This Data Processing Addendum ("Addendum") is entered into and is supplemental to, and made pursuant to, the ZanReal Labs Services Agreement, Enterprise Services Order Form and Enterprise Terms and Conditions or other agreement executed between ZanReal Labs and Customer for ZanReal Labs' provision of Services (the "Agreement") as of the effective date of such Agreement ("Effective Date") and is by and between ZANREAL Mateusz Janota, a Polish corporation ("ZanReal Labs"), and the Customer that executed the Agreement. This Addendum applies to ZanReal Labs' Processing of Personal Data under the Agreement across all Services including software development, marketing services, remote IT support, SEO optimization, and UI/UX design services.
Customer enters into this Addendum on behalf of itself and, to the extent required under applicable Data Protection Laws and Regulations, in the name and on behalf of its Affiliates to the extent such Affiliates are included and covered under the Agreement with ZanReal Labs. For the purposes of this Addendum only, and except where indicated otherwise, the term "Customer" shall include Customer and Affiliates.
This Addendum shall become legally binding upon Customer entering into the Agreement.
Any terms used in this Addendum and not defined will have the meanings given to them in the applicable Agreement.
Each party will comply with its obligations under Applicable Data Protection Laws with respect to its Processing of Customer Data.
The parties acknowledge that Customer must be able to assess ZanReal Labs' compliance with its obligations under Applicable Data Protection Laws and this Addendum, insofar as ZanReal Labs is acting as a processor on behalf of Customer.
ZanReal Labs will provide reasonable cooperation to Customer, to the extent Customer does not otherwise have access to the relevant information and such information is available to ZanReal Labs, in connection with any data protection impact assessment (at Customer's expense only if such reasonable cooperation will require ZanReal Labs to assign significant resources to that effort) or consultations with regulatory authorities as required by Applicable Data Protection Laws.
ZanReal Labs will upon Customer's request (and at Customer's expense) provide Customer with such assistance as it may reasonably require to comply with its obligations under Applicable Data Protection Laws to respond to requests from individuals to exercise their rights under Applicable Data Protection Laws (e.g., rights of data access, rectification, erasure, restriction, portability and objection) in cases where Customer cannot reasonably fulfill such requests independently by using the self-service functionality of the Services. If ZanReal Labs receives a request from a Data Subject in relation to the Processing of their Customer Data, ZanReal Labs will advise the Data Subject to submit their request to Customer, and Customer will be responsible for responding to any such request.
Subject Matter & Details of Processing
ZanReal Labs will process Personal Data as necessary to provide the Services under the Agreement. ZanReal Labs does not sell Customer Data (or end user information within such Customer Data) and does not share such end users' information with third parties for compensation or for those third parties' own business interests.
The period for which Personal Data will be retained and the criteria used to determine that period is as follows:
Technical & Organizational Security Measures
Where applicable, this Schedule 2 will serve as Annex II to the Standard Contractual Clauses. The following provides more information regarding ZanReal Labs' technical and organizational security measures set forth below.
ZanReal Labs maintains Customer Data in an encrypted format at rest using Advanced Encryption Standard (AES-256) and in transit (TLS 1.2 or higher).
ZanReal Labs' Customer agreements contain strict confidentiality obligations. Additionally, ZanReal Labs requires Subprocessors to sign confidentiality provisions that are substantially similar to those contained in ZanReal Labs' Customer agreements. All employees (and contractors) are bound by ZanReal Labs' internal policies regarding maintaining the confidentiality of Customer Data and are contractually obligated to comply with these obligations.
The Services operate on Amazon Web Services ("AWS"), Microsoft Azure ("Azure"), and Google Cloud Platform ("GCP") and are protected by the security and environmental controls of Amazon and Google, respectively. The infrastructure for the ZanReal Labs Services spans multiple, fault-independent AWS availability zones in geographic regions physically separated from one another, supported by various tools and processes to maintain high availability of services.
ZanReal Labs performs regular backups of Customer Data, which is hosted in AWS, Microsoft Azure, and GCP data centers. Backups are globally replicated for resiliency against regional disasters and periodically tested by the ZanReal Labs engineering team.
Employees complete mandatory training annually, which covers privacy and data protection, confidentiality, social engineering, password policies, and information security.
ZanReal Labs performs regular backups of Customer Data, which is hosted in AWS, Microsoft Azure, and GCP data centers. Backups are retained redundantly across multiple availability zones and encrypted in transit and at rest.
