Data Processing Addendum

This Data Processing Addendum ("DPA") describes how Zetra ("Processor") processes personal data on behalf of a customer workspace ("Controller") when the Controller uses Zetra to handle end users' personal data — for example, names, emails, or phone numbers collected through a lead-capture form or a conversation. It supplements our Terms of Service.

1. Subject matter and duration

Processing covers the personal data the Controller submits to the Service (directly, or via its own end users) for the duration the Controller maintains an active workspace, plus any period required for legitimate business or legal retention purposes.

2. Nature and purpose of processing

The Processor processes personal data to operate the Service as configured by the Controller: storing and retrieving uploaded content, generating AI responses grounded in that content, routing conversations to configured channels, and delivering notifications the Controller has set up (webhooks, Slack, email). The Processor does not use Controller data for its own independent purposes.

3. Subprocessors

The Controller authorizes the Processor to engage the subprocessors listed on our Subprocessors page to provide the Service. The Processor will update that page when subprocessors change and, for material changes, notify Controllers where required.

4. Security measures

The Processor implements the technical and organizational measures described on our Security & Trust page, including hashed credentials, signed sessions, tenant isolation enforced at the database query level, and HMAC-signed webhook delivery.

5. Assistance with data subject requests

The Processor will provide reasonable assistance to the Controller in responding to verified data subject requests (access, correction, deletion) relating to data processed through the Service, primarily through the account's existing self-service deletion tools and, for full-account deletion, a request to [email protected].

6. International transfers

Personal data may be processed outside the country or region where it was collected, including by the subprocessors listed on our Subprocessors page. Where data protection law requires a transfer safeguard, Zetra relies on appropriate mechanisms such as the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), or the safeguards required by Kenya's Data Protection Act, 2019, and requires its subprocessors to do the same.

7. Breach notification

Zetra will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting your data. The notice will describe, as far as is then known, the nature of the breach, the data and individuals affected, the likely consequences and the steps taken or proposed to address it, and will be updated as more information becomes available.

8. Audit rights

On written request, no more than once in any 12-month period (or after a personal data breach), Zetra will make available the information reasonably needed to show compliance with this DPA, such as completed security questionnaires, policies and any third-party audit reports. If that information is not enough to meet a requirement of applicable law, you may carry out an audit, at your own cost, with at least 30 days' notice, during business hours, subject to confidentiality and without access to other customers' data.

9. Contact

Questions about this DPA can be sent to [email protected].