Data Processing Agreement (DPA)

1. Roles and scope

This DPA applies when a customer uses Zoveto to process personal data under applicable data protection law. Unless otherwise agreed in writing:

• Customer acts as the data controller (or business).
• Zoveto acts as the data processor (or service provider).

2. Processing instructions

Zoveto processes personal data only on documented customer instructions, including configuration and user actions performed by authorized customer users in the Service.

3. Data handling commitments

• Process data for service delivery, support, reliability, and security operations.
• Ensure personnel access is limited to need-to-know and bound by confidentiality obligations.
• Assist customers with reasonable requests related to data subject rights handling.

4. Security measures

• Encryption in transit (TLS) and encryption at rest for core production systems.
• Role-based access controls and authentication controls for internal systems.
• Logging and monitoring for operational and security events.
• Backup and recovery controls aligned to service reliability needs.

5. Subprocessors

Customer authorizes use of subprocessors required to deliver the Service. Current subprocessors are listed at /subprocessors. Zoveto remains responsible for subprocessors used for processing under this DPA.

6. Incident and breach notification

If Zoveto becomes aware of a confirmed personal data breach affecting customer data, Zoveto will notify the customer without undue delay and provide available information necessary for customer response obligations.

7. International transfers

Where personal data is transferred across borders, Zoveto applies contractual and technical safeguards required by applicable law.

8. Return and deletion

On account termination, customer data is returned or deleted according to service functionality, retention policy, and legal obligations, unless retention is required by law.

9. Related policies

• Privacy Policy
• Terms of Service
• Security & Data Protection
• Subprocessors

10. Contact

DPA and enterprise privacy requests: privacy@zoveto.com