This Data Processing Addendum ("Addendum") is entered into and is supplemental to, and made pursuant to, the ZanReal Services Agreement, Enterprise Services Order Form and Enterprise Terms and Conditions or other agreement executed between ZanReal and Customer for ZanReal' provision of Services (the "Agreement") as of the effective date of such Agreement ("Effective Date") and is by and between ZANREAL Mateusz Janota, a Polish corporation ("ZanReal"), and the Customer that executed the Agreement. This Addendum applies to ZanReal' Processing of Personal Data under the Agreement across all Services including software development, marketing services, remote IT support, SEO optimization, and UI/UX design services.
Customer enters into this Addendum on behalf of itself and, to the extent required under applicable Data Protection Laws and Regulations, in the name and on behalf of its Affiliates to the extent such Affiliates are included and covered under the Agreement with ZanReal. For the purposes of this Addendum only, and except where indicated otherwise, the term "Customer" shall include Customer and Affiliates.
This Addendum shall become legally binding upon Customer entering into the Agreement.
Any terms used in this Addendum and not defined will have the meanings given to them in the applicable Agreement.
Each party will comply with its obligations under Applicable Data Protection Laws with respect to its Processing of Customer Data.
The parties acknowledge that Customer must be able to assess ZanReal' compliance with its obligations under Applicable Data Protection Laws and this Addendum, insofar as ZanReal is acting as a processor on behalf of Customer.
ZanReal will provide reasonable cooperation to Customer, to the extent Customer does not otherwise have access to the relevant information and such information is available to ZanReal, in connection with any data protection impact assessment (at Customer's expense only if such reasonable cooperation will require ZanReal to assign significant resources to that effort) or consultations with regulatory authorities as required by Applicable Data Protection Laws.
ZanReal will upon Customer's request (and at Customer's expense) provide Customer with such assistance as it may reasonably require to comply with its obligations under Applicable Data Protection Laws to respond to requests from individuals to exercise their rights under Applicable Data Protection Laws (e.g., rights of data access, rectification, erasure, restriction, portability and objection) in cases where Customer cannot reasonably fulfill such requests independently by using the self-service functionality of the Services. If ZanReal receives a request from a Data Subject in relation to the Processing of their Customer Data, ZanReal will advise the Data Subject to submit their request to Customer, and Customer will be responsible for responding to any such request.
Subject Matter & Details of Processing
ZanReal will process Personal Data as necessary to provide the Services under the Agreement. ZanReal does not sell Customer Data (or end user information within such Customer Data) and does not share such end users' information with third parties for compensation or for those third parties' own business interests.
The period for which Personal Data will be retained and the criteria used to determine that period is as follows:
Technical & Organizational Security Measures
Where applicable, this Schedule 2 will serve as Annex II to the Standard Contractual Clauses. The following provides more information regarding ZanReal' technical and organizational security measures set forth below.
ZanReal maintains Customer Data in an encrypted format at rest using Advanced Encryption Standard (AES-256) and in transit (TLS 1.2 or higher).
ZanReal' Customer agreements contain strict confidentiality obligations. Additionally, ZanReal requires Subprocessors to sign confidentiality provisions that are substantially similar to those contained in ZanReal' Customer agreements. All employees (and contractors) are bound by ZanReal' internal policies regarding maintaining the confidentiality of Customer Data and are contractually obligated to comply with these obligations.
The Services operate on Amazon Web Services ("AWS"), Microsoft Azure ("Azure"), and Google Cloud Platform ("GCP") and are protected by the security and environmental controls of Amazon and Google, respectively. The infrastructure for the ZanReal Services spans multiple, fault-independent AWS availability zones in geographic regions physically separated from one another, supported by various tools and processes to maintain high availability of services.
ZanReal performs regular backups of Customer Data, which is hosted in AWS, Microsoft Azure, and GCP data centers. Backups are globally replicated for resiliency against regional disasters and periodically tested by the ZanReal engineering team.
Employees complete mandatory training annually, which covers privacy and data protection, confidentiality, social engineering, password policies, and information security.
ZanReal performs regular backups of Customer Data, which is hosted in AWS, Microsoft Azure, and GCP data centers. Backups are retained redundantly across multiple availability zones and encrypted in transit and at rest.
