Legal
Data Processing Addendum
Because Zentum’s Enterprise Agreement already incorporates this Enterprise Data Processing Addendum (“DPA”), you do not need to sign a separate copy. This DPA contains legal terms that apply to personal information that may be contained in Customer Content.
Posted Date: 8th October 2026
Effective Date: 9th October 2026
This Enterprise Contract Data Processing Addendum (“DPA”) forms part of the Enterprise Contract (the “Contract”) entered into between Zentum Services Ltd. (“Zentum”) and Customer (“you”) that incorporates this DPA by reference. This DPA governs the processing of Personal Information by Zentum in providing the Service (as defined in the Agreement). This DPA does not apply to Personal Information once transferred from the Service to a Third-Party Service (as defined in the Agreement), as your agreement with that Third-Party Service will instead govern.
1. Definitions
1.1. “Applicable Data Protection Law” means applicable law governing the use of, access to, deletion of, or processing of Personal Information under this DPA, including, but not limited to, UK GDPR, together with any national or subordinate legislation and regulations implementing, in each case as amended, repealed, consolidated, or replaced from time to time.
1.2. “commercial purpose”, “controller”, “processor”, “data subject”, “processing” (and “process”), “service provider”, and “supervisory authority” each have the meaning given to them in Applicable Data Protection Law, as appropriate.
1.3. “Europe” means the European Union, the European Economic Area and/or their member states, Switzerland, and the United Kingdom.
1.4. “European Data” means Personal Information that is subject to the protection of European Data Protection Laws.
1.5. “European Data Protection Laws” mean (a) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Information and on the free movement of such data (General Data Protection Regulation) (“GDPR”); (b) in respect of the United Kingdom, the Data Protection Act 2018 and the EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK GDPR”); and (c) the Swiss Federal Data Protection Act and its implementing regulations (“Swiss FADP”); in each case as may be amended, superseded or replaced from time to time.
1.6. “Personal Information” means (a) personal data or personal information (as defined under the Applicable Data Protection Law) that is subject to the Applicable Data Protection Law and (b) that is contained within Customer Content, for which you authorise Zentum to collect and process on your behalf in connection with Zentum’s provision of the Service under the Agreement.
1.7. “Security Incident” means a breach of security of the Service or Zentum’s systems used to process Personal Information that Zentum has reasonably determined to have occurred, leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Information processed by Zentum. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Personal Information, including unsuccessful login attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
1.8. “Sensitive Information” means any Personal Information (a) revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; (b) that is genetic data, biometric data processed for the purposes of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation; (c) relating to criminal convictions and offences; and (d) any other form of Personal Information that is afforded enhanced protection under the Applicable Data Protection Law.
1.9. “Subprocessor List” means Zentum’s Subprocessors as identified on https://www.zentum.co.uk/legal/subprocessors.
2. Processing Details
2.1. Subject-Matter and Nature of Processing. The subject matter of processing of Personal Information by Zentum is the provision of the administrative or cloud-based Services to you that involves processing of Personal Information. Personal Information will be subject to those processing activities that Zentum needs to perform in order to provide the Service pursuant to the Agreement.
2.2. Duration of the Processing. Personal Information will be processed for the duration of the Agreement, subject to Section 12 of this DPA.
2.3. Purpose of the Processing. Personal Information will be processed by Zentum for purposes of providing the Service set out in the Agreement.
2.4. Types of Personal Information. As set out in Schedule 1.
2.5. Categories of Data Subjects. As set out in Schedule 1.
3. Processing Requirements
3.1. Zentum will process Personal Information in its capacity as processor (a) for the purpose of providing and supporting the Service in accordance with the Agreement, this DPA, and any other documented lawful instructions from you (whether in written or electronic form); and (b) as otherwise required by applicable law. Zentum will at all times comply with the Applicable Data Protection Law in processing Personal Information under the Agreement.
3.2. Notwithstanding anything to the contrary in the Agreement, consistent with Applicable Data Protection Law, Zentum shall not: (a) retain, use, or disclose Personal Information other than as provided for in the Agreement or as needed to perform the Service; (b) “sell” (as such term is defined by ICO) or “share,” (as such term is defined by ICO); or (c) process Personal Information except as necessary for the business purposes specified in the Agreement or this DPA; or (d) retain, use, disclose, or otherwise process Personal Information outside of the direct business relationship with Customer and not combine Personal Information with personal information that it receives from other sources, except as permitted under the ICO. Further, Zentum shall notify Customer if it makes a determination that it can no longer meet its obligations under ICO.
