Data Processing Agreement

Customer Personal Data means personal data processed by Zof on behalf of Customer in providing the Services under the parties’ agreement. Data Protection Law means privacy and data protection law applicable to that processing. Controller, processor, data subject, personal data, processing, and personal data breach have the meanings given by applicable Data Protection Law. A Subprocessor is another processor engaged by Zof to process Customer Personal Data.

This DPA forms part of the applicable services agreement and governs Customer Personal Data rather than data for which Zof independently determines the purposes and means of processing. It controls over conflicting general service terms on that subject. Required Standard Contractual Clauses or other mandatory transfer terms control to the extent of a conflict. Commercial liability terms remain as agreed except where mandatory law or transfer terms require otherwise.

Zof processes Customer Personal Data to provide the ordered testing, analysis, system mapping, reporting, support, and related services. The subject matter, nature, purpose, duration, categories of individuals, and data types must be documented in the order, processing schedule, and Customer’s lawful configuration and instructions. The following describes the possible scope; it is not permission to submit every category.

Processing continues for the services term and any agreed return or deletion period. Customer must limit data to what is necessary and ensure that connected systems, attachments, logs, and test artifacts do not inadvertently expand the approved scope. Special-category data, protected health information, payment authentication data, or similarly regulated material require explicit agreement and appropriate safeguards before submission.

Customer is the controller, or a processor acting on a controller’s behalf, and Zof is Customer’s processor or subprocessor for Customer Personal Data. Customer is responsible for lawful collection and disclosure, required notices, a valid basis for processing, accuracy, data minimization, and the authority to issue instructions. Where Customer acts for another controller, it must have authorization to engage Zof.

Customer’s documented instructions include the applicable agreement, this DPA, orders, and use of supported controls within the agreed scope. Additional instructions must be lawful and consistent with the agreed service; the parties will address any required change in scope or cost. Zof will inform Customer if, in its opinion, an instruction infringes applicable Data Protection Law, and the parties will resolve it before the affected processing continues.

Zof will process Customer Personal Data only on Customer’s documented instructions, including with respect to transfers, unless processing is required by applicable law. In that case Zof will inform Customer of the requirement before processing unless the law prohibits that notice on important grounds of public interest.

Zof will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty, and that access is limited to what is needed for the authorized processing. Zof will not use Customer Personal Data for unrelated purposes or treat this DPA as permission for independent advertising, resale, or unrestricted model training.

Where Zof acts as a service provider or contractor under applicable US state privacy law, it will not sell or share Customer Personal Data, retain or use it outside the specified business purposes and direct business relationship except as permitted by law, or combine it with other personal information except where legally permitted. Zof will provide the legally required level of protection, notify Customer if it can no longer meet applicable obligations, and support reasonable steps to stop and remediate unauthorized use.

Taking account of the state of the art, implementation costs, processing context, and risks to individuals, Zof will implement appropriate technical and organizational measures for Customer Personal Data as required by applicable law, including Article 32 GDPR where applicable. Measures are to be documented for the actual service and deployment; a list of marketing badges is not a security schedule.

The agreed schedule should address confidentiality, integrity, availability and resilience; encryption and key management where appropriate; identity and access management; segregation and execution boundaries; logging and vulnerability management; backup and restoration; incident handling; personnel controls; and regular assessment of effectiveness. Detailed evidence may be subject to confidentiality and restrictions necessary to protect other customers.

Customer remains responsible for its data classification, permissions, endpoints, integration credentials, test scope, local infrastructure, and changes it approves. For private or customer-operated deployments, the schedule must allocate responsibilities for patching, monitoring, recovery, and access. Zof will not materially reduce the agreed overall level of protection during the services term.

• Trust center
• Deployment options

Customer authorizes the Subprocessors identified in the agreed processing schedule or authorized register. Zof will impose written data protection obligations on Subprocessors that provide the protections required for the relevant processing, and remains responsible for their performance of those obligations as required by Data Protection Law.

For general authorization under this DPA, Zof will provide at least 30 days’ advance notice of intended additions or replacements and an opportunity for Customer to raise a reasonable objection based on data protection grounds, unless an executed DPA specifies a different lawful process. The parties must record the notice recipients and method, rather than relying on an unmonitored web page.

If Customer objects, the parties will work in good faith to resolve the concern, including considering a practicable alternative. Any right to suspend the affected processing or terminate the affected service, and related fees or refunds, follows the applicable agreement and mandatory law. The public provider overview distinguishes website services from deployment-specific platform subprocessors.

