Data processing addendum

This data processing addendum (“DPA”) forms part of the Terms of service or other written agreement (the “Agreement”) between Zerqano LLC (“Zerqano”) and the customer, and applies automatically whenever Zerqano processes personal data on the customer’s behalf. No signature is needed. If this DPA and the Agreement disagree about personal data, this DPA wins. For a countersigned copy, email legal@zerqano.com.

Customer personal data

Personal data in the data the customer and its users put into the Zerqano service.

Data protection law

The laws that apply to processing customer personal data, which can include the EU GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act.

Subprocessor

A third party Zerqano engages that processes customer personal data.

Security incident

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, customer personal data.

The customer is the controller of customer personal data, or a processor for its own clients, and Zerqano is its processor or subprocessor. Zerqano is a separate controller of account, billing, security and usage data, as the Privacy policy describes. The customer is responsible for having a lawful basis for the data it puts into the service and for the instructions it gives.

Zerqano processes customer personal data only to provide the service under the Agreement, on the customer’s documented instructions (the Agreement, this DPA, and the customer’s use of the service’s settings), or where the law requires it, in which case Zerqano tells the customer first unless the law forbids it. The customer’s documented instructions include transfers to the subprocessors and locations in this DPA. Zerqano does not sell customer personal data and does not use it for its own purposes, other than creating aggregated and de-identified statistics as the Agreement allows. Zerqano does not use it to train general-purpose AI models or models that serve other customers; models fitted to the customer’s data to produce its results are part of the service. Zerqano tells the customer if it believes an instruction breaks data protection law.

Subject matter and purpose

Providing the Zerqano service: storing the customer’s catalog, sales, stock, supplier and order data, analysing it, answering questions with AI models, reading documents, and drafting purchase orders and other actions for the customer to review.

Duration

The term of the Agreement, and until deletion under section 13.

Data subjects

The customer’s users; its employees; its suppliers’ contacts; its own customers, including individual consumers where it sells to them.

Categories of personal data

Names, email addresses, phone numbers, job roles, postal, shipping and billing addresses, order and purchase history, the contents of invoices and other uploaded documents (which may include bank details and tax identifiers), messages sent to the assistant, assistant memories, sign-in and device data.

Special categories

None are needed for the service, and the customer agrees not to upload them.

Zerqano lets only people who need access to run and support the service process customer personal data, and each is bound to keep it confidential.

Zerqano keeps these measures: encryption in transit (TLS 1.2 or higher); encryption at rest by the database provider; encryption of stored connection credentials; separation of customers by organization ID in the API and database; role-based access for users; rate limits; error monitoring; and review of subprocessors. The Security page describes them further. Zerqano may change these measures if the overall level of protection does not go down.

The customer authorizes Zerqano to use the subprocessors listed on the Subprocessors page. Zerqano puts a written agreement in place with each one with data protection terms no less protective than this DPA, and is responsible for their work.

Zerqano tells the customer’s organization owners by email at least 30 days before adding or replacing a subprocessor. The customer may object on reasonable data protection grounds within that time; if the parties cannot resolve it, the customer may end the affected part of the service and receive a refund of prepaid fees for the unused period.

If Zerqano receives a request from an individual about customer personal data, it passes the request to the customer and does not answer it itself unless the customer asks. Zerqano helps the customer answer such requests, taking into account the nature of the processing.

Zerqano notifies the customer without undue delay, and in any case within 72 hours, after becoming aware of a security incident. The notice describes, as far as known, what happened, the data and people affected, the likely consequences, and the steps taken. Zerqano updates the customer as it learns more and helps it meet its own notification duties.

Zerqano gives the customer reasonable help with data protection impact assessments and consultations with authorities that concern the service, using the information available to Zerqano.

Zerqano and most of its subprocessors process data in the United States. Where data protection law restricts a transfer of customer personal data to Zerqano, the following are incorporated by this reference.

• EEA: the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914, Module Two where the customer is a controller and Module Three where the customer is a processor. Clause 7 applies. Clause 9(a) Option 2 applies, with the notice period in section 8. The optional wording in Clause 11 does not apply. Under Clause 17 Option 1 the law of Ireland governs, and under Clause 18(b) the courts of Ireland have jurisdiction. Annex I is completed from sections 1, 5 and 17 of this DPA and the customer’s order form or account details, with the supervisory authority identified under Clause 13. Annex II is section 7 of this DPA. Annex III is the Subprocessors page.
• UK: the International Data Transfer Addendum, version B1.0, issued by the UK Information Commissioner, completed from the same information. Neither party may end it under its section 19.
• Switzerland: the clauses above, with references to the GDPR read as the Swiss Federal Act on Data Protection, the Swiss FDPIC as supervisory authority, and Switzerland treated as a Member State for Clause 18(c).

These clauses prevail over this DPA and the Agreement if they conflict. If a mechanism stops being valid, the parties will adopt a valid replacement in good faith, and the customer may end the affected service if none is available within a reasonable time.

When the Agreement ends, or earlier on the customer’s written request, Zerqano makes customer personal data available for export for 30 days. Within 30 days after that, Zerqano deletes it from the database, file storage and search indexes. Copies in any backups are overwritten within the backup retention period. Zerqano keeps limited records, such as invoices and security logs, only for the periods in the Privacy policy or where the law requires, keeps them confidential and does not otherwise use them. Zerqano confirms deletion in writing on request.

Zerqano makes available the information reasonably needed to show that it meets this DPA, and answers the customer’s reasonable security questionnaires. Where that is not enough, the customer may audit Zerqano’s processing once a year, on at least 30 days’ written notice, during business hours, at its own cost, and under a confidentiality agreement, in a way that does not expose other customers’ data. The once-a-year limit does not apply where a supervisory authority requires an audit, or after a security incident affecting customer personal data.

For personal information subject to the California Consumer Privacy Act, Zerqano is a service provider. The customer discloses it only for the limited and specified purposes in section 5. Zerqano will: (a) not sell or share it; (b) not retain, use or disclose it for any other purpose, including any other commercial purpose, except as the CCPA allows; (c) not retain, use or disclose it outside the direct business relationship with the customer; (d) not combine it with personal information from other sources, except as the CCPA regulations allow; (e) comply with the CCPA and give the level of privacy protection it requires; (f) let the customer take reasonable steps to ensure Zerqano uses the information consistently with the customer’s CCPA obligations; (g) tell the customer within five business days if it can no longer meet those obligations; (h) let the customer, on notice, take reasonable steps to stop and fix unauthorized use; and (i) help the customer respond to consumer requests. Subprocessors are bound by the same terms.

Each party’s liability under this DPA and the Standard Contractual Clauses, as between the parties, is subject to the limits in the Agreement. Nothing limits a data subject’s rights under those clauses. This DPA lasts as long as Zerqano processes customer personal data for the customer.

Zerqano LLC, an Illinois limited liability company. Data protection questions: privacy@zerqano.com. Notices: legal@zerqano.com.