1. Application and precedence
Zavia is operated by Global Data Intelligence Limited, a company registered in England and Wales under company number 09410808. Our registered office is Artisans’ House, 7 Queensbridge, Northampton, Northamptonshire, United Kingdom, NN4 7BF. Contact us at info@zavia.ai.
This Data Processing Addendum (DPA) applies only where incorporated into an accepted written customer agreement together with an agreed processing schedule. Publication of this page does not execute a DPA or approve an international transfer. A customer-specific signed DPA prevails over this standard version. Mandatory transfer clauses take precedence where they conflict.
“Customer Data” means personal data submitted to Zavia for processing solely on the customer’s instructions. “Applicable Data Protection Law” means UK GDPR, the Data Protection Act 2018 as amended, and EU GDPR where applicable. Controller, processor, personal data, processing and personal data breach have the meanings given by that law.
2. Processing scope and instructions
The order and processing schedule must identify the parties and privacy contacts; subject matter and duration; service purpose and operations; data categories and affected individuals; approved locations and subprocessors; security measures; retention and deletion arrangements; and any transfer mechanism. A schedule may restrict the service’s standard capabilities. Processing outside that agreed scope is not authorised.
Typical instructed activities include storing, organising, retrieving, displaying, exporting and deleting customer-submitted company research, notes, supporting documents and monitoring instructions. The customer determines the purpose, users, records and lawful instructions. Sensitive or criminal-offence data is excluded unless expressly agreed with the required legal conditions and safeguards.
Compiling our own company intelligence, administering customer accounts, billing and protecting the service are separate controller activities described in the Privacy Policy. They are not automatically converted into processor activities by this DPA.
3. Customer and processor responsibilities
The customer must provide lawful, documented instructions and comply with its own obligations for collection, transparency, accuracy and permitted disclosures. Zavia will process Customer Data only on those instructions, including for transfers, unless applicable law requires otherwise. Where permitted, Zavia will inform the customer of a legal requirement before processing.
Zavia will promptly inform the customer if an instruction appears to breach Applicable Data Protection Law and may pause the affected processing while the parties resolve it. Customer Data will not be used for an independent advertising, resale or general-purpose model-training purpose under this DPA.
4. Confidentiality and security
Zavia will restrict access to people who need it for the instructed service and are subject to confidentiality obligations. Zavia will maintain technical and organisational measures appropriate to the risk, including access management, protection of data in transit, secure credential handling, incident response, recovery arrangements and regular evaluation of the effectiveness of relevant safeguards.
The agreed security schedule must describe the measures applicable to the deployment, including any encryption at rest, access logging, backup, recovery, personnel and deletion controls. Zavia will not materially reduce the agreed overall protection during the term. This clause is a contractual commitment, not a representation that every deployment has a particular certification or residency configuration.
5. Subprocessors
Zavia may engage a subprocessor for Customer Data only with the customer’s prior specific or general written authorisation. The initial authorised list, legal entities, functions and locations must be included or identified in the processing schedule. Our general website supplier description does not substitute for that list.
Under general authorisation, Zavia will give at least 30 days’ advance notice of an intended addition or replacement so the customer can raise a reasonable data-protection objection. The parties will work to resolve the objection; if they cannot, the affected processing will not proceed through the proposed provider and the parties may terminate that affected service with a refund of unused prepaid fees.
Zavia will impose equivalent applicable data-protection obligations on each subprocessor and remain responsible to the customer for that subprocessor’s performance of them.
6. International transfers
Restricted transfers of Customer Data require documented customer instructions and a valid mechanism under Applicable Data Protection Law. The schedule must identify applicable adequacy coverage or executed transfer clauses, including the correct parties, modules, annexes, competent authority and UK adaptation where required. The parties will complete required transfer assessments and supplementary measures.
This DPA is not itself an EU Standard Contractual Clause, UK Addendum or International Data Transfer Agreement. Such instruments must be separately completed and incorporated where needed before the restricted transfer.
7. Assistance and individual requests
Taking account of the processing and information available, Zavia will provide reasonable assistance with individual rights, security obligations, data protection impact assessments and consultations with supervisory authorities. If a request concerning Customer Data is received directly, Zavia will promptly pass it to the customer and will not respond substantively without instructions unless law requires.
The parties will agree practical support procedures. Any agreed reasonable charges for exceptional assistance must not prevent either party from meeting mandatory legal obligations.
8. Personal data breaches
Zavia will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Data. The notice will describe available facts about the incident, affected categories and approximate scale, likely consequences, mitigation and a contact for follow-up. Information may be supplied in stages as the investigation progresses.
Zavia will take reasonable steps to contain, investigate and remediate the incident, preserve relevant evidence and assist the customer’s required notifications. The customer remains responsible for its controller decisions about notifying authorities and individuals; Zavia will not delay its notice until an investigation is complete.
9. Return and deletion
At the end of the instructed services, Zavia will, at the customer’s choice, return Customer Data in an agreed usable format or securely delete it, and delete remaining copies unless applicable law requires retention. The schedule sets the export window, deletion process and backup cycle. Retained copies must remain protected and used only for the legally required purpose.
Where immediate removal from a protected backup is technically impracticable, the data will be put beyond routine use and removed under the agreed backup deletion cycle. Zavia will confirm completion of its agreed deletion obligations on request.
10. Evidence, audits and liability
Zavia will make available information needed to demonstrate compliance with its processor obligations and allow and contribute to audits and inspections by the customer or an independent auditor bound by confidentiality. Reasonable notice, scope and security arrangements may protect other customers and avoid unnecessary disruption, but must not defeat a legally required audit or regulator access.
The main agreement’s liability terms apply to the extent lawful. They do not restrict individuals’ statutory rights, supervisory authorities’ powers or mandatory provisions of applicable transfer clauses. Request the deployment-specific processing schedule and DPA at info@zavia.ai before submitting data that requires processor terms.
Request a DPA and processing schedule