing Agreement (“Agreement”) forms part of the Yemzio Terms of Service and applies to all customers using the Yemzio platform (“Platform”).

This Agreement is entered into between:

A.M.K. Ecoleaf Ltd, a company incorporated in the Republic of Cyprus with registration number HE272640G (“Yemzio”, “Processor”, “we”, “us”)

and

the customer using the Platform (“Customer”, “Controller”, “you”).

By accessing or using the Platform, the Customer agrees to this Agreement.

1. Purpose and Scope

This Agreement governs the processing of personal data by Yemzio on behalf of the Customer in connection with the use of the Platform.

Yemzio provides a dealflow management platform that connects to email systems and converts startup communications into structured investment pipelines. In providing this service, Yemzio processes personal data contained in emails, attachments, and investment-related communications.  

This Agreement ensures that such processing is carried out in compliance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

2. Roles of the Parties

For the purposes of this Agreement, the Customer acts as the data controller and determines the purposes and means of processing personal data.

Yemzio acts as the data processor and processes personal data solely on behalf of the Customer and in accordance with the Customer’s instructions, as reflected in the use of the Platform and these Terms.

Yemzio does not process personal data for its own independent purposes and does not sell or exploit Customer Data.

3. Nature of Processing

Yemzio processes personal data only as necessary to provide the Platform.

This includes the ingestion, structuring, storage, organization, and retrieval of data related to startup dealflow and investor communications. The Platform converts unstructured communications, such as emails and attachments, into structured startup profiles, timelines, and investment pipelines.

Processing activities may include collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, and deletion of personal data.

4. Categories of Data and Data Subjects

The personal data processed through the Platform may include professional contact information, communication content, and attachments such as pitch materials.

Data subjects may include startup founders, employees of startups, investors, and employees or representatives of the Customer.

The Customer determines what data is processed through the Platform and remains responsible for ensuring that such processing is lawful.

5. Customer Instructions

Yemzio shall process personal data only on documented instructions from the Customer.

The Customer instructs Yemzio to process personal data as necessary to provide the Platform, including email integration, data structuring, and dealflow management functionality.

If Yemzio believes that an instruction violates applicable data protection laws, it shall inform the Customer without undue delay.

6. Confidentiality

Yemzio ensures that all personnel authorized to process personal data are subject to confidentiality obligations.

Access to personal data is restricted to individuals who require access to provide the Platform and is granted on a need-to-know basis.

7. Security Measures

Yemzio implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, or misuse.

These measures include encryption of data in transit and at rest, access control mechanisms, authentication safeguards, and system monitoring.

Given the nature of the Platform, which processes sensitive investment-related communications, Yemzio applies data isolation between customers and restricts internal access to data.

8. Subprocessors

Yemzio may engage subprocessors to support the operation of the Platform, including infrastructure, hosting, and payment services.

All subprocessors are subject to contractual obligations that ensure a level of data protection consistent with this Agreement.

Yemzio remains responsible for the actions of its subprocessors.

A list of subprocessors may be made available upon request or published separately.

9. International Data Transfers

Where personal data is transferred outside the European Economic Area, Yemzio ensures that appropriate safeguards are in place, including Standard Contractual Clauses or equivalent mechanisms.

10. Assistance to the Customer

Yemzio provides reasonable assistance to the Customer in fulfilling its obligations under applicable data protection laws, including responding to data subject requests and supporting compliance with security and breach-related obligations.

11. Data Breach Notification

In the event of a personal data breach affecting Customer Data, Yemzio will notify the Customer without undue delay after becoming aware of the breach.

Yemzio will take appropriate steps to mitigate the impact and prevent further incidents.

12. Data Retention and Deletion

Yemzio retains personal data only for as long as necessary to provide the Platform and in accordance with the Customer’s instructions.

Upon termination of the service, Customer Data will be deleted or made inaccessible within a reasonable period, unless retention is required by law.

13. Audit and Compliance

Yemzio will make available information reasonably necessary to demonstrate compliance with this Agreement.

Where appropriate, Customers may request additional information regarding data protection practices, provided such requests do not compromise the security or operations of the Platform.

14. Relationship with Terms of Service

This Agreement forms an integral part of the Yemzio Terms of Service.

In the event of a conflict between this Agreement and the Terms of Service, this Agreement shall prevail with respect to data protection matters.

15. Updates to this Agreement

Yemzio may update this Agreement from time to time to reflect changes in legal requirements or the Platform.

Where changes are material, Customers will be notified. Continued use of the Platform constitutes acceptance of the updated Agreement.