Data Processing Agreement — Review Draft

Agreement status and scope

This document is a review draft, not an executed DPA or evidence of GDPR compliance. It requires identification of both legal parties, applicable law, authorized subprocessors, processing locations, security measures, transfer mechanisms, retention and deletion schedules, and an agreed effective date before execution.

For customer-controlled lead, campaign, and mailbox personal data, the customer acts as controller, or as a processor with authority to appoint another processor. Zintara acts as processor or subprocessor for the agreed service. Independent account administration and legal obligations are described in the Privacy Policy.

Documented instructions and confidentiality

Zintara will process covered data only on documented lawful instructions, including agreed service configuration and authorized support requests, unless applicable law requires otherwise. Where permitted, it will notify the customer of a conflicting legal requirement and inform the customer if an instruction appears to infringe applicable data protection law.

Personnel authorized to process covered data must be bound by confidentiality duties and access restrictions appropriate to their work. The customer is responsible for the lawfulness of instructions, disclosures, and collection of data.

Security and incident assistance

The parties must attach an accurate schedule of technical and organizational measures appropriate to risk, addressing access control, credential protection, encryption, logging, recovery, isolation, and incident response. No certification or audit report is represented by this draft.

Zintara will notify the customer without undue delay after becoming aware of a personal data breach affecting covered data and provide available information and reasonable assistance for investigation, mitigation, and legally required notifications. Information may be supplied in phases as facts become available.

Subprocessors and transfers

Before processing begins, the parties must agree the authorized subprocessor inventory and a procedure for advance notice of additions or replacements and reasonable objections. Relevant data-protection obligations must flow down in written contracts, and Zintara remains responsible for its subprocessors’ performance as required by applicable law.

Covered data may be transferred internationally only under documented instructions and a valid applicable transfer mechanism. Necessary standard contractual clauses, UK addenda, assessments, or other safeguards must be separately completed; this draft does not incorporate unsigned safeguards by implication.

Requests, assessments, and compliance evidence

Taking account of the nature of processing, Zintara will reasonably assist the customer with data-subject requests, security obligations, breach response, impact assessments, and regulatory consultations as required by applicable law. Requests received directly from a data subject will be referred to the customer where appropriate.

Zintara will make available information necessary to demonstrate compliance with the agreed processor obligations and allow required audits and inspections by the customer or an authorized auditor, with reasonable confidentiality and security arrangements that do not defeat statutory rights.

End of processing

At the customer’s choice, Zintara will return or delete covered data at the end of services and delete existing copies unless applicable law requires retention. The parties must specify return formats, timing, backup isolation and expiry, and treatment of legally retained records in the completed schedule.

Processing schedule to complete

Subject matter: operation of customer-directed cold email outreach and reply management. Nature: hosting, organizing, generating drafts, researching public sources, transmitting, synchronizing, and recording configured events. Duration: the service relationship plus agreed return, deletion, or legally required retention periods.

Data subjects: customer-authorized users, leads, recipients, correspondents, and people identified in customer content. Data categories: business contact details, customer fields, message content and attachments, mailbox authorization data, campaign and reply events, and technical identifiers. Sensitive data is not an intended service input.

The final schedule must identify actual infrastructure and AI vendors, locations, safeguards, security measures, retention periods, and customer instructions. Use Contact to request completion and execution before relying on this agreement.