Data Processing Addendum

1. Definitions#

Data Protection Law

all laws on privacy and personal data that apply to the processing of Customer Personal Data under the Agreement, including the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act (as amended) and other US state privacy laws, and any laws implementing or replacing them.

GDPR

Regulation (EU) 2016/679. UK GDPR means the GDPR as it forms part of the law of the United Kingdom.

Customer Personal Data

personal data in Customer Content, including End User Data, that Zentiq processes on the Customer's behalf under the Agreement.

Personal Data Breach

a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data held by Zentiq or its Sub-processors.

Sub-processor

a third party that Zentiq engages to process Customer Personal Data.

SCCs

the standard contractual clauses for transfers of personal data to third countries approved by the European Commission in Implementing Decision (EU) 2021/914.

UK Addendum

the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0), as amended from time to time.

Restricted Transfer

a transfer of Customer Personal Data that would be prohibited by Data Protection Law without a transfer mechanism such as the SCCs or the UK Addendum.

"Controller", "processor", "data subject", "personal data", "processing", "business", "service provider" and "sell" and "share" have the meanings given in the applicable Data Protection Law.

2. Roles and scope#

• The Customer is the controller of Customer Personal Data (or, where it acts for another controller, a processor), and Zentiq is its processor (or sub-processor) and service provider.
• Zentiq is an independent controller, and not the Customer's processor, for the personal data it processes to manage the Customer's account and billing, to secure the Service and prevent misuse, to verify consent for faces and voices, to comply with the law, and to create aggregated or de-identified information about how the Service is used. Our Privacy Policy covers that processing.
• The subject matter, nature, purpose and duration of the processing, and the types of personal data and data subjects, are set out in Annex 1.

3. Processing on the Customer's instructions#

• Zentiq will process Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise, in which case Zentiq will tell the Customer before processing unless the law prohibits that.
• The Customer's instructions are the Agreement, this DPA, the Customer's settings and use of the Service (for example the recording, retention, camera and data capture settings it chooses), and any other reasonable written instructions consistent with the Agreement.
• Zentiq will tell the Customer if, in its opinion, an instruction infringes Data Protection Law. Zentiq may suspend the affected processing until the instruction is confirmed or changed.

4. The Customer's obligations#

The Customer is responsible for the lawfulness of the processing it instructs. In particular, the Customer will:

• have a lawful basis for the processing and give data subjects the information Data Protection Law requires, including about Zentiq's processing;
• obtain every consent the law requires, including consent to record or transcribe conversations, written releases under biometric privacy laws before a person's face or voice is used, verifiable parental consent or school authorisation for children, and the notices and consents required for AI interviews;
• choose settings that are lawful for its End Users, including switching off features that infer emotions of people at work or in education where the law prohibits that;
• not submit special categories of personal data, criminal offence data, health records or payment card data, except where a feature expressly requires it and the law allows it; and
• handle requests from data subjects, with Zentiq's help as described below.

5. Confidentiality and security#

• Zentiq will ensure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, and will give access only to those who need it.
• Zentiq will implement and maintain the technical and organisational measures in Annex 2. Zentiq may update them, provided the overall level of protection is not reduced.

6. Sub-processors#

• General authorisation. The Customer authorises Zentiq to engage Sub-processors. The categories, purposes and locations are listed on our Sub-processors page. The current list of named Sub-processors is available to customers on request at privacy@zentiqai.com.
• Notice of changes. Zentiq will notify the Customer at least 30 days before a new Sub-processor starts processing Customer Personal Data, by email to the Customer's account owners or through the Service. If Zentiq must replace a Sub-processor urgently to keep the Service running or secure, it will notify the Customer as soon as reasonably possible, and the objection right below still applies.
• Objection. The Customer may object to a new Sub-processor on reasonable data protection grounds by emailing privacy@zentiqai.com within the notice period. The parties will discuss the objection in good faith. If Zentiq cannot offer a reasonable alternative within 30 days, the Customer may terminate the affected part of the Service by notice and receive a refund of prepaid fees for the unused part of its billing period. This is the Customer's only remedy for an objection.
• Flow-down. Zentiq will impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains responsible to the Customer for its Sub-processors' performance of those obligations.

7. Data subject requests#

Taking into account the nature of the processing, Zentiq will help the Customer, by appropriate technical and organisational measures and as far as possible, to respond to requests from data subjects to exercise their rights. The Service includes tools for this, such as exports, a copy of a candidate's data, erasure of candidate data and removal of visitor details. If Zentiq receives a request directly, it will pass it to the Customer without undue delay and will not respond itself, except to tell the person that it has done so. Zentiq may charge reasonable costs for help that goes beyond these tools, where the law allows.