ZanReal has a business continuity and disaster recovery plan that incorporates input from periodic risk assessments, vulnerability scanning, and threat analysis.
ZanReal maintains a risk-based assessment security program. The framework for ZanReal' security program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the Services and confidentiality, integrity, and availability of Customer Data. ZanReal' security program is intended to be appropriate to the nature of the Services and the size and complexity of ZanReal' business operations.
ZanReal has a separate and dedicated security team that manages ZanReal' security program. This team facilitates and supports independent audits and assessments performed by third parties to provide independent feedback on the operating effectiveness of the information security program (e.g., SOC 2 Type 2, penetration testing, and vulnerability scanning).
ZanReal' security governance program covers: Policies and Procedures, Asset Management, Access Management, Data Handling, Encryption, Logging & Monitoring, Password Management, Personnel Security, Resiliency, Responsible Disclosure, Risk Assessment, Vendor Risk Management, Vulnerability, SDLC, Incident Response, Business Continuity & Crisis Management, Acceptable Use and Code of Conduct. Information security policies and standards are reviewed and approved by management at least annually and are made available to all employees.
Security is managed at the highest levels of the company, with security and technology leadership meeting with executive management regularly to discuss issues and coordinate company-wide security initiatives.
ZanReal personnel are required to use unique user access credentials and passwords for authorization. ZanReal follows the principles of least privilege through role-based and time-based access models when provisioning system access. ZanReal personnel are authorized to access Customer Data based on their job function, role and responsibilities, and such access requires approval prior to access provisioning. Employee access to Customer Data is promptly removed upon role change or termination.
ZanReal uses commercially reasonable practices to identify and authenticate users who attempt to access ZanReal systems.
Customer Data is encrypted when in transit between Customer and the ZanReal Services.
Customer Data is stored encrypted using AES-256. ZanReal uses AWS Key Management System ("KMS") to encrypt data in our infrastructure. AWS KMS is a secure and resilient service that uses FIPS 140-2 validated hardware security modules to protect keys that cannot be retrieved from the service by anyone or transmitted beyond the AWS regions where they were created. AWS log-in credentials and private keys generated by the Service are for ZanReal' internal use only.
ZanReal is a remote-first organization with limited physical presence globally. As needed, physical security controls for office space are inherited from our co-working office provider, which manages visitors, building entrances, CCTVs (closed circuit televisions), and overall office security.
The Services operate on AWS, Microsoft, and GCP and are protected by the security and environmental controls of Amazon, Microsoft, and Google, respectively.
Detailed information about AWS security is available at:
For AWS SOC Reports, please see:
Detailed information about Azure security is available at:
Detailed information about GCP security is available at:
ZanReal monitors access to applications, tools, and resources that process or store Customer Data, including cloud services. Monitoring of security logs is centralized by the security team. Log activities are investigated when necessary and escalated appropriately.
User activity metrics are available to Customers within the Services. For further information, visit /settings/activity.
ZanReal applies Secure Software Development Lifecycle (Secure SDLC) standards to perform numerous security-related activities for the Services across different phases of the product creation lifecycle from requirements gathering and product design all the way through product deployment. These activities include, but are not limited to, the performance of (a) internal security reviews before new Services are deployed; and (b) annual penetration testing by independent third parties.
ZanReal adheres to a change management process to administer changes to the production environment for the Services, including changes to its underlying software, applications, and systems. Monitors are in place to notify the security team of changes made to critical infrastructure and services that do not adhere to the change management processes.
ZanReal maintains a risk-based assessment security program. The framework for ZanReal' security program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the Services and confidentiality, integrity, and availability of Customer Data. ZanReal' security program is intended to be appropriate to the nature of the Services and the size and complexity of ZanReal' business operations.
ZanReal has a separate and dedicated Information Security team that manages ZanReal' security program. This team facilitates and supports independent audits and assessments performed by third parties to provide independent feedback on the operating effectiveness of the information security program (e.g., SOC 2 Type 2, penetration testing, and vulnerability scanning).
