Data Processing Agreement

DRAFT — pending legal review. This is the structure of the Art. 28 GDPR data processing agreement offered to every EU workspace. It has not been written or approved by counsel and must not be relied on until it is replaced by a reviewed version.

1. Parties and scope

This agreement is between the workspace owner's organisation (the "customer", controller) and [ZETT legal entity — to be confirmed by counsel] (the "processor"). It applies to personal data the processor handles on the customer's behalf in the EU region.

2. Subject matter, nature and purpose

The processor hosts and processes workspace data to provide ZETT: storage, collaboration, client portal, video review, notifications, invoicing helpers, automations and AI-assisted features.

3. Categories of data and data subjects

• Data subjects: the customer's team members, clients and their contacts, leads, collaborators.
• Data: contact details, project and commercial data, files and media, messages, comments and portal activity.

[Counsel: special categories, if any.]

4. Processor obligations

• Process only on documented instructions from the customer.
• Ensure that people authorised to process the data are bound by confidentiality.
• Apply the security measures in section 6.
• Assist the customer with data subject requests and with Art. 32–36 obligations.
• Delete or return data at the end of the service, as set out in section 9.

[Counsel: complete Art. 28(3) wording.]

5. Sub-processors

The customer authorises the sub-processors in the sub-processor list. [Counsel: notice period and objection right for new sub-processors.]

6. Security measures

[Counsel and engineering: technical and organisational measures, e.g. tenant isolation with row-level security, encryption in transit, encrypted backups in the EU, access control and logging.]

7. International transfers

Workspace data is stored in the European Union. Video review content may be processed outside the EEA by Cloudflare (video transcoding and delivery). AI features may send prompts to model providers configured for the EU region. [Counsel: transfer mechanisms (SCCs, EU-US Data Privacy Framework) and model provider retention terms.]

8. Personal data breaches

[Counsel: notification without undue delay, content of the notice, cooperation.]

9. Deletion and return

[Counsel: export options, deletion timeline, backups retention.]

10. Audits

[Counsel: information and audit rights.]

11. Acceptance

The workspace owner accepts this agreement for the workspace when creating it, or in workspace settings. The version and time of acceptance are recorded.