8. Personal Data Breaches#

• Zentiq will notify the Customer of a Personal Data Breach without undue delay after becoming aware of it, and will aim to do so within 48 hours.
• The notice will describe, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences and the measures taken or proposed. Zentiq will provide further information as it becomes available.
• Zentiq will take reasonable steps to contain and remedy the breach, and will cooperate with the Customer's reasonable requests for help in meeting its own obligations to notify authorities and data subjects.
• A notification is not an admission of fault or liability.

9. Impact assessments and AI transparency#

• Zentiq will give the Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to Zentiq.
• As the provider of the AI system behind the Service, Zentiq will give the Customer the information it reasonably needs about how the Service works, its capabilities and limitations, and the safeguards available in it, so that the Customer can meet its own obligations as a deployer of AI, including transparency to End Users and human oversight of decisions.

10. Information and audits#

• Zentiq will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR, including by answering a reasonable security questionnaire once a year.
• If that information is not sufficient, or a supervisory authority requires it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality who is not a competitor of Zentiq, on at least 30 days' written notice, no more than once in any 12 months (unless after a Personal Data Breach or at a supervisory authority's request), during normal business hours and in a way that does not disrupt the Service or put other customers' data at risk. Audits are carried out remotely where possible, and at the Customer's cost.

11. International transfers#

Zentiq and its Sub-processors process Customer Personal Data in the United States, Singapore and Canada, and live audio and video may be routed through servers in other countries, including in the European Union, to reduce delay. Zentiq will make Restricted Transfers only in accordance with this section.

Transfers from the European Economic Area#

To the extent the Customer's transfer of Customer Personal Data to Zentiq is a Restricted Transfer under the GDPR, the SCCs are incorporated into this DPA by reference and apply as follows: Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) applies where the Customer is a processor; the Customer is the data exporter and Zentiq is the data importer; the optional docking clause in Clause 7 applies; Option 2 (general written authorisation) of Clause 9(a) applies, with the notice period set out in Sub-processors; the optional wording in Clause 11(a) does not apply; in Clause 17 the SCCs are governed by the law of Ireland; in Clause 18(b) disputes are resolved by the courts of Ireland; and Annexes I, II and III of the SCCs are completed by Annex 1, Annex 2 and Annex 3 of this DPA.

Transfers from the United Kingdom#

To the extent the transfer is a Restricted Transfer under the UK GDPR, the UK Addendum is incorporated into this DPA by reference: Table 1 is completed with the parties' details in Annex 1; Table 2 refers to the SCCs as they apply under this section; Table 3 is completed by Annexes 1 to 3 of this DPA; and in Table 4 either party may end the UK Addendum as set out in its Section 19.

Transfers from Switzerland#

To the extent the transfer is a Restricted Transfer under Swiss law, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers; references to the GDPR include the Swiss Federal Act on Data Protection; and the term "member state" does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

Onward transfers and changes in the law#

Zentiq will ensure that transfers to its Sub-processors are protected by the SCCs, the UK Addendum, an adequacy decision or another mechanism recognised by Data Protection Law. If a transfer mechanism is invalidated or replaced, the parties will work together to put an alternative in place. If there is a conflict between the SCCs or the UK Addendum and the rest of this DPA or the Agreement, the SCCs or the UK Addendum prevail.

12. US state privacy laws#

Where the California Consumer Privacy Act or another US state privacy law applies, Zentiq acts as the Customer's service provider or processor and:

• processes Customer Personal Data only for the business purposes of providing, securing and supporting the Service, as set out in the Agreement;
• will not sell or share Customer Personal Data, or use it for targeted or cross-context behavioural advertising;
• will not retain, use or disclose it for any purpose other than those business purposes, or outside the direct business relationship with the Customer, except as the law permits;
• will not combine it with personal data received from others or collected from its own interactions with individuals, except as the law permits;
• will comply with the law's obligations and provide the same level of privacy protection the law requires, and will notify the Customer if it determines it can no longer meet them;
• permits the Customer, on reasonable notice, to take reasonable and appropriate steps to stop and remediate any unauthorised use of Customer Personal Data;
• will keep any de-identified data in de-identified form and will not attempt to re-identify it; and
• certifies that it understands and will comply with these restrictions.

