Data Processing Addendum

Last updated: 18 August 2026

1. Roles and scope

For personal data contained in Customer Data, you are the controller and Zeno Technologies Pvt. Ltd. is the processor. Where you are yourself a processor for another controller, we are a sub-processor and this DPA applies as if you were the controller, on the basis that you have the authority to enter it.

For our own business records — your billing contact, correspondence with our support team, security logs, and aggregate usage statistics — we are the controller, and our Privacy Policy governs that processing rather than this DPA.

Terms defined in the Terms of Service carry the same meaning here. "Applicable Data Protection Law" means the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA as amended by the CPRA, and any other law governing the processing under this agreement. "Personal Data", "controller", "processor", "processing", and "data subject" take their meaning from that law.

2. Details of the processing

This section is the schedule that Article 28(3) requires, and it is what an auditor will ask you for.

• Subject matter. Provision of the Zeno platform as described in the Terms of Service.
• Duration. The term of your subscription, plus the deletion window in clause 10.
• Nature and purpose. Hosting, storage, transmission, retrieval, indexing, analysis, and deletion of Customer Data in order to operate the products you have enabled, including delivering and receiving messages on the channels you connect.
• Categories of data subject. Your Authorised Users, and the end users your business communicates with or records — typically your customers, prospects, suppliers, and employees.
• Categories of personal data. Determined by what you choose to store. Typically: identifiers such as name, phone number, and email address; message content and attachments across WhatsApp, SMS, email, and voice, together with transcripts and descriptions derived from that media; commercial records such as deals, tickets, orders and invoices; employment records where you use the HR product; consent and preference records with their evidentiary metadata; and technical data such as IP address and user agent.
• Special categories. Not required by the platform and not expected. If you intend to process special-category data, tell us first under clause 5 so that we can agree the additional safeguards it needs.
• Frequency. Continuous, for as long as the service is in use.

3. Our obligations

• Process personal data only on your documented instructions. This DPA, the Terms of Service, and your configuration of the platform together constitute those instructions. Your use of a feature is an instruction to perform the processing that feature involves.
• Tell you if, in our opinion, an instruction infringes Applicable Data Protection Law. We may suspend the affected processing until it is resolved rather than carry it out.
• Process only where legally required beyond your instructions, and where that happens, tell you first unless the law forbids it.
• Ensure everyone authorised to process the data is bound by confidentiality obligations that survive their engagement.
• Implement and maintain the technical and organisational measures in clause 7.
• Assist you with data subject requests, as set out in clause 8.
• Assist you with data protection impact assessments and prior consultations, taking into account the information available to us.
• Notify you of a personal data breach as set out in clause 9, and delete or return data as set out in clause 10.
• Make available the information needed to demonstrate compliance, and submit to audits under clause 11.
• Not sell or share personal data as those terms are defined by the CCPA and comparable laws, and not retain, use, or disclose it for any purpose other than performing the service. We certify that we understand and will comply with this restriction.
• Not train models on Customer Data, and contract with model providers on terms that prohibit them from doing so.

4. Your obligations

• Ensure you have a lawful basis for the personal data you put into the platform and for the messages you send, and that the required notices have been given to data subjects.
• Obtain and evidence the consents required by clause 6 of the Terms of Service before messaging anyone, and honour withdrawals.
• Configure the platform appropriately: retention rules, roles and permissions, agent capability grants, and approval requirements are yours to set, and the defaults are not advice.
• Keep your credentials secure and remove access for people who no longer need it.
• Ensure the accuracy of the data you upload, and respond to data subject requests that reach you as controller.

5. Special categories and restricted data

The platform is general-purpose business software and is not designed or certified for health data under HIPAA, for card data under PCI-DSS, or for classified government data. Do not put such data into it without a written agreement with us that addresses the requirement.

Where you use the HR product, employment records will necessarily include some sensitive information. That is expected and within scope; the restriction above is about regulated categories that carry their own compliance regime.

6. Sub-processors

You give general authorisation for us to engage sub-processors. Each is bound by a written agreement imposing data protection obligations no less protective than this DPA, and we remain fully liable to you for their performance.

The current list:

Changes. We give at least 30 days’ notice by email before adding or replacing a sub-processor. Subscribe by writing to legal@zenohq.io. You may object on reasonable data protection grounds within that period; we will work with you to find an alternative, and if we cannot, you may terminate the affected part of the service and receive a pro-rata refund of prepaid fees. We may replace a sub-processor immediately where waiting would create a security or continuity risk, and will tell you as soon as we can.