ZanReal' security governance program covers Policies and Procedures, Asset Management, Access Management, Data Handling, Encryption, Logging & Monitoring, Password Management, Personnel Security, Resiliency, Responsible Disclosure, Risk Assessment, Vendor Risk Management, Vulnerability, SDLC, Incident Response, Business Continuity & Crisis Management, Acceptable Use and Code of Conduct. Information security policies and standards are reviewed and approved by management at least annually and are made available to all employees.
Security is managed at the highest levels of the company, with security and technology leadership meeting with executive management regularly to discuss issues and coordinate company-wide security initiatives.
ZanReal conducts various third-party audits to attest to various frameworks including SOC 2 Type 2 and annual application penetration testing.
AWS, Azure, and GCP have achieved: SOC 1, 2, and 3; ISO 27001, 27017, 27018, 27701, and 9001; Cloud Security Alliance Security, Trust, Assurance and Risk (CSA STAR); FedRAMP; and use FIPS 140-2 validated cryptographic modules, in addition to meeting compliance standards for many other legal, security, and privacy frameworks. Further information about these providers' security practices can be found on their respective websites.
ZanReal Customers unilaterally determine what Customer Data they route through the ZanReal Services and how the Services are configured. As such, ZanReal operates on a shared responsibility model. ZanReal provides tools within the Services that gives Customers control over exactly what data enters the platform and enables Customers with the ability to block data at the Source level. Additionally, ZanReal allows Customers to delete and suppress Customer Data on demand.
ZanReal has a three-fold approach for ensuring data quality. These measures include: (i) unit testing to ensure the quality of logic used to make API calls, (ii) volume testing to ensure the code is able to scale, and (iii) daily end-to-end testing to ensure that the input values match expected values. ZanReal applies these measures across the board, both to ensure the quality of any Service-Generated Data that ZanReal collects and to ensure that the ZanReal Services are operating in accordance with the documentation.
Each ZanReal Customer chooses what Customer Data they route through the ZanReal Services and how the Services are configured. As such, ZanReal operates on a shared responsibility model. ZanReal ensures that data quality is maintained from the time a Customer sends Customer Data into the Services and until that Customer Data leaves ZanReal to flow to a downstream destination.
ZanReal has a process that allows individuals to exercise their privacy rights, as described in ZanReal' Privacy Notice available at Privacy Policy.
ZanReal Customers unilaterally determine what Customer Data they route through the ZanReal Services and how the Services are configured. As such, ZanReal operates on a shared responsibility model. Customers have the ability to delete Customer Data via the self-service functionality of the Services. ZanReal will, within a commercially reasonable timeframe after request by Customer following the termination or expiration of the Agreement, delete all Customer Data from ZanReal' systems, unless required by law.
ZanReal has adopted measures for ensuring accountability, such as implementing data protection policies across the business, publishing ZanReal' Information Security Policy (available at /security), maintaining documentation of processing activities, and recording and reporting Security Incidents involving Personal Data. ZanReal conducts regular third-party audits to ensure compliance with our privacy and security standards.
ZanReal' Customers have direct relationships with their end users and are responsible for responding to requests from their end users who wish to exercise their rights under Applicable Data Protection Laws.
ZanReal has self-service functionality that allows Customers to delete and suppress their Customer Data.
ZanReal specifies in the Addendum that it will provide assistance to such Customer as may reasonably be required to comply with Customer's obligations under Applicable Data Protection Laws to respond to requests from individuals to exercise their rights under Applicable Data Protection Laws (e.g., rights of data access, rectification, erasure, restriction, portability and objection). If ZanReal receives a request from a Data Subject in relation to their Customer Data, ZanReal will advise the Data Subject to submit their request to Customer, and Customer will be responsible for responding to any such request.
ZanReal has a process that allows individuals to exercise their privacy rights, as described in ZanReal' Privacy Notice available at Privacy Policy.
When ZanReal engages a Subprocessor under this Addendum, ZanReal and the Subprocessor enter into an agreement with data protection terms substantially similar to those contained herein. Each Subprocessor agreement must ensure that ZanReal is able to meet its obligations to Customer. In addition to implementing technical and organisational measures to protect personal data, Subprocessors must a) notify ZanReal in the event of a Security Incident so ZanReal may notify Customer; b) delete data when instructed by ZanReal in accordance with Customer's instructions to ZanReal; c) not engage additional Subprocessors without authorization; d) not change the location where data is processed; or e) process data in a manner which conflicts with Customer's instructions to ZanReal.
