Data Processing Agreement.

1. When it applies

This Data Processing Agreement ("DPA"), made under Article 28 of Regulation (EU) 2016/679 (GDPR), is part of the Zen Staff Terms and conditions and applies automatically to customers of the Hosted plan and the always-on server. On the Personal and Self-host plans we process no company data: it stays on your own computers and servers.

2. Parties and roles

• The Customer (the company using the Hosted plan) is the controller: it decides what data goes into the hub and for what purpose.
• FORTITUDO VINCIT S.R.L., tax ID 43990858, J2021000522266, is the processor: it processes the data only on the Customer's behalf and instructions.

3. Subject matter, duration, nature and purpose

• Subject matter: hosting the Zen Staff hub and company memory, relaying shared chats, tasks and approvals, client approval links, the company's always-on server.
• Duration: while the Customer has a Hosted plan or always-on server, plus the deletion period in the termination section.
• Nature: storage, encrypted transmission, search in company memory, extraction of facts from conversation summaries, backup and restore, deletion.
• Purpose: solely providing the Service to the Customer.

4. Data categories and data subjects

• Data subjects: the Customer's users (employees, contractors), its clients, suppliers and other contacts who appear in the content.
• Data categories: identification and contact data (name, e-mail, phone, company, role), account and device data, the audit log, shared chat content (end-to-end encrypted), summaries and facts in company memory, files sent for approval and the answers to them.
• The Customer does not put special categories of data (Art. 9 GDPR) into the hub unless it has a legal basis and has assessed the risk.

5. Our obligations

• We process data only on the Customer's documented instructions; the Terms, this DPA and the hub settings are those instructions. If an instruction seems unlawful to us, we tell the Customer.
• People with access to the data are bound by confidentiality.
• We apply the technical and organisational measures in Annex 2.
• We help the Customer answer data-subject requests (access, erasure, export) and, on request, with data protection impact assessments and prior consultation of the authority.
• We make available the information needed to demonstrate compliance with Article 28 and allow reasonable audits, announced at least 30 days in advance, at most once a year, at the Customer's cost, without access to other customers' data.

6. Sub-processors

The Customer gives us prior general authorisation to use the sub-processors in Annex 1. Each is bound by a contract with data protection obligations at least as strict as these. We announce any new or replaced sub-processor at least 30 days in advance by e-mail. The Customer may object within that period on reasonable grounds; if we cannot find a solution, the Customer may end the plan without penalty. We remain liable to the Customer for our sub-processors.

7. International transfers

Hub and memory data are stored in Germany. When a sub-processor processes data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework (where the provider is certified) or on the European Commission's Standard Contractual Clauses.

8. Personal data breaches

We notify the Customer without undue delay and within 48 hours at most of becoming aware of a security breach affecting its data. The notice covers, as far as we know them: what happened, the categories and approximate number of people and records affected, the likely consequences, the measures taken and recommended, and a contact person. We complete the information as we learn more.

9. Deletion or return on termination

When the plan ends, the Customer can export its hub data. Within 30 days of termination we delete the Customer's data from the hub and company memory, except what the law requires us to keep (such as invoices). Backup copies are deleted as backups rotate, within 12 months at the latest, and are used in the meantime only for restoring. On request we confirm deletion in writing.

10. How to sign

For Hosted customers the DPA applies on accepting the Terms, with no further step. If you need a signed copy for your records, write to [email protected] with your company name and tax ID and we will send it.

11. Annex 1: sub-processors

12. Annex 2: technical and organisational measures

• Agent permissions and approvals: an agent can do only what the person who started it may do; anything leaving the company (e-mail, file, order) waits for a person's approval. Approvals are on by default.
• Roles and access: Owner, Admin, Member, Guest and custom roles, per team and project; rights per data type and per action.
• Isolation between companies: one AES-256 encryption key for each company's memory; requests signed per company and refused for any other company; on Enterprise, a separate database.
• Audit log: append-only, each row cryptographically chained to the previous one, so a change or deletion shows up on verification; search, CSV or JSON export and forwarding to a SIEM.
• Backups: every night at 03:30, encrypted before leaving the server, kept 30 days plus one copy per month for 12 months, in Cloudflare R2, Western Europe region; restore tested, with an alert if a night's backup is missing.
• Authentication: two-step verification mandatory for owners and admins, passkeys, approval of new devices on the company server, remote session sign-out.
• Shared chats: end-to-end encrypted; the hub sees only ciphertext. Each request is signed by the device that sends it.
• Prompt injection: outside e-mails and documents are treated as data, not instructions; flags for hidden text, misleading links and unverified senders; approval for anything leaving the company.
• No tokens for the Customer's apps: connections to Gmail, Drive and others stay in the Customer's AI account or in the encrypted vault on its own server.
• EU hosting: Hetzner servers in Germany.
• Said plainly: on the hosted plan the server disk is not encrypted; backups are. Facts extracted into company memory are stored unencrypted in the search database so they can be found, and are protected by access control.

The full description, with examples: Security.