ZanReal Labs has a business continuity and disaster recovery plan that incorporates input from periodic risk assessments, vulnerability scanning, and threat analysis.
ZanReal Labs maintains a risk-based assessment security program. The framework for ZanReal Labs' security program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the Services and confidentiality, integrity, and availability of Customer Data. ZanReal Labs' security program is intended to be appropriate to the nature of the Services and the size and complexity of ZanReal Labs' business operations.
ZanReal Labs has a separate and dedicated security team that manages ZanReal Labs' security program. This team facilitates and supports independent audits and assessments performed by third parties to provide independent feedback on the operating effectiveness of the information security program (e.g., SOC 2 Type 2, penetration testing, and vulnerability scanning).
ZanReal Labs' security governance program covers: Policies and Procedures, Asset Management, Access Management, Data Handling, Encryption, Logging & Monitoring, Password Management, Personnel Security, Resiliency, Responsible Disclosure, Risk Assessment, Vendor Risk Management, Vulnerability, SDLC, Incident Response, Business Continuity & Crisis Management, Acceptable Use and Code of Conduct. Information security policies and standards are reviewed and approved by management at least annually and are made available to all employees.
Security is managed at the highest levels of the company, with security and technology leadership meeting with executive management regularly to discuss issues and coordinate company-wide security initiatives.
ZanReal Labs personnel are required to use unique user access credentials and passwords for authorization. ZanReal Labs follows the principles of least privilege through role-based and time-based access models when provisioning system access. ZanReal Labs personnel are authorized to access Customer Data based on their job function, role and responsibilities, and such access requires approval prior to access provisioning. Employee access to Customer Data is promptly removed upon role change or termination.
ZanReal Labs uses commercially reasonable practices to identify and authenticate users who attempt to access ZanReal Labs systems.
Customer Data is encrypted when in transit between Customer and the ZanReal Labs Services.
Customer Data is stored encrypted using AES-256. ZanReal Labs uses AWS Key Management System ("KMS") to encrypt data in our infrastructure. AWS KMS is a secure and resilient service that uses FIPS 140-2 validated hardware security modules to protect keys that cannot be retrieved from the service by anyone or transmitted beyond the AWS regions where they were created. AWS log-in credentials and private keys generated by the Service are for ZanReal Labs' internal use only.
ZanReal Labs is a remote-first organization with limited physical presence globally. As needed, physical security controls for office space are inherited from our co-working office provider, which manages visitors, building entrances, CCTVs (closed circuit televisions), and overall office security.
The Services operate on AWS, Microsoft, and GCP and are protected by the security and environmental controls of Amazon, Microsoft, and Google, respectively.
Detailed information about AWS security is available at:
For AWS SOC Reports, please see:
Detailed information about Azure security is available at:
Detailed information about GCP security is available at:
ZanReal Labs monitors access to applications, tools, and resources that process or store Customer Data, including cloud services. Monitoring of security logs is centralized by the security team. Log activities are investigated when necessary and escalated appropriately.
User activity metrics are available to Customers within the Services. For further information, visit /settings/activity.
ZanReal Labs applies Secure Software Development Lifecycle (Secure SDLC) standards to perform numerous security-related activities for the Services across different phases of the product creation lifecycle from requirements gathering and product design all the way through product deployment. These activities include, but are not limited to, the performance of (a) internal security reviews before new Services are deployed; and (b) annual penetration testing by independent third parties.
ZanReal Labs adheres to a change management process to administer changes to the production environment for the Services, including changes to its underlying software, applications, and systems. Monitors are in place to notify the security team of changes made to critical infrastructure and services that do not adhere to the change management processes.
ZanReal Labs maintains a risk-based assessment security program. The framework for ZanReal Labs' security program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the Services and confidentiality, integrity, and availability of Customer Data. ZanReal Labs' security program is intended to be appropriate to the nature of the Services and the size and complexity of ZanReal Labs' business operations.
ZanReal Labs has a separate and dedicated Information Security team that manages ZanReal Labs' security program. This team facilitates and supports independent audits and assessments performed by third parties to provide independent feedback on the operating effectiveness of the information security program (e.g., SOC 2 Type 2, penetration testing, and vulnerability scanning).