13. Schools, students and children#

• Where the Customer is an educational agency or institution in the United States, Zentiq acts as a school official with a legitimate educational interest, under the Customer's direct control as to the use and maintenance of education records, and will use education records only to provide the Service to the Customer and will not re-disclose them except as the Customer authorises or the law requires.
• Where a school authorises the collection of personal data from children under 13 in place of their parents, Zentiq relies on that authorisation only for the school's educational purposes and never for any commercial purpose.
• Zentiq will not use students' or children's personal data for targeted advertising, will not sell it, and will not build profiles of students except to provide the educational service the Customer uses.
• Zentiq will support the Customer in meeting any additional obligations under state student privacy laws, where the Customer tells Zentiq which apply.

14. Faces, voices and biometric data#

• The Customer is responsible for informing each person whose face or voice it submits, and for obtaining their written consent or release as required by biometric privacy laws, before submitting it.
• Zentiq will process face and voice data only to create and run the Customer's avatars and voices, will not use it to identify anyone, and will not sell, lease, trade or otherwise profit from it.
• Zentiq will destroy face and voice data in accordance with the retention and destruction schedule in its Privacy Policy.

15. Return and deletion#

• During the term, the Customer can export and delete Customer Personal Data using the tools in the Service, and can ask Zentiq to delete specific data, which Zentiq will do within 30 days.
• For 30 days after the Agreement ends, the Customer may retrieve Customer Personal Data as described in the Terms. Zentiq will then delete Customer Personal Data within a further 60 days, unless the law requires Zentiq to keep it. Copies in backups are deleted as those backups expire and, until then, are protected and not otherwise used.
• On request, Zentiq will confirm the deletion in writing.

16. Liability, term and precedence#

• Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Law or the SCCs do not allow such limitation, including as regards the rights of data subjects under the SCCs.
• This DPA applies for as long as Zentiq processes Customer Personal Data.
• If there is a conflict, the following order applies: the SCCs and the UK Addendum; then this DPA; then the rest of the Agreement.

17. Annex 1: Details of the processing#

A. The parties#

Data exporter

the Customer, as identified in its account or order. Activities: using the Service to create and deploy AI avatars for its End Users. Role: controller (or processor). Signature and date: the Customer's acceptance of the Agreement.

Data importer

Zentiq. Contact: privacy@zentiqai.com. Activities: providing the Service. Role: processor (or sub-processor). Signature and date: Zentiq's acceptance of the Agreement.

B. Description of the processing#

Categories of data subjects

The Customer's Authorised Users; its End Users, such as learners, employees, website visitors, job candidates and students (who may include children where the Customer is a school, tutoring service or family); and people whose face or voice is used to create an avatar or voice.

Categories of personal data

Identity and contact details; account and usage data; live audio of conversations (processed in real time, not stored); conversation transcripts, summaries, scores, reports and certificates; for job interviews, answers, ratings, reviewers' notes and decisions and, where the Customer turns recording on, audio and video recordings; contact details and requests that visitors choose to give; safety flags; photos, video and voice recordings used to create avatars and voices; consent records; and on-device camera observations (descriptions or measurements, not video).

Sensitive data

The Customer does not intend to submit special categories of data. Conversations may reveal such data if End Users choose to share it. Face and voice data is used to generate avatars and voices, not to identify people. Safeguards: the measures in Annex 2, strict access controls and the deletion commitments in this DPA.

Frequency

Continuous, for as long as the Customer uses the Service.

Nature of the processing

Collection, storage, real-time speech recognition, language processing and voice and video generation, transcription, analysis and scoring as configured by the Customer, safety checks, display to the Customer's authorised users, transmission to Sub-processors, and deletion.

Purpose

Providing, securing and supporting the Service for the Customer under the Agreement.

Retention

For the term of the Agreement, then as set out in Return and deletion. Within the term, data is kept according to the Customer's settings: job interview data is deleted automatically at the end of the period the Customer sets for each role; for other conversation data, automatic deletion at the end of the chosen period is not yet switched on, so it is kept until the Customer deletes it or asks Zentiq to delete it. Face and voice data follows the schedule in our Privacy Policy.

Transfers to Sub-processors

For the purposes, and in the categories and locations, listed on our Sub-processors page, for the duration of the Agreement.

C. Competent supervisory authority#

The supervisory authority of the EU member state in which the Customer is established. If the Customer is not established in the EU but falls under the GDPR, the supervisory authority of the member state in which its EU representative is established or, if it has none, of the member state where the relevant data subjects are. For the UK, the Information Commissioner's Office; for Switzerland, the Federal Data Protection and Information Commissioner.

18. Annex 2: Technical and organisational security measures#

19. Annex 3: Sub-processors#

The categories, purposes and locations of Zentiq's Sub-processors are listed on our Sub-processors page, which forms part of this Annex. The named list is available to customers on request at privacy@zentiqai.com, and changes are notified as set out in Sub-processors.