3.3. In case Zentum cannot process Personal Information in accordance with your instructions due to a legal requirement under any applicable law to which Zentum is subject, Zentum shall (a) promptly notify you in writing (including by e-mail) of such legal requirement before carrying out the relevant processing, to the extent permitted by the applicable law, and (b) cease all processing (other than merely storing and maintaining the security of the affected Personal Information) until you provide Zentum with new instructions.
3.4. You are solely responsible for (a) the accuracy, quality, and legality of Personal Information and the means by which you acquired Personal Information; (b) complying with all necessary transparency and lawfulness requirements under Applicable Data Protection Law for the collection and use of Personal Information, including obtaining any necessary consents and authorisations; (c) ensuring you have the right to transfer, or provide access to, Personal Information to Zentum for processing in accordance with the terms of the Agreement (including this DPA); and (d) ensuring that your instructions to Zentum regarding the processing of Personal Information comply with applicable laws, including Applicable Data Protection Law.
3.5. You are responsible for independently determining whether the data security provided for in the Service adequately meets your obligations under Applicable Data Protection Law. Without limiting the foregoing, you represent, warrant, and covenant that you shall only transfer Personal Information to Zentum using secure, reasonable, and appropriate mechanisms.
3.6. You acknowledge that the Service is not intended or designed for the processing of Sensitive Information, and you agree not to provide any Sensitive Information through the Service, unless otherwise provided in the Agreement. The parties agree that you provide Personal Information to Zentum as a condition precedent to Zentum’s performance of the Service and that Personal Information is not exchanged for monetary or other valuable consideration.
4. Security
Zentum shall implement and maintain throughout the term of the Agreement reasonable and appropriate technical and organisational measures designed to protect Personal Information against unauthorised or accidental access, loss, alteration, disclosure, or destruction, as further described in Schedule 2 of this DPA (Technical and Organisational Measures). Zentum will also provide reasonable assistance to you with conducting any legally required data protection impact assessments with respect to the processing of Personal Information by Zentum (including, where necessary, subsequent consultation with a supervisory authority with jurisdiction over such processing), if so required by the Applicable Data Protection Law, taking into account the nature of processing and the information available to Zentum.
5. Security Incident
If Zentum becomes aware of a Security Incident, Zentum will (a) notify you without undue delay, and not later than 48 hours after Zentum discovers the Security Incident, and (b) make reasonable efforts to identify the cause of the Security Incident, mitigate the effects, and remediate the cause to the extent within Zentum’s reasonable control. Upon your request and taking into account the nature of the applicable processing, Zentum will assist by providing, when available, information reasonably necessary for you to meet your Security Incident notification obligations under the Applicable Data Protection Laws. You acknowledge that Zentum providing notification of a Security Incident is not an acknowledgment of fault or liability.
6. Confidentiality
Zentum will ensure that its personnel authorised to process Personal Information are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
7. Data Subject Requests
You are responsible for handling any requests or complaints from data subjects with respect to their Personal Information processed by Zentum under this DPA. If Zentum receives a request from your data subject in relation to the data subject’s Personal Information processed under your Service account, Zentum will notify you promptly, and advise the data subject to submit the request to you, and you will be responsible for responding to any such request. You may access, delete, and export Personal Information upon written request to Zentum.
8. Audits
8.1. To the extent necessary and required by Applicable Data Protection Law, you may, at your sole expense, conduct a reasonable audit pursuant to a mutually agreed-upon audit plan with Zentum that is consistent with the requirements of this Section 8.
8.2. Each such audit must: (a) be conducted by you or through a third-party auditor on your behalf that will enter into a confidentiality agreement with Zentum; (b) be limited in scope to matters reasonably required to assess Zentum’s compliance with this DPA and Applicable Data Protection Law; (c) occur no more than once annually (unless required under Applicable Data Protection Law); (d) cover only processing facilities directly controlled by Zentum; (e) restrict findings to your Personal Information only; and (f) treat any results as confidential information to the fullest extent permitted by Applicable Data Protection Law.
9. Subprocessors
In providing the Service, you agree that:
9.1. Zentum engages the organisations listed on the Subprocessor List (each a “Subprocessor”) to help process Personal Information on the Service.
9.2. Zentum will enter into an agreement with each Subprocessor imposing data processing and protection obligations substantially the same as those set out in this DPA.
9.3. Zentum will maintain a current list of its Subprocessors, including their functions and locations, as specified in the Subprocessor List.
9.4. Zentum may update the Subprocessor List from time to time. In the event that Zentum updates the Subprocessor List, Zentum will provide fourteen (14) days’ advance written notice (which may be via email, a posting, notification on an online portal for our services, or other reasonable means).
9.5. In the event that you do not wish to consent to the use of such additional Subprocessor, you may notify Zentum that you do not consent within fourteen (14) days of Zentum’s advance written notice based on reasonable data protection concerns. In such case, the parties will discuss such concerns in good faith.
