Data Processing Addendum

This is a first draft written to build the required protections into the product. It has not yet been reviewed by an attorney and will be before ZARA takes paying customers.

When a business uses ZARA with its own customers’ data, the business is the controller and ZARA OS is the processor. We will:

• process personal data only on the business’s documented instructions and to provide the service;
• keep it confidential and secure, and require the same of our subprocessors;
• help the business answer access, export and deletion requests;
• notify the business without undue delay of a personal-data breach;
• delete or return the data when the service ends, unless the law requires we keep it.

[Attorney to finalize: SCCs for international transfers, audit rights, sub-processor change notice period.] A signed copy is available on request: (support email not yet published — pre-launch).