• Subprocessor information

Zof and Customer must ensure that any restricted transfer has a lawful mechanism before it takes place. Depending on the data origin and parties’ roles, this may require the European Commission’s 2021 Standard Contractual Clauses, the UK Addendum or another lawful UK mechanism, and applicable Swiss adaptations. The parties must complete the correct modules, party details, supervisory authority, processing description, security annex, and Subprocessor information.

Where applicable, the parties will cooperate on transfer assessments and supplementary measures. A hosting region alone does not establish that no international transfer occurs: remote administration, support, model inference, backups, and telemetry must also be considered. Zof will provide information reasonably needed to assess the relevant transfer, subject to confidentiality and lawful restrictions.

This public DPA does not itself supply a completed transfer annex or assert Zof’s participation in the Data Privacy Framework or approval of Binding Corporate Rules. Contact legal@zof.ai to arrange any required transfer documentation for the deployment in scope before the restricted transfer begins.

Taking account of the nature of processing, Zof will assist Customer through appropriate technical and organizational measures, insofar as possible, in responding to individuals exercising their rights. If Zof receives a request concerning Customer Personal Data, it will direct the requester to Customer or notify Customer and will not independently answer on Customer’s behalf unless instructed or legally required.

Taking account of the nature of processing and information available to Zof, Zof will assist Customer with security obligations, data protection impact assessments, and prior consultation with supervisory authorities where required by applicable law. Customer retains responsibility for its decisions, regulatory submissions, and response to the individual. Any agreed fee arrangements for extraordinary assistance do not excuse mandatory assistance.

• Contact privacy@zof.ai

Zof will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notification will describe, to the extent then known, the nature of the breach; categories and approximate numbers of affected individuals and records; a contact for more information; likely consequences; and measures taken or proposed to address and mitigate it. Information may be provided in phases as it becomes available.

Zof will take reasonable steps to contain and investigate the breach and cooperate with Customer’s lawful response. Notice does not by itself constitute an admission of liability. Customer must maintain current incident contacts and is responsible for determining its notification duties to individuals and regulators, unless applicable law requires Zof to act directly. The controller’s GDPR notification deadline is not a substitute for the processor’s duty to notify without undue delay.

Zof will make available information necessary to demonstrate compliance with its processing obligations and allow for and contribute to audits, including inspections, by Customer or its mandated auditor as required by applicable law. Available independent reports, relevant certifications, questionnaires, and control documentation may be used to address a request where they adequately establish compliance.

Ordinary audits are coordinated on reasonable notice, during appropriate hours, and subject to confidentiality, auditor independence, security restrictions, and measures protecting other customers. Routine audits are ordinarily limited to once per year, but that limit does not prevent an audit required by law or a supervisory authority, or reasonably necessary after a relevant breach or evidence of noncompliance. Contractual scheduling and reasonable cost arrangements may not make statutory audit rights ineffective.

At Customer’s choice, Zof will return or delete Customer Personal Data after the end of the relevant processing services and delete existing copies, unless applicable law requires retention. The parties must arrange the export format, recipient, access period, and deletion instructions. Unless a different lawful schedule is agreed, Zof will complete return or deletion of active service data within 90 days after the relevant processing services end. Customer may request an earlier deletion timeline; Zof will follow the applicable lawful instructions and confirm the corresponding schedule.

Backup expiration must follow the documented schedule applicable to the deployment. Data retained because of legal requirements or in backups awaiting expiration remains protected under this DPA, is restricted from ordinary use, and is deleted when the applicable retention ground ends. If a backup is restored, relevant deletion instructions must be reapplied. Zof will provide confirmation of completion on reasonable request.

Customer should request export before service access ends and revoke customer-managed integrations and credentials when appropriate. The obligations in this DPA continue for as long as Zof retains Customer Personal Data.

To complete the processing schedule and arrange any required DPA execution, contact legal@zof.ai with the contracting entity, service scope, deployment model, data categories, relevant jurisdictions, required regions, and privacy and security contacts. Identify whether Customer acts as a controller or processor and whether special contractual or regulatory requirements apply.

Before enabling processing, confirm that the parties have recorded the authorized providers and model services, security responsibilities, retention and backup periods, incident contacts, and any completed transfer clauses. A website summary or unanswered questionnaire does not supply missing processing particulars or required transfer documentation.

• Contact legal@zof.ai