Data Processing Agreement

1. Parties and roles

Your company is the controller (in India, the data fiduciary) of the personal data it puts into ZetSuite. The ZetSuite company that bills you is the processor. This agreement applies from the moment your company accepts the Terms of Service, and lasts as long as we process the data.

2. What we process

3. Your instructions

We process the data only on your company's documented instructions: these terms, and the settings your Owner and Admins choose in ZetSuite. If we think an instruction breaks the law, we tell you. We never use your data for our own purposes or to train AI models.

4. Confidentiality

Everyone at ZetSuite who can reach customer data is bound by confidentiality, trained every year, and given only the access their role needs. Opening a company's data needs a support ticket, is time-limited and audit-logged, and the company can turn support access off in Settings › Security.

5. Security measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Data kept in the company's region: India, the EU or the UAE.
• Two-factor sign-in for all staff, single sign-on and IP allow-lists available to companies.
• Encrypted backups, tested restores, and an append-only audit log.
• Regular independent security testing, with a summary shared on request.

6. Sub-processors

You authorise the sub-processors listed in our Privacy Policy. We give at least 30 days notice before adding or replacing one, by email to subscribers and in Settings › Privacy & data. You can object on reasonable data protection grounds; if we can't resolve it, you can end the affected service and get a refund for the unused period. We hold every sub-processor to the same duties as this agreement.

7. International transfers

Data is stored in your region. If a sub-processor reaches it from elsewhere, we use the EU Standard Contractual Clauses (2021) for EU data, and the safeguards required by the DPDP Act and UAE PDPL for Indian and UAE data.

8. Helping with rights requests

ZetSuite has tools for access, correction, deletion and export requests. If someone contacts us directly about your company's data, we pass the request to you within 5 business days and don't answer it ourselves unless you ask us to.

9. Personal data breaches

We tell your company's Owner and Admins without undue delay, and within 48 hours of becoming aware of a breach that affects your data, so you can meet your own 72-hour duty to the authority. We share what happened, what data and people are affected, and what we are doing about it, and keep you updated.

10. Audits

We share a summary of our latest independent security test and our security documentation on request. If you need more, you can audit once a year with 30 days notice, at your cost, or sooner after a breach or if an authority requires it.

11. Return and deletion

When your company closes, you can export everything during the grace period (30 days by default). After that we delete the data, including from backups within 35 days, and send a deletion certificate. We keep only what the law requires, such as invoices.

12. Country terms

For EU data, this agreement includes the terms of Article 28 GDPR. For India, it covers the duties of a data processor under the DPDP Act 2023 and its Rules. For the UAE, it covers Federal Decree-Law No. 45 of 2021.

13. Versions

Your company accepted a version when it signed up or when we last asked. See which one in Settings › Privacy & data.