Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between ZenzoLabs ("Processor") and the customer ("Controller"). It applies to the extent that ZenzoLabs processes Personal Data on behalf of the Controller in connection with the Service and is designed to comply with Article 28 of the UK GDPR and EU GDPR.

1. Definitions

Terms not defined here have the meaning given in the Terms or in UK GDPR / EU GDPR. "Personal Data", "Processing", "Data Subject", "Sub-processor" and "Supervisory Authority" shall be interpreted accordingly.

2. Roles

The Controller is the controller of Personal Data contained in Customer Data. ZenzoLabs acts as a processor when processing such Personal Data on the Controller's documented instructions. ZenzoLabs is the controller of its own account and billing data — covered by its Privacy Notice.

3. Subject-matter, duration, nature and purpose

4. Processor obligations

1. Process Personal Data only on the Controller's documented instructions (including those in the Terms, this DPA, and the configured connectors).
2. Ensure all personnel authorised to process Personal Data are bound by confidentiality.
3. Implement appropriate technical and organisational measures (Annex II).
4. Engage sub-processors only under written terms imposing equivalent data-protection obligations (clause 6).
5. Assist the Controller in responding to Data Subject requests, taking into account the nature of the processing.
6. Assist the Controller with DPIAs, prior consultations, and Articles 32–36 obligations.
7. Notify the Controller without undue delay (and in any event within 48 hours) on becoming aware of a Personal Data Breach affecting Controller's data.
8. On termination, delete or return Personal Data at the Controller's choice within 30 days (see Data Deletion), unless retention is required by law.
9. Make available to the Controller information needed to demonstrate compliance and allow audits as set out in clause 7.
10. Immediately inform the Controller if, in its opinion, an instruction infringes UK GDPR, EU GDPR or other data-protection law.

5. Controller obligations

The Controller warrants that it has a lawful basis to share Personal Data with ZenzoLabs, has provided all required notices to Data Subjects, and will not instruct ZenzoLabs to process Personal Data in a manner that infringes applicable law.

6. Sub-processors

The Controller grants ZenzoLabs general authorisation to engage sub-processors. The current list and locations are published at /subprocessors.html. ZenzoLabs will give at least 30 days' notice of any new or replaced sub-processor (by updating the page and notifying customers who have subscribed to updates). The Controller may object on reasonable data-protection grounds; if the parties cannot resolve the objection in good faith, the Controller may terminate the affected portion of the Service for convenience.

7. Audits

ZenzoLabs will make available, on written request and subject to confidentiality, its then-current security documentation (e.g. security whitepaper, penetration-test summary, ISO 27001 / SOC 2 reports as they become available). The Controller may, no more than once per year and on at least 30 days' notice, conduct an audit, which may take the form of a questionnaire. On-site audits require reasonable scope and a mutually agreed scope and timing, and the Controller bears the costs.

8. International transfers

Where Personal Data is transferred from the UK or EEA to a third country, the parties incorporate by reference the relevant transfer mechanism:

• For UK→third-country transfers: the UK International Data Transfer Addendum to the EU SCCs (IDTA Addendum) — Controller-to-Processor module — with the Annexes populated from this DPA and the Sub-processors page.
• For EEA→third-country transfers: the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (Controller to Processor), with the same Annexes.
• Where the recipient is certified under the UK Extension to the EU–US Data Privacy Framework, that mechanism is used in addition.

9. Liability

Each party's liability under this DPA is subject to the limitations in the Terms. Nothing in this DPA limits a Data Subject's rights against either party under Article 82 of UK GDPR / EU GDPR.

10. Governing law

This DPA is governed by the laws of England and Wales, except where the EU SCCs require otherwise; in that case, the law of the EU Member State chosen in the SCCs applies to the SCCs only.

Annex I — Description of the processing

As set out in clause 3.

Annex II — Technical and organisational measures

Summary (full detail in our Security Policy):

• TLS 1.2+ in transit; encryption at rest where supported by the hosting provider.
• Role-based access control and principle of least privilege.
• Privacy-firewall architecture: raw business data is not sent to third-party LLMs — only schema and aggregated/derived results.
• Centralised audit logs of admin and customer actions.
• Hardened, container-isolated workloads on a UK/EU-based VPS; configuration as code.
• Multi-factor authentication for admin accounts; password hashing with modern KDFs.
• Documented incident-response and breach-notification process.
• Documented backup and restore procedure.
• Personnel confidentiality obligations; security awareness for all engineers.

Annex III — List of sub-processors

See subprocessors.html, which is maintained as part of this DPA.