Data Processing Agreement

"Data Protection Laws" means all laws and regulations applicable to the processing of personal data under this DPA, including the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the CCPA/CPRA (California).

"Personal Data", "Process", "Processor", "Controller", "Data Subject", and "Supervisory Authority" have the meanings given in the applicable Data Protection Laws.

"Sub-processor" means any third party engaged by Zenith Intelligence Technologies to Process Personal Data on behalf of Customer in connection with the Service.

Customer is the Controller and Zenith Intelligence Technologies is the Processor of Customer Personal Data Processed in the course of providing the Service. Where Customer's use of the Service involves Personal Data of EU/UK/Swiss Data Subjects, the EU/UK/Swiss provisions of this DPA apply.

Subject matter: provision of the Service as described in the Terms of Service.

Duration: for the duration of the Subscription, plus any required post-termination period under Section 9.

Nature and purpose: hosting, storing, transmitting, analyzing, indexing, and otherwise processing Customer Personal Data solely to provide and secure the Service per Customer's documented instructions.

Types of Personal Data: name, email, phone, role, organization, IP address, usage logs, message content, attachments, and any other data Customer chooses to submit.

Categories of Data Subjects: Customer's employees, contractors, customers, partners, leads, and any other individuals about whom Customer or its Users submit Personal Data to the Service.

Zenith Intelligence Technologies will: (a) Process Personal Data only on Customer's documented instructions, including the Terms of Service, this DPA, and any other written instructions Customer provides; (b) ensure that persons authorized to Process Personal Data are bound by appropriate confidentiality obligations; (c) implement and maintain the technical and organizational security measures described in Annex II; (d) assist Customer, taking into account the nature of processing, in responding to Data Subject requests and in complying with Customer's obligations under Data Protection Laws; (e) notify Customer without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data Breach affecting Customer Personal Data; and (f) make available to Customer all information necessary to demonstrate compliance with this DPA.

Zenith Intelligence Technologies will notify Customer immediately if it considers that an instruction infringes Data Protection Laws.

Customer authorizes Zenith Intelligence Technologies to engage Sub-processors in connection with the Service. A current list of Sub-processors, their roles, and locations is maintained at https://zisquare.app/legal/dpa#subprocessors and updated when Sub-processors are added or removed.

Zenith Intelligence Technologies will impose data-protection obligations on each Sub-processor that are equivalent to those set out in this DPA and will remain liable to Customer for the performance of each Sub-processor's obligations.

Zenith Intelligence Technologies will notify Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days in advance. Customer may object on reasonable data-protection grounds within fifteen (15) days of notice; the parties will work in good faith to resolve the objection. If no resolution can be found, Customer may terminate the affected portion of the Service.

Where Personal Data originating in the EEA, the United Kingdom, or Switzerland is transferred to a country that has not received an adequacy decision, the parties incorporate by reference: (a) for transfers from the EEA, the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). Module Two (controller to processor); (b) for transfers from the UK, the UK International Data Transfer Addendum issued by the Information Commissioner under Section 119A of the Data Protection Act 2018; (c) for transfers from Switzerland, the SCCs as adapted by the Swiss Federal Data Protection and Information Commissioner.

Zenith Intelligence Technologies will conduct transfer impact assessments and apply supplementary measures (technical, contractual, and organizational) as required by Schrems II and applicable guidance.

Zenith Intelligence Technologies will implement and maintain the technical and organizational measures set out in Annex II below, designed to ensure a level of security appropriate to the risk, including encryption, access controls, network segmentation, vulnerability management, secure software development, and incident response.

Zenith Intelligence Technologies will, taking into account the nature of processing, provide Customer with self-service tools (export, delete, audit log search) sufficient for Customer to respond to Data Subject requests under Data Protection Laws.

If a Data Subject contacts Zenith Intelligence Technologies directly, Zenith Intelligence Technologies will, without responding to the request, forward it to Customer and assist as reasonably necessary.

In the event of a Personal Data Breach affecting Customer Personal Data, Zenith Intelligence Technologies will notify Customer without undue delay and in any event within seventy-two (72) hours of becoming aware. The notification will include, to the extent known, the nature of the breach, the categories and approximate numbers of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach.

