Appearance
Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of an agreement between Zeeker Platforms, Inc. (“Zeeker”) and an organization customer (“Customer”) only to the extent Zeeker processes Customer Personal Data as Customer’s processor or service provider. It does not apply to processing for which Zeeker independently determines purposes, including account management, security, abuse prevention, platform moderation, legal compliance, product-wide analytics, and public Zeeker services.
1. Definitions and scope
“Customer Personal Data” means personal data submitted to an eligible organization-controlled feature and processed by Zeeker solely on Customer’s documented instructions. “Data Protection Law” means privacy and data-protection law applicable to that processing.
The subject matter is delivery and support of the contracted Zeeker feature. Duration is the agreement term plus deletion/return. Categories and people depend on Customer configuration and may include community members, website visitors, administrators, public commenters, profile and content data, device/activity data, and support records. Customer must not submit special-category or highly sensitive data unless an order expressly permits it.
2. Roles and instructions
Customer is controller/business and Zeeker is processor/service provider for Customer Personal Data. Customer instructs Zeeker to process it to provide, secure, support, troubleshoot, and comply with documented feature settings and the agreement. Additional instructions require written agreement and may incur reasonable cost.
Customer is responsible for lawful collection, notices, consents, instructions, data accuracy, rights in content, and configuration. Zeeker will inform Customer if an instruction appears to violate Data Protection Law, unless prohibited.
3. Zeeker obligations
Zeeker will:
- process Customer Personal Data only on documented instructions, except where law requires otherwise;
- ensure authorized personnel are bound by confidentiality;
- implement appropriate technical and organizational security measures;
- assist reasonably with data-subject requests, impact assessments, consultations, incidents, and compliance information;
- maintain required processing records;
- delete or return Customer Personal Data after termination, at Customer’s choice, unless law requires retention; and
- not sell Customer Personal Data, share it for cross-context behavioral advertising, or combine it outside permitted service-provider purposes.
4. Security
Measures include, as appropriate: encryption in transit; protected cloud storage; identity and least-privilege access; secret management; logging and monitoring; network and tenant controls; secure development and change management; backups and resilience; vulnerability and incident management; personnel confidentiality; and periodic review.
Customer is responsible for account security, role assignments, endpoints, integration code, backups it exports, and lawful feature configuration.
5. Incidents
Zeeker will notify Customer without undue delay after confirming a personal-data breach affecting Customer Personal Data and provide information reasonably available about nature, likely consequences, affected data/people, mitigation, and contact. Notification is not an admission of fault. Customer is responsible for regulator and individual notices unless law assigns them to Zeeker.
6. Subprocessors
Customer generally authorizes subprocessors listed at Subprocessors. Zeeker will impose materially equivalent data-protection duties and remains responsible for their performance to the extent required by law.
Zeeker will post notice of a new material subprocessor before use where practicable. Customer may object on reasonable data-protection grounds within 15 days. The parties will work toward a reasonable alternative; if none is feasible, either may terminate only the affected feature.
7. Rights requests
Taking into account the nature of processing, Zeeker will provide reasonable technical and organizational assistance for Customer to respond to rights requests. If Zeeker directly receives a request identifiable as Customer-controlled, Zeeker may direct the person to Customer unless law requires a response.
8. International transfers
For restricted transfers from the EEA, the EU Standard Contractual Clauses apply as appropriate: Module Two for controller-to-processor and Module Three for processor-to-processor, with Customer as exporter, Zeeker as importer, this DPA supplying Annexes I and II, optional docking, and the law/forum selections required by the applicable order. For UK transfers, the UK Addendum applies; for Switzerland, references adapt to the Swiss FADP.
The parties will reasonably cooperate on transfer assessments and supplementary measures. A separately executed transfer addendum controls if needed.
9. Audit
Zeeker will make reasonably current third-party certifications, summaries, and security information available under confidentiality. If that is insufficient for a legal requirement, Customer may conduct one proportionate audit per year on reasonable advance notice, during business hours, avoiding disruption and other customers’ data, at Customer’s cost. A regulator-required or confirmed-incident audit is not subject to the annual limit.
10. Deletion and return
At termination or valid instruction, Zeeker will delete or return Customer Personal Data from active systems within a commercially reasonable period and allow backups to age out under protected cycles. Legal holds, security records, and Zeeker-independent controller data are excluded and remain governed by the Privacy Policy.
11. Liability and precedence
The agreement’s liability limits apply to this DPA to the maximum lawful extent. This DPA controls on a processor-specific data-protection conflict; the Standard Contractual Clauses control over this DPA where they cannot be altered.
12. Details
Exporter: Customer and its address/contact in the applicable order.
Importer: Zeeker Platforms, Inc., 230 E Ohio St., 410-1590, Chicago, IL 60611, USA.
Frequency: Continuous for the feature term.
Purpose: Provide and secure the contracted feature.
Retention: Feature term plus the deletion schedule above.
Supervisory authority: Determined under the applicable transfer terms.
To request an executed DPA or raise a data-protection objection, use the Request Center.