Data processing agreement

For the personal data of your website visitors and the content you add to the Service, you are the controller and we are the processor. You are responsible for having a lawful basis for the processing and for giving your visitors the information required by law, for example in your own privacy policy.

For the data about your account and team members, we are the controller; that is covered by our privacy policy, not by this DPA.

• We process personal data only on your documented instructions, which are this DPA, the terms of service and the settings you choose in the Service, unless the law requires otherwise. If we believe an instruction breaks Data Protection Law, we will tell you.
• Everyone at Zovama who can access personal data is bound by confidentiality.
• We take the security measures described in section 5.
• We help you, as far as reasonably possible, to answer requests from data subjects (for example access, correction, deletion or export). Many of these can be done directly in the panel.
• We help you with data protection impact assessments and consultations with authorities where they relate to our Service.
• We make available the information needed to show that we comply with this DPA, and we allow and contribute to reasonable audits, as described in section 8.

You give us a general authorisation to use sub-processors. We currently use the following types of provider:

You can request the current named list at [email protected]. We will tell you at least 14 days before adding or replacing a sub-processor that processes your visitors' data. If you object on reasonable data protection grounds and we cannot find a solution, you may close your account; we will refund any prepaid amount for the remaining period.

We put written terms in place with each sub-processor that give at least the same level of protection as this DPA, and we remain responsible for them.

• Encryption in transit (HTTPS/TLS) for all connections.
• Passwords stored only as secure hashes; optional two-factor authentication for users and required two-factor authentication for our staff panel.
• Each customer's data is separated in the application; access is limited by role.
• Staff access to customer data is limited to what is needed for support and operations, and it is logged.
• Regular backups, and monitoring of the systems.
• Rate limits and other protections against abuse.

We may update these measures as long as the overall level of protection does not decrease.

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within 72 hours. We will give you the information we have about what happened, the data affected, its likely consequences and what we are doing about it, and we will keep you updated.

Our servers are in the European Union. Some sub-processors, for example AI model providers, may process data outside the UK and the EU. Where this happens, we rely on adequacy decisions where available, or on the European Commission's standard contractual clauses and the UK International Data Transfer Addendum, together with additional safeguards where needed.

We will answer your reasonable written questions about our data protection practices. If that is not enough to show compliance, or if an authority requires it, you may carry out an audit, or have an independent auditor bound by confidentiality do so, at most once a year, with at least 30 days' notice, during business hours and at your own cost.

While your account is active, you can export your visitors' data from the panel and delete conversations and visitors. Data is also deleted automatically according to the retention period you set.

When your account is closed, we delete your personal data within 30 days, unless the law requires us to keep it. Backups are overwritten in their normal cycle, within a further 30 days.

The limits of liability in the terms of service apply to this DPA. If this DPA and the terms of service conflict on the processing of personal data, this DPA takes precedence.

This DPA is governed by the same law as the terms of service.