Legal
Data Processing Agreement
The GDPR Article 28 agreement under which we process your organization’s content on your behalf. It applies as part of the Terms of Service — nothing to sign.
Last updated 11 August 2026
In plain language
01 Scope and roles
This Data Processing Agreement forms part of the Terms of Service between [FULL_NAME], sole trader (autónomo) registered in Spain, tax ID [NIF], address [ADDRESS] (“the processor”, “we”) and the customer organization (“the controller”, “you”). It applies to all personal data contained in the content your organization stores or processes in the zeypm service — data about your team members, collaborators, clients and anyone else appearing in that content. For account and billing data, where we act as controller, the Privacy Policy applies instead of this agreement.
02 Subject matter, duration, nature and purpose
The subject matter is the provision of the zeypm work platform: hosting, storing, transmitting, displaying, backing up and otherwise processing the content your organization puts into its projects, and — when a member of your organization invokes an AI feature — sending the relevant content to our AI sub-processor to produce the requested result. Processing lasts for as long as your organization uses the service, plus the deletion timelines in section 09. Data subjects include your staff, collaborators, client contacts, and any individuals mentioned in your content. The categories of data are those your organization chooses to put in — the service neither requires nor is intended for special categories of data, and you agree not to store them unless you have a lawful basis to do so.
03 Processing on your instructions
We process personal data in your organization’s content only on your documented instructions. Your instructions are: the Terms of Service, this agreement, your organization’s configuration of the service (which modules each project enables, who has access, what client accounts can see), and the actions your users and connected agents take in the product. We will not process that data for any other purpose, and we will tell you if we believe an instruction conflicts with the GDPR — unless the law prevents us from doing so.
04 Confidentiality
Access to your organization’s data is limited to what operating the service requires. The service is operated by its owner; any person we ever authorize to access personal data will be bound by a contractual or statutory duty of confidentiality before access is granted.
05 Security
We implement the technical and organisational measures described in the Privacy Policy’s Security section: encryption in transit, encryption at rest by our storage providers, per-organization isolation enforced by access controls on every request, module-level and client-visibility rules within projects, two-factor authentication, least-privilege operational access, and encrypted backups with automatic roll-off. We review these measures as the service evolves and will not reduce the overall level of protection during your subscription.
06 Sub-processors
You give general written authorization for the sub-processors listed at /subprocessors, which states each provider’s role, processing location and transfer mechanism. We will announce any addition or replacement at least 30 days before it takes effect, in the app or by email. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may terminate the affected subscription and the export window in section 09 applies. Every sub-processor is bound by a data processing agreement imposing obligations equivalent to this one.
07 Assistance
Taking into account the nature of the processing, we assist you in fulfilling your obligations as controller: we provide the product’s export and access capabilities so you can answer data subject requests, we forward to you any request we receive that concerns your organization’s data, and we provide reasonable information for your data protection impact assessments and consultations with supervisory authorities. If we become aware of a personal data breach affecting your organization’s data, we will notify you without undue delay with what we know, the likely consequences, and the measures taken or proposed.
08 International transfers
Application data is stored at rest in the United Kingdom (AWS eu-west-2, London), covered by the European Commission’s adequacy decision for the UK, valid to 27 December 2031. Where a sub-processor processes data in the United States or another third country, the transfer relies on that provider’s EU–US Data Privacy Framework certification and/or Standard Contractual Clauses incorporated in our agreement with them, as recorded per provider at /subprocessors.
09 Deletion and return
During the subscription you can export your organization’s content at any time using the product’s export capabilities. After the subscription ends, content remains exportable for [30] days; we then delete it from production systems within [60] days, and residual copies in encrypted backups roll off automatically within [BACKUP_RETENTION_DAYS] days, unless EU or Spanish law requires us to retain specific data longer.
10 Audits and information
On written request, we will make available the information reasonably necessary to demonstrate compliance with this agreement — including descriptions of our security measures and the compliance documentation of our sub-processors. Where that is genuinely insufficient, you may conduct (directly or through an independent auditor bound to confidentiality) an audit limited to the processing under this agreement, at your cost, with reasonable notice, during business hours, and no more than once a year except after a personal data breach.
11 Liability and precedence
This agreement is governed by the same law and liability framework as the Terms of Service, including its limitation of liability. If this agreement conflicts with the Terms of Service on a data protection matter, this agreement prevails.
Questions about any of this? Get in touch.