ZanReal Labs' security governance program covers Policies and Procedures, Asset Management, Access Management, Data Handling, Encryption, Logging & Monitoring, Password Management, Personnel Security, Resiliency, Responsible Disclosure, Risk Assessment, Vendor Risk Management, Vulnerability, SDLC, Incident Response, Business Continuity & Crisis Management, Acceptable Use and Code of Conduct. Information security policies and standards are reviewed and approved by management at least annually and are made available to all employees.
Security is managed at the highest levels of the company, with security and technology leadership meeting with executive management regularly to discuss issues and coordinate company-wide security initiatives.
ZanReal Labs conducts various third-party audits to attest to various frameworks including SOC 2 Type 2 and annual application penetration testing.
AWS, Azure, and GCP have achieved: SOC 1, 2, and 3; ISO 27001, 27017, 27018, 27701, and 9001; Cloud Security Alliance Security, Trust, Assurance and Risk (CSA STAR); FedRAMP; and use FIPS 140-2 validated cryptographic modules, in addition to meeting compliance standards for many other legal, security, and privacy frameworks. Further information about these providers' security practices can be found on their respective websites.
ZanReal Labs Customers unilaterally determine what Customer Data they route through the ZanReal Labs Services and how the Services are configured. As such, ZanReal Labs operates on a shared responsibility model. ZanReal Labs provides tools within the Services that gives Customers control over exactly what data enters the platform and enables Customers with the ability to block data at the Source level. Additionally, ZanReal Labs allows Customers to delete and suppress Customer Data on demand.
ZanReal Labs has a three-fold approach for ensuring data quality. These measures include: (i) unit testing to ensure the quality of logic used to make API calls, (ii) volume testing to ensure the code is able to scale, and (iii) daily end-to-end testing to ensure that the input values match expected values. ZanReal Labs applies these measures across the board, both to ensure the quality of any Service-Generated Data that ZanReal Labs collects and to ensure that the ZanReal Labs Services are operating in accordance with the documentation.
Each ZanReal Labs Customer chooses what Customer Data they route through the ZanReal Labs Services and how the Services are configured. As such, ZanReal Labs operates on a shared responsibility model. ZanReal Labs ensures that data quality is maintained from the time a Customer sends Customer Data into the Services and until that Customer Data leaves ZanReal Labs to flow to a downstream destination.
ZanReal Labs has a process that allows individuals to exercise their privacy rights, as described in ZanReal Labs' Privacy Notice available at Privacy Policy.
ZanReal Labs Customers unilaterally determine what Customer Data they route through the ZanReal Labs Services and how the Services are configured. As such, ZanReal Labs operates on a shared responsibility model. Customers have the ability to delete Customer Data via the self-service functionality of the Services. ZanReal Labs will, within a commercially reasonable timeframe after request by Customer following the termination or expiration of the Agreement, delete all Customer Data from ZanReal Labs' systems, unless required by law.
ZanReal Labs has adopted measures for ensuring accountability, such as implementing data protection policies across the business, publishing ZanReal Labs' Information Security Policy (available at /security), maintaining documentation of processing activities, and recording and reporting Security Incidents involving Personal Data. ZanReal Labs conducts regular third-party audits to ensure compliance with our privacy and security standards.
ZanReal Labs' Customers have direct relationships with their end users and are responsible for responding to requests from their end users who wish to exercise their rights under Applicable Data Protection Laws.
ZanReal Labs has self-service functionality that allows Customers to delete and suppress their Customer Data.
ZanReal Labs specifies in the Addendum that it will provide assistance to such Customer as may reasonably be required to comply with Customer's obligations under Applicable Data Protection Laws to respond to requests from individuals to exercise their rights under Applicable Data Protection Laws (e.g., rights of data access, rectification, erasure, restriction, portability and objection). If ZanReal Labs receives a request from a Data Subject in relation to their Customer Data, ZanReal Labs will advise the Data Subject to submit their request to Customer, and Customer will be responsible for responding to any such request.
ZanReal Labs has a process that allows individuals to exercise their privacy rights, as described in ZanReal Labs' Privacy Notice available at Privacy Policy.
When ZanReal Labs engages a Subprocessor under this Addendum, ZanReal Labs and the Subprocessor enter into an agreement with data protection terms substantially similar to those contained herein. Each Subprocessor agreement must ensure that ZanReal Labs is able to meet its obligations to Customer. In addition to implementing technical and organisational measures to protect personal data, Subprocessors must a) notify ZanReal Labs in the event of a Security Incident so ZanReal Labs may notify Customer; b) delete data when instructed by ZanReal Labs in accordance with Customer's instructions to ZanReal Labs; c) not engage additional Subprocessors without authorization; d) not change the location where data is processed; or e) process data in a manner which conflicts with Customer's instructions to ZanReal Labs.
