Plan for GDPR responsibilities.

The EU General Data Protection Regulation applies according to the parties, people, and processing involved. Zof’s privacy notice describes processing for website and business-contact purposes. Where Zof processes customer personal data to provide the service, the applicable agreement and DPA describe the instructions and responsibilities.

A customer may act as a controller or as a processor for another organization. Determine those roles before deployment and obtain the notices, permissions, and contractual authorizations your use requires. GDPR compliance is an ongoing legal and operational responsibility, not a product certification.

• Privacy notice
• Data processing addendum

Record the purpose, subject matter, duration, data categories, and categories of individuals in the processing description. Tests can process personal data in application responses, fixtures, logs, screenshots, source comments, and support records even if the original purpose is software verification.

Minimize these inputs and use synthetic data where practical. Restrict access to approved personnel and service identities. Set retention according to the business purpose, legal requirements, and contractual arrangements; distinguish active service data from exported copies and backup data.

Depending on the applicable law and circumstances, individuals may request access, correction, erasure, restriction, portability, or object to certain processing. Where processing relies on consent, they may withdraw it without affecting the lawfulness of earlier processing. They may also complain to the competent supervisory authority.

For personal data controlled by your employer or another Zof customer, direct the request to that organization so it can verify identity and determine the appropriate response. Zof’s assistance with customer-data requests is governed by the DPA. For data covered by Zof’s own privacy notice, use the contact method in that notice.

Rights are subject to applicable conditions and exceptions. Verification may be necessary, and legal retention duties may limit deletion. Do not submit identity documents, credentials, or another person’s data unless an appropriate verification method has been requested.

• Privacy requests and contact information

Confirm storage, remote-access, support, model-provider, and integration locations for your selected deployment. This page does not promise EU-only processing. Private infrastructure and regional storage do not by themselves prevent international access or onward transfers.

Where a restricted transfer occurs, the parties must identify a valid mechanism and applicable safeguards, such as an adequacy decision or executed standard contractual clauses. Review the actual DPA and transfer documentation for your arrangement. Do not assume that binding corporate rules, a certification framework, or another transfer mechanism applies without supporting documentation.

Review the subprocessors that will process your customer data, their purposes and locations, and the notice and objection procedures in your DPA. Customer-selected integrations may have separate privacy terms and responsibilities.

• Subprocessor information

Assess technical and organizational measures against the nature and risk of your processing. Confirm access controls, data-flow restrictions, encryption arrangements, retention, deletion, and evidence handling for the chosen service. Perform a data protection impact assessment where required and identify any assistance needed from Zof.

A processor’s notification to its controller and a controller’s notification to a supervisory authority are different obligations. The GDPR requires a processor to notify its controller without undue delay after becoming aware of a personal data breach. A controller assesses its own regulatory and individual notification obligations, including the applicable 72-hour requirement and exceptions. The DPA and applicable law govern the parties’ cooperation.

• Security measures
• Contact security@zof.ai

This page supports vendor evaluation and describes the topics to confirm for your use of Zof. The applicable Terms of Service and DPA, together with any executed agreement, order form, and service schedule, define the commitments for your organization according to their order of precedence. Public security descriptions do not amend those terms or extend a commitment to every deployment.

Security depends on the selected service, configuration, integrations, and customer environment. Confirm the controls and evidence for the actual scope you will purchase before transferring regulated information or enabling production access.