Data Processing Agreement

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, such as collection, storage, use, disclosure, or deletion.
• "Data Subject" means the individual to whom Personal Data relates.
• "Sub-processor" means any third party engaged by Processor to process Personal Data on behalf of Controller.
• "Services" means the Zof AI platform, APIs, integrations, and professional services provided under your agreement with us.

2. Scope and purpose

This Data Processing Agreement applies to all personal data processed by Zof AI on behalf of the customer.

• Providing automated testing, validation, and reliability services
• Analyzing software systems and workflows for quality assurance
• Generating reports, dashboards, and operational insights
• Delivering technical support, onboarding, and service improvements

Processor will process Personal Data only on documented instructions from Controller, including as set forth in the Services agreement, this DPA, and applicable order forms, unless required by law.

3. Roles and responsibilities

For Personal Data processed under this DPA:

4. Processor obligations

Zof AI undertakes the following obligations as a data processor.

• Process Personal Data only on documented instructions from Controller, unless required by law (in which case we will inform Controller unless prohibited)
• Ensure personnel authorized to process Personal Data are bound by confidentiality obligations
• Implement and maintain appropriate technical and organizational security measures
• Assist Controller in responding to Data Subject requests, DPIAs, and prior consultations where applicable
• Notify Controller without undue delay after becoming aware of a Personal Data breach
• Delete or return Personal Data upon termination of Services, subject to Section 11
• Make available information reasonably necessary to demonstrate compliance with this DPA

5. Security measures

Zof AI implements comprehensive technical and organizational security measures to protect personal data.

Additional detail is available in our Security documentation and, upon request, SOC 2 Type II reports. Security.

6. Sub-processors

Zof AI may engage sub-processors to assist in providing services, subject to the requirements outlined in this agreement.

• Maintain an up-to-date list of Sub-processors used to deliver the Services
• Provide at least 30 days' notice before adding or replacing a Sub-processor, where required by law or contract
• Impose data protection obligations on Sub-processors that are substantially similar to this DPA
• Remain responsible for Sub-processor performance of Processing obligations

See our Subprocessors list.

7. International transfers

When personal data is transferred outside the EEA, Zof AI ensures appropriate safeguards are in place.

• EU-U.S. Data Privacy Framework certification, where applicable
• Standard Contractual Clauses approved by the European Commission (Module 2 or Module 3, as applicable)
• Supplementary technical and organizational measures where required by regulators or transfer impact assessments

Controller may request copies of applicable transfer mechanisms upon reasonable notice.

8. Data subject rights

Processor will assist Controller in fulfilling Data Subject rights under applicable law, including access, rectification, erasure, restriction, portability, and objection. Data Subjects should submit requests to Controller. Controller may forward requests to Processor at dpo@zof.ai, and Processor will respond within a reasonable timeframe and in accordance with Controller instructions.

9. Data breach notification

Processor will notify Controller without undue delay after confirming a Personal Data breach affecting Controller Personal Data. Notification will include, to the extent known: nature of the breach, categories and approximate number of Data Subjects and records concerned, likely consequences, and measures taken or proposed. Processor will cooperate with Controller's investigation and remediation efforts.

10. Audit rights

Upon reasonable written notice and subject to confidentiality obligations, Controller may audit Processor's compliance with this DPA no more than once per year (unless required by a supervisory authority or following a confirmed breach). Processor may satisfy audit requests through SOC 2 Type II reports, security questionnaires, and documented evidence of controls. On-site audits require mutual scheduling and may be subject to reasonable fees for extensive requests.

11. Term and termination

This DPA remains in effect for the duration of the Services agreement. Upon termination or expiry, Processor will delete or return all Personal Data within 90 days, unless retention is required by law or Controller requests an earlier deletion timeline. Processor may retain copies in encrypted backups until rotation, provided such copies remain subject to this DPA.