Data Processing Agreement

This agreement forms part of the ZenMode Terms of Service between ZenMode Ltd, a company registered in England and Wales (company number 16925050), whose registered office is at 41 Elm Park, Stanmore, Middlesex, HA7 4AU ("ZenMode"), and the customer ("Customer"). It applies where ZenMode processes personal data on the Customer's behalf.

1. Roles

The Customer is the controller, and ZenMode the processor, of the personal data the Customer puts into or creates in ZenMode: its contacts, prospect lists and uploads, campaign messages, conversations and CRM records ("Customer Personal Data"). ZenMode is the controller of account and billing data, and of the anonymised statistics described in its Privacy Policy.

2. Subject matter, duration and nature

Providing ZenMode's LinkedIn outreach, CRM and related features, for as long as the Customer's account is active. The people concerned are the Customer's business contacts and prospects, and its users. The data is professional contact and profile data (such as name, job title, company, LinkedIn profile address and work email address), messages and notes. ZenMode does not want special-category data, and the Customer must not upload it.

3. ZenMode's obligations

ZenMode will:

• process Customer Personal Data only on the Customer's documented instructions, which are the Terms of Service and the Customer's use of the service;
• make sure everyone authorised to process it is bound by confidentiality;
• keep appropriate technical and organisational security measures, including encryption in transit and access controls;
• help the Customer respond to requests from the people its data is about, and meet its obligations on security, breach notification and impact assessments, taking into account the nature of the processing;
• tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data;
• at the end of the service, delete Customer Personal Data within 30 days, unless the law requires ZenMode to keep it; the Customer may export its data before then;
• make available the information needed to show compliance with this agreement, and allow reasonable audits on 30 days' notice, at most once a year.

4. Subprocessors

The Customer authorises ZenMode to use subprocessors in these categories: cloud hosting and database; payments; authentication and bot protection; transactional email; AI model providers; voice generation; error monitoring and product analytics; and third-party B2B data and enrichment providers. The countries involved include the United Kingdom, the European Union (including France, Belgium, Germany and Ireland), the United States and Australia. A list of subprocessors by name is available on request from jonathan@zen-mode.io.

ZenMode puts data protection terms on each subprocessor equivalent to this agreement, stays responsible for its subprocessors, and will give 30 days' notice by email before adding a new category of subprocessor, during which the Customer may object. If an objection cannot be resolved, the Customer may stop using the affected feature or end the service.

5. Third-party B2B data and enrichment

Some features the Customer chooses to run may use third-party B2B data and enrichment providers, for example to read public professional information or to look up details about a business. For those features ZenMode sends a provider only what the feature needs, never the Customer's messages. Where a provider returns data from its own business-contact database, it supplies that data as an independent controller; once saved in the Customer's ZenMode account, the Customer is its controller. The Customer will use these features only for business contacts in their professional role, have a lawful basis for contacting them, and comply with the rules that apply to how it contacts them.

6. International transfers

Where Customer Personal Data is transferred outside the United Kingdom or the European Economic Area, ZenMode relies on an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, as applicable.

7. The Customer's obligations

The Customer is responsible for the lawfulness of the data it provides and of its instructions, including its legal basis and the notices it gives to the people it contacts.

8. Precedence

If this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails.

9. Contact

Questions about this agreement, or a request for the list of subprocessors: jonathan@zen-mode.io.