GDPR Compliance

When you visit our website or sign up for an Account, Zenith Intelligence Technologies Inc. is the data controller of the personal data we collect about you.

When you use the Service to process personal data about your own contacts, customers, or employees, you are the controller and we are your processor. The Data Processing Agreement (DPA) at https://zisquare.app/legal/dpa sets out our processor obligations in full.

We rely on the following GDPR Article 6 lawful bases: performance of a contract (to provide the Service), legal obligation (to comply with applicable laws), legitimate interests (to secure and improve the Service), and consent (where we ask for it, such as optional marketing). You may withdraw consent at any time without affecting prior processing.

Under the GDPR, you have the right to: access the personal data we hold about you (Article 15); correct inaccurate or incomplete data (Article 16); request deletion (Article 17, "right to be forgotten"); restrict processing (Article 18); object to processing based on legitimate interests (Article 21); data portability (Article 20); and, where processing is based on consent, withdraw that consent at any time (Article 7).

To exercise any of these rights, contact [email protected]. We will respond within one month, extendable to three months for complex requests.

You also have the right to lodge a complaint with your national Supervisory Authority. A list of EU/EEA Supervisory Authorities is maintained by the European Data Protection Board at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

Zenith Intelligence Technologies is headquartered in the United States. When we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Module Two for processor relationships), the UK International Data Transfer Addendum, or the equivalent Swiss mechanism.

We conduct transfer impact assessments and apply supplementary measures (technical, contractual, and organizational) consistent with the Schrems II ruling and subsequent EDPB guidance.

Customers requiring EU-resident hosting for their workspace can request it from [email protected].

Annex II of our DPA describes the technical and organizational security measures we apply, including TLS 1.3 in transit, AES-256-GCM and Kyber post-quantum encryption at rest, role-based access control, time-based one-time-password (TOTP) multi-factor authentication, an audit log of administrative actions, segmented networks, dependency scanning, and incident response. WebAuthn passkeys and SAML/OIDC SSO are roadmap items not yet shipped.

If a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, we will notify the competent Supervisory Authority within 72 hours and, where required, inform affected Data Subjects without undue delay, in accordance with GDPR Articles 33 and 34.

For processing carried out as a processor on behalf of a customer, we will notify the customer-controller within 72 hours of becoming aware so that the customer can fulfil its own notification obligations.

Account data is retained for the life of the Account. Content is retained while it remains in your workspace; after termination, it is available for export for 30 days and then deleted from active systems within 60 days. Usage logs are retained for 90 days. Customers can configure longer retention or shorter deletion for documents via the Document Vault module's retention policies.

A current list of Sub-processors, their roles, and locations is maintained in Annex III of the DPA at https://zisquare.app/legal/dpa. We notify customers at least 30 days in advance of any addition or replacement; customers may object on reasonable data-protection grounds.

Our designated point of contact for data-protection matters is reachable at [email protected].

The Service is not directed to children under 16. If we become aware that we have collected personal data from a child under 16 without the consent of a holder of parental responsibility, we will delete that data.

Zenith Intelligence Technologies maintains records of processing activities (Article 30) covering both our own processing as a controller and the categories of processing we carry out as a processor on behalf of customers. Records are made available to Supervisory Authorities on request.

For any GDPR-related question or request, contact [email protected] or [email protected].

Zenith Intelligence Technologies Inc., State of Maryland, United States of America.