9.6. If the parties are unable to reach a mutually agreeable resolution to your objection to a new Subprocessor, you, as your sole and exclusive remedy, may terminate the order for the affected Service for convenience, and Zentum will refund any prepaid, unused fees for the terminated portion of the applicable subscription term for the affected Service.
10. Data Transfers
10.1. In connection with the performance of the Agreement, you authorise Zentum to transfer Personal Information internationally, and in particular, that Personal Information may be transferred to and processed by Zentum in the United Kingdom of Great Britain and Northern Ireland and other jurisdictions where Zentum and its Subprocessors have operations. Whenever Personal Information is transferred outside its country of origin, each party will ensure such transfers are made in compliance with the requirements of Applicable Data Protection Laws.
10.2. To the extent applicable to you, you acknowledge that in connection with the performance of the Service, Zentum is a recipient of European Data in the UK. To the extent that Zentum receives European Data in the UK, Zentum will comply with the following:
10.2.1. Standard Contractual Clauses. If the Data Privacy Framework is invalidated and/or does not cover the transfer of European Data to Zentum, the applicable standard contractual clauses will be incorporated by reference and form a part of this DPA as follows:
10.2.1.1. the Controller to Processor SCCs if the restricted transfer is subject to the GDPR and Zentum is acting as your processor;
10.2.1.2. the Processor to Processor SCCs if the restricted transfer is subject to the GDPR and Zentum is acting as your subprocessor;
10.2.1.3. the Swiss Amendments if the restricted transfer consists of Personal Information originating from Switzerland; and
10.2.1.4. the UK Addendum if the restricted transfer is subject to the UK GDPR.
10.2.1.5. the Standard Contractual Clauses set forth in Resolution CD/ANPD No. 19/2024 if the restricted transfer is subject to the LGPD.
11. Information
11.1. Zentum shall make available its privacy and security policies and other such information necessary to demonstrate compliance with the obligations set forth in this DPA.
11.2. Upon reasonable notice and appropriate confidentiality agreements, and taking into account the nature of the applicable processing, Zentum will assist you in fulfilling your obligations under Applicable Data Protection Laws to carry out a data protection impact or similar risk assessment related to your use of the Service, including, if required by Applicable Data Protection Laws, by assisting you in consultations with relevant government authorities.
11.3. If a law enforcement agency sends Zentum a demand for Personal Information (e.g., a subpoena or court order), Zentum will attempt to redirect the law enforcement agency to request that data directly from you. As part of this effort, Zentum may provide your contact information to the law enforcement agency. If compelled to disclose Personal Information to a law enforcement agency, then Zentum will give you reasonable notice of the demand to allow you to seek a protective order or other appropriate remedy, to the extent Zentum is legally permitted to do so.
12. Disposal
Promptly following termination of the Agreement and this DPA for any reason, Zentum will destroy the Personal Information it was processing on your behalf pursuant to Zentum’s provision of the Service unless Applicable Data Protection Law prevents Zentum from destroying all or part of the Personal Information.
13. Modification
Zentum may modify this DPA as reasonably necessary to comply with Applicable Data Protection Law. Zentum will provide Customer with at least thirty (30) days’ advance written notice of any modification that materially decreases the data protection obligations set forth herein, including a summary of the change and its effective date.
14. No AI Training by Default
Zentum does not use customer content to train generalised AI models, build cross-customer datasets, or create benchmarks from customer data. Zentum uses paid API, enterprise, or processing terms intended to prevent AI model providers from training on customer content.
Contact
Data protection questions can be sent to hello@zentum.co.uk.
Schedule 1
LIST OF PARTIES
Data exporter(s):
| Name | You |
|---|---|
| Address | As provided in the “Notices” section of the Contract. |
| Contact person’s name, position, and contact details | As provided in the “Notices” section of the Contract. |
| Activities relevant to the data transferred under these Clauses | Receipt of the Service |
| Role (controller/processor) | Controller |
Data importer(s):
| Name | Zentum |
|---|---|
| Address | Fourth Floor Elsley Court 20-22 Great Titchfield Street, London United Kingdom W1W 8BE |
| Contact person’s name, position, and contact details | hello@zentum.co.uk |
| Activities relevant to the data transferred under these Clauses | Provision of the Service |
| Role (controller/processor) | Processor |
DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
Data exporter may submit Personal Information to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Personal Information relating to the following categories of data subjects:
Data exporter’s employees, contractors, representatives, agents, and other individuals whom data exporter permits to use the Service, as well as Personal Information relating to the data exporter’s customers, partners, users, and vendors.