Cross Border Data Transfer Mechanism
Standard Contractual Clauses. To the extent that Customer's use of the Services requires an onward transfer mechanism to lawfully transfer personal data from the EEA, UK, or Switzerland to ZanReal located outside of those jurisdictions, the Standard Contractual Clauses will apply to such transfers. The parties agree that: a. Customer is the data exporter and ZanReal is the data importer; b. The subject matter, duration, nature and purpose of the processing, categories of data subjects, and categories of personal data are set out in Schedule 1; c. The technical and organizational measures are set out in Schedule 2; d. Any Subprocessor arrangements will be governed by the terms of this DPA; e. The parties will comply with the Standard Contractual Clauses as if they were directly incorporated into this DPA.
UK International Data Transfer Addendum. For transfers of personal data from the UK, the UK IDTA set out in Schedule 5 will apply.
ZanReal will notify Customer of any changes to applicable transfer mechanisms and work with Customer to implement any necessary updates to ensure continued compliance with applicable laws.
Jurisdiction Specific Terms
GDPR Compliance. Where ZanReal processes personal data subject to the GDPR, ZanReal will comply with the obligations of a processor under the GDPR.
Data Protection Officer. Customer may contact ZanReal' Data Protection Officer at privacy@zanreal.com.
Supervisory Authority. The competent supervisory authority is the supervisory authority of the Member State in which Customer has its main establishment or, if Customer has no establishment in the EU, the supervisory authority in the Member State where Customer's representative is established.
UK GDPR Compliance. Where ZanReal processes personal data subject to the UK GDPR, ZanReal will comply with the obligations of a processor under the UK GDPR.
UK Representative. If required by applicable law, ZanReal will appoint a UK representative and provide Customer with the representative's contact information.
UK International Data Transfer Addendum
| Start date | The date this Addendum enters into force |
|---|---|
| The Parties | Data exporter: Customer (as data controller or processor) and Data importer: ZanReal (as processor) |
| Addendum EU SCCs | The version of the Approved EU SCCs which this Addendum is appended to |
|---|---|
| Module | Module Two (controller to processor) and/or Module Three (processor to processor) as applicable |
| Appendix | Information |
|---|---|
| Annex 1A: List of Parties | As set out in Schedule 1 |
| Annex 1B: Description of Transfer | As set out in Schedule 1 |
| Annex II: Technical and organisational measures | As set out in Schedule 2 |
| Annex III: List of Sub processors | As set out at zanreal.com/security |
| Ending this Addendum when the Approved Addendum changes | Which Parties may end this Addendum as set out in Section 19: Customer and ZanReal |
|---|
Interpretation of this Addendum. This Addendum forms part of the Agreement and must be read together with the Standard Contractual Clauses. This Addendum does not modify the Standard Contractual Clauses except where specified.
Hierarchy. In case of conflict, this Addendum prevails over the Agreement but does not prevail over the Standard Contractual Clauses.
Incorporation of and changes to the EU SCCs. This Addendum incorporates the Standard Contractual Clauses which are amended to the extent necessary so that: a. Together they operate for data transfers made by the data exporter to the data importer, to the extent that such transfers are subject to the Data Protection Laws of the United Kingdom; b. The Standard Contractual Clauses taken together with this Addendum provide appropriate safeguards pursuant to the Data Protection Laws of the United Kingdom.
Interpretation of this Addendum. Where this Addendum uses terms that are defined in the Standard Contractual Clauses, those terms shall have the same meaning as in the Standard Contractual Clauses. Additionally, the following terms have the following meanings: a. "Addendum" means this UK International Data Transfer Addendum; b. "Approved Addendum" means the template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022; c. "Data Protection Laws" means all applicable data protection and privacy laws including the Data Protection Act 2018 and the UK GDPR; d. "ICO" means the Information Commissioner's Office; e. "UK" means the United Kingdom of Great Britain and Northern Ireland; f. "UK GDPR" means the UK General Data Protection Regulation.
The previous versions of our Policies and other documents can be seen at GitHub