On termination or expiration of the Subscription, Zenith Intelligence Technologies will, at Customer's choice and within thirty (30) days, return Customer Personal Data in a commonly used machine-readable format or delete all Customer Personal Data, unless retention is required by applicable law.

Backups containing Customer Personal Data will be deleted in the ordinary course within sixty (60) days following termination.

Zenith Intelligence Technologies will make available to Customer the information necessary to demonstrate compliance with this DPA. Customer may, no more than once per calendar year (or more frequently following a Personal Data Breach or at the reasonable request of a Supervisory Authority), conduct an audit on terms to be mutually agreed in writing, including reasonable scope limitations to protect Zenith Intelligence Technologies's confidentiality obligations to other customers.

Zenith Intelligence Technologies may satisfy this obligation by providing an up-to-date third-party audit report (for example, SOC 2 Type II or ISO 27001) where one is available.

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

In the event of any conflict between this DPA and the Terms of Service, this DPA prevails with respect to the processing of Personal Data. In the event of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

Categories of Data Subjects: as set out in Section 2.

Categories of Personal Data: as set out in Section 2.

Special categories of Personal Data: only if Customer chooses to submit them; Zenith Intelligence Technologies does not require special-category data to provide the Service.

Frequency of transfer: continuous, throughout the Subscription.

Purposes: as set out in Section 2.

Period for which Personal Data will be retained: as set out in Section 6 of the Privacy Policy and Section 9 of this DPA.

Encryption. Personal Data in transit is protected by TLS 1.3. Personal Data at rest is protected by AES-256-GCM on ingestion and Kyber post-quantum encryption at rest, applied to designated sensitive fields.

Access control. Role-based access control with five built-in roles (owner, admin, manager, user, viewer) and per-permission scoping; time-based one-time-password (TOTP) multi-factor authentication available for all users; per-tenant Postgres database isolation available on request for Enterprise customers. WebAuthn passkeys and SAML/OIDC SSO are roadmap items not yet shipped.

Network and infrastructure. Hosting in hardened data centers with physical access controls; segmented networks; web application firewall; rate limiting; intrusion detection.

Software development. Source code reviewed before merge; dependency vulnerability scanning; automated test suites; immutable deployment pipeline; production-secret rotation.

Logging and monitoring. Centralized logging with retention; immutable audit log of administrative actions; alerting on anomalous activity.

Personnel. Background checks where permitted by law; mandatory security training; access reviews; documented joiner/mover/leaver process.

Incident response. Documented incident response plan; on-call rotation; tabletop exercises; breach-notification workflow integrated with this DPA.

Business continuity. Daily encrypted backups with off-site replication; tested restore procedures; documented disaster-recovery plan.

Hosting and infrastructure: Zenith Intelligence Technologies-owned infrastructure operated by Zenith Intelligence Technologies Inc. in EU (Germany) data centers. Enterprise customers may request alternative regions where supported.

Content delivery and TLS termination: Cloudflare, Inc. (https://www.cloudflare.com). Region: global edge. Used as a reverse proxy in front of the Service for TLS termination, DDoS protection, and CDN caching. Cloudflare's role and safeguards are described in its publicly available DPA.

Transactional email delivery: Resend, Inc. (https://resend.com). Region: United States. Used to send authentication emails, invoice notifications, and other transactional messages on behalf of the Service.

Payment processing: Stripe, Inc. (https://stripe.com). Region: United States. Used to process subscription and one-off payments. We do not store full card numbers; Stripe holds payment-method data.

Error monitoring and logging: Functional Software, Inc. d/b/a Sentry (https://sentry.io). Region: United States. Used to capture server-side exceptions and front-end errors for debugging; configured to scrub Personal Data from event payloads.

Optional integrations triggered by Customer (Google Workspace, Microsoft 365, Zoom, IMAP servers, SMS gateways, etc.) are not Sub-processors under this DPA; they are independent processors engaged by Customer directly through the Service's connection flows.

DPA-related notices and requests should be sent to [email protected].

Zenith Intelligence Technologies Inc., State of Maryland, United States of America.