Data Processing Agreement

1. Scope and applicability

This DPA applies whenever ZevyAI processes personal data on behalf of the Controller in connection with the services. It supplements the Master Subscription Agreement and forms part of the contractual relationship between the parties.

Where data protection laws including the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the UK GDPR, the California Consumer Privacy Act, and other applicable privacy laws apply to the processing, the terms of this DPA take precedence over any conflicting term of the underlying agreement.

The parties acknowledge that the Controller alone determines the purposes and means of processing personal data, and that ZevyAI processes personal data only on documented instructions from the Controller.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person processed by ZevyAI on behalf of the Controller in the course of providing the services.

"Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.

"Subprocessor" means any third party engaged by ZevyAI to process Personal Data on behalf of the Controller. A current list of approved Subprocessors is published below and at https://zevyai.com/legal/dpa.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates. Capitalised terms not defined here have the meanings given to them in the Master Subscription Agreement or the GDPR.

3. Roles and responsibilities

The Controller is the controller of Personal Data and ZevyAI is the processor. Each party will comply with its respective obligations under applicable data protection laws.

The Controller is responsible for ensuring it has a valid legal basis for the processing it instructs and for providing data subjects with all required notices.

ZevyAI will process Personal Data only on documented instructions from the Controller, including the instructions contained in the agreement and in this DPA, unless required to do otherwise by Union or Member State law to which ZevyAI is subject.

4. Controller instructions

The Controller's complete and final instructions for the processing of Personal Data are set out in the agreement, the order form, and the documented configuration of the services.

ZevyAI will notify the Controller without undue delay if, in its opinion, an instruction infringes applicable data protection law, unless prohibited from doing so on important grounds of public interest.

Additional or alternative instructions may be issued via the support channels described in the agreement. ZevyAI is not obliged to follow instructions that would require it to materially exceed the scope of the services or to incur disproportionate cost.

5. Confidentiality

ZevyAI ensures that personnel authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Access to Personal Data is restricted on a need-to-know basis. ZevyAI maintains a documented onboarding and offboarding process that revokes access promptly when a role change occurs.

All personnel receive annual privacy and security awareness training and are required to acknowledge ZevyAI's information security policies.

6. Technical and organisational measures

ZevyAI implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, including the measures set out in Annex II of the Standard Contractual Clauses where applicable.

Measures include encryption of Personal Data in transit (TLS 1.2 or above) and at rest (AES-256), role-based access control with least-privilege defaults, automated key rotation, network segmentation, multi-factor authentication for all administrative access, continuous logging, vulnerability scanning, and an annual penetration test performed by an independent third party.

ZevyAI evaluates and updates its security measures regularly to reflect industry best practices and the evolving threat landscape.

7. Subprocessors

The Controller authorises ZevyAI to engage the Subprocessors listed in Annex A (also reproduced in the table below) for the processing of Personal Data.

ZevyAI will notify the Controller of any intended changes concerning the addition or replacement of Subprocessors at least thirty (30) days in advance, giving the Controller the opportunity to object on reasonable grounds related to data protection.

ZevyAI imposes data protection obligations on each Subprocessor that are no less protective than those set out in this DPA, including the requirement to provide sufficient guarantees to implement appropriate technical and organisational measures.

8. Data subject rights

Taking into account the nature of the processing, ZevyAI assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligation to respond to requests from data subjects exercising their rights under applicable data protection laws.

Where a request is received directly by ZevyAI, ZevyAI will, without undue delay, forward the request to the Controller and will not respond to the data subject directly unless instructed by the Controller or required by law.

The services provide self-service export, rectification, and deletion tooling that the Controller can use to satisfy most data subject requests without involving ZevyAI personnel.

9. Personal data breach notification

ZevyAI notifies the Controller without undue delay, and in any event within seventy-two (72) hours of becoming aware, of any Personal Data Breach affecting the Controller's Personal Data.

The notification will describe the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its possible adverse effects.

ZevyAI cooperates with the Controller and provides reasonable assistance to enable the Controller to comply with its own obligations to notify supervisory authorities and affected data subjects.

10. International data transfers

Where Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, the transfer is governed by the appropriate Standard Contractual Clauses adopted by the European Commission and, where relevant, the UK International Data Transfer Addendum.

The parties agree to execute additional documentation reasonably required to give effect to any successor mechanism approved by competent authorities.

ZevyAI conducts a transfer impact assessment for each new Subprocessor located outside an adequate jurisdiction and applies supplementary measures where necessary.

11. Audits and inspections

ZevyAI makes available to the Controller all information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

The Controller may exercise this right not more than once per calendar year, except where required by a competent supervisory authority. Audits must be conducted during regular business hours, with reasonable advance notice, and in a manner that does not unreasonably disrupt ZevyAI's business operations.

At the Controller's request, ZevyAI will provide a current SOC 2 Type II report and ISO 27001 certificate in lieu of an on-site audit where the report addresses the controls relevant to the inquiry.

12. Retention

ZevyAI retains Personal Data only for as long as necessary to provide the services or as instructed by the Controller, unless retention is required by applicable law.

Upon expiry of the retention period, ZevyAI deletes Personal Data using industry-standard secure deletion methods. Backups are overwritten in the ordinary course of business and become unrecoverable within ninety (90) days of deletion.

The Controller can configure custom retention windows for chats, files, and audit logs via the workspace settings.

13. Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitations and exclusions of liability set out in the Master Subscription Agreement.

Nothing in this DPA limits either party's liability for damages caused by a wilful breach of this DPA or for matters that cannot be limited under applicable law.

14. Termination and return of data

This DPA terminates automatically upon termination or expiration of the Master Subscription Agreement.

Upon termination, ZevyAI will, at the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the Personal Data.

The Controller may export Personal Data at any time during the term using the self-service export tools provided in the services.

Annex A — Approved Subprocessors