Cross Border Data Transfer Mechanism
Standard Contractual Clauses. To the extent that Customer's use of the Services requires an onward transfer mechanism to lawfully transfer personal data from the EEA, UK, or Switzerland to ZanReal Labs located outside of those jurisdictions, the Standard Contractual Clauses will apply to such transfers. The parties agree that: a. Customer is the data exporter and ZanReal Labs is the data importer; b. The subject matter, duration, nature and purpose of the processing, categories of data subjects, and categories of personal data are set out in Schedule 1; c. The technical and organizational measures are set out in Schedule 2; d. Any Subprocessor arrangements will be governed by the terms of this DPA; e. The parties will comply with the Standard Contractual Clauses as if they were directly incorporated into this DPA.
UK International Data Transfer Addendum. For transfers of personal data from the UK, the UK IDTA set out in Schedule 5 will apply.
ZanReal Labs will notify Customer of any changes to applicable transfer mechanisms and work with Customer to implement any necessary updates to ensure continued compliance with applicable laws.
Jurisdiction Specific Terms
GDPR Compliance. Where ZanReal Labs processes personal data subject to the GDPR, ZanReal Labs will comply with the obligations of a processor under the GDPR.
Data Protection Officer. Customer may contact ZanReal Labs' Data Protection Officer at privacy@zanreal.com.
Supervisory Authority. The competent supervisory authority is the supervisory authority of the Member State in which Customer has its main establishment or, if Customer has no establishment in the EU, the supervisory authority in the Member State where Customer's representative is established.
UK GDPR Compliance. Where ZanReal Labs processes personal data subject to the UK GDPR, ZanReal Labs will comply with the obligations of a processor under the UK GDPR.
UK Representative. If required by applicable law, ZanReal Labs will appoint a UK representative and provide Customer with the representative's contact information.
UK International Data Transfer Addendum
| Start date | The date this Addendum enters into force |
|---|---|
| The Parties | Data exporter: Customer (as data controller or processor) and Data importer: ZanReal Labs (as processor) |
| Addendum EU SCCs | The version of the Approved EU SCCs which this Addendum is appended to |
|---|---|
| Module | Module Two (controller to processor) and/or Module Three (processor to processor) as applicable |
| Appendix | Information |
|---|---|
| Annex 1A: List of Parties | As set out in Schedule 1 |
| Annex 1B: Description of Transfer | As set out in Schedule 1 |
| Annex II: Technical and organisational measures | As set out in Schedule 2 |
| Annex III: List of Sub processors | As set out at zanreal.com/security |
| Ending this Addendum when the Approved Addendum changes | Which Parties may end this Addendum as set out in Section 19: Customer and ZanReal Labs |
|---|
Interpretation of this Addendum. This Addendum forms part of the Agreement and must be read together with the Standard Contractual Clauses. This Addendum does not modify the Standard Contractual Clauses except where specified.
Hierarchy. In case of conflict, this Addendum prevails over the Agreement but does not prevail over the Standard Contractual Clauses.
Incorporation of and changes to the EU SCCs. This Addendum incorporates the Standard Contractual Clauses which are amended to the extent necessary so that: a. Together they operate for data transfers made by the data exporter to the data importer, to the extent that such transfers are subject to the Data Protection Laws of the United Kingdom; b. The Standard Contractual Clauses taken together with this Addendum provide appropriate safeguards pursuant to the Data Protection Laws of the United Kingdom.
Interpretation of this Addendum. Where this Addendum uses terms that are defined in the Standard Contractual Clauses, those terms shall have the same meaning as in the Standard Contractual Clauses. Additionally, the following terms have the following meanings: a. "Addendum" means this UK International Data Transfer Addendum; b. "Approved Addendum" means the template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022; c. "Data Protection Laws" means all applicable data protection and privacy laws including the Data Protection Act 2018 and the UK GDPR; d. "ICO" means the Information Commissioner's Office; e. "UK" means the United Kingdom of Great Britain and Northern Ireland; f. "UK GDPR" means the UK General Data Protection Regulation.
The previous versions of our Policies and other documents can be seen at GitHub