7. Security measures

We implement and maintain appropriate technical and organisational measures under Article 32. These are the measures as at the date above; we may change them, but not in a way that materially reduces overall security during your subscription.

On certifications, plainly: SOC 2 Type II is in progress and we do not claim it until the report exists. ISO 27001 is planned to follow. We would rather tell you the true status than show a badge we have not earned. Ask and we will share the current position, including the penetration test summary, under NDA.

8. Data subject requests

The platform gives you the tools to answer most requests yourself, without needing us: a data inventory that lists every record tied to an identifier, export in machine-readable formats, correction, deletion, and a consent history you can produce as evidence.

Where a request cannot be handled through those tools, we will assist you, taking into account the nature of the processing. If a data subject contacts us directly about data we hold on your behalf, we will not respond substantively; we will tell them to approach you, identify you to them, and forward the request so it does not disappear.

Our public instructions for data subjects are at how to delete your data.

9. Personal data breach

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records involved, the likely consequences, the measures taken or proposed, and a contact point — to the extent that information is available at the time.

We will not delay a first notification in order to make it complete. You will get what we know, an explicit statement of what we do not yet know, and updates as the investigation proceeds.

We will assist you in meeting your own notification obligations to supervisory authorities and data subjects. Notifying is your decision as controller, and we will not make it on your behalf or notify your data subjects without instruction, unless the law compels us.

10. Deletion and return

You can export Customer Data at any time during the subscription. On termination, data remains available for export for 30 days.

After that window we delete Customer Data within a further 30 days. Encrypted backups roll off within 35 days, and until they do, deleted data persists there; backups are restored only for disaster recovery, never to resurrect deleted records.

We retain only what the law requires us to: billing records for tax purposes, security audit logs for their 12-month window, and suppression and consent records that exist to prove someone asked not to be contacted. Deleting that last category would defeat its purpose. Each is restricted to that use and nothing else.

Written confirmation of deletion is available on request.

11. Audits

We will make available the information reasonably needed to demonstrate compliance with Article 28, including our security documentation, penetration test summary, and completed security questionnaires, under NDA.

Where that is not sufficient for your regulator or your own obligations, you may audit us, or appoint an independent auditor who is not our competitor, on 30 days’ written notice, no more than once a year unless a regulator requires otherwise or a breach has occurred. Audits happen during business hours, must not unreasonably disrupt operations, and are subject to confidentiality. Each party bears its own costs; we may charge for time spent on audits beyond the annual one.

12. International transfers

Several sub-processors in clause 6 are outside the EEA and the UK. Where personal data originating there, or in Switzerland, is transferred outside it, the transfer is made under an adequacy decision where one applies, and otherwise under the European Commission’s Standard Contractual Clauses.

The SCCs are incorporated into this DPA by reference, with Module Two (controller to processor) applying where you are a controller and Module Three (processor to processor) where you are a processor. The details in clause 2 populate Annex I, and clause 7 populates Annex II. Docking is permitted. Where a choice is offered, the supervisory authority is that of your establishment, and the governing law is that of the EU member state in which it sits.

For UK transfers, the UK International Data Transfer Addendum applies to the SCCs. For Swiss transfers, references are read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner.

We will tell you if we receive a legally binding request from a public authority for Customer Data, unless prohibited from doing so, and we will challenge requests that appear unlawful or overbroad.

13. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in clause 17 of the Terms of Service. Nothing here limits a data subject’s rights under Applicable Data Protection Law, or either party’s liability to a supervisory authority.

14. Order of precedence

If this DPA conflicts with the Terms of Service, this DPA prevails on data protection matters. If it conflicts with the Standard Contractual Clauses, the Clauses prevail. A negotiated agreement signed by both parties prevails over all of them on whatever it addresses.

15. Contact

Data protection questions: privacy@zenohq.io
Data protection officer: dpo@zenohq.io
Contractual questions and counter-signed copies: legal@zenohq.io
Security reports: security@zenohq.io
Postal: Zeno Technologies Pvt. Ltd., [Registered office address, city, postal code, country]

See also our Privacy Policy, our Terms of Service, our Cookie Policy, and how to delete your data.