Categories of personal data transferred
Data exporter may submit Personal Information to the Service, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following Personal Information:
First and last name, contact information such as address and email address, IP address, date of birth, user identifier.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
None, and the data exporter is prohibited from using the Service to process any such data under the terms of the Agreement.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
Continuous basis
Nature of the processing
The performance of the Service pursuant to the Agreement.
Purpose(s) of the data transfer and further processing
The performance of the Service pursuant to the Agreement.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
For the duration of the Agreement
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Located on Zentum’s Subprocessor webpage at https://www.zentum.co.uk/legal/subprocessors.
Schedule 2
TECHNICAL AND ORGANISATIONAL MEASURES
For the generally released Service that is not a Beta Release, Zentum will maintain administrative, physical, and technical safeguards designed to protect Customer Content, including Personal Information, as described in Sections 1 to 6 below. All capitalised terms not otherwise defined herein shall have the meanings as set forth in the DPA.
1. Access Control
1.1. Preventing Unauthorised Product Access
a. Third-party data hosting and processing: We host our Service with third-party cloud infrastructure providers. Additionally, we maintain contractual relationships with vendors in order to provide the Service in accordance with the DPA. We rely on contractual and data protection agreements, and vendor compliance programs in order to protect data processed or stored by these vendors.
b. Physical and environmental security: We host our product infrastructure with multi-tenant, outsourced infrastructure providers.
c. Authentication: Customers who interact with the products via the user interface are required to authenticate before they are able to access their non-public data. We support two-factor authentication and highly recommend that each customer enable two-factor authentication on their Zentum account. Zentum also supports Single-Sign-On.
d. Authorisation: Customer Content (data originated by customers that a customer transmits through Zentum online service) is stored in multi-tenant storage systems which are only accessible to Customers via application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorisation model in each of our products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customisation options. Authorisation to data sets is performed by validating the user's permissions against the attributes associated with each data set.
e. Application Programming Interface (API) access: Public product APIs may be accessed using an API key or through OAuth authorisation. Authorisation credentials are stored encrypted.
1.2. Preventing Unauthorised Product Use. We implement industry-standard access controls and detection capabilities for the internal networks that support our products.
a. Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorised protocols from reaching product infrastructure. The technical measures implemented differ between infrastructure providers and may include Virtual Private Cloud (VPC) implementations, security group assignment, and traditional firewall rules.
b. Static code analysis: Automated security reviews of code stored in our source code repositories, performed through static code analysis, checking for coding best practices and identifiable software vulnerabilities.
1.3. Limitations of Privilege & Authorisation Requirements
a. Product access: A subset of our personnel have access to the products and to customer data via controlled interfaces. The intent of providing access to a subset of personnel is to provide effective customer support, troubleshoot potential problems, detect, and respond to security incidents, and implement data security.
b. Personnel Security: Zentum personnel are required to conduct themselves in a manner consistent with the company's guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards. Zentum conducts reasonably appropriate background checks to the extent legally permissible and in accordance with applicable local law and regulations.
2. Encryption Technologies
2.1. In-transit: We make HTTPS encryption (also referred to as SSL or TLS) available on all our login interfaces and on every customer site hosted on Zentum products. Our HTTPS implementation uses industry-standard algorithms and certificates.
2.2. At-rest: We store user passwords following policies that follow industry standard practices for security. We have implemented technologies to ensure that stored data is encrypted at rest.
3. Input Controls
3.1. Detection: We designed our infrastructure to log extensive information about the system behaviour, traffic received, system authentication, and other application requests. Internal systems aggregate log data and alert appropriate personnel of potentially malicious, unintended, or anomalous activities. Our personnel are responsive to known incidents.
3.2. Response and tracking: We maintain a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, and/or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, we will take appropriate steps to minimise product and customer damage or unauthorised disclosure. Notifications will be in accordance with the terms of the Agreement.
4. Data Deletion and Portability. Zentum enables customers to delete their accounts and delete or export their account data in a manner consistent with the functionality of Zentum products.
5. Availability Controls. Our products are designed to ensure redundancy and seamless failover. The server instances that support the products are also architected with a goal of preventing single points of failure. This design assists our operations in maintaining and updating product applications and backend while limiting downtime.
5.1. Redundancy: The infrastructure providers use designs to eliminate single points of failure and minimise the impact of anticipated environmental risks. Zentum’s products are designed to allow the company to perform certain types of preventative and corrective maintenance without interruption.
6. Beta Releases. For Beta Releases (as defined in the Agreement), only this Section 6 shall apply. For Beta Releases, Zentum will maintain reasonable and appropriate technical and organisational measures designed to protect Personal Information against unauthorised or accidental access, loss, alteration, disclosure, or destruction, including with respect to personnel, facilities, hardware and software, storage, and networks.