Appearance
Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of an agreement between Zeeker Platforms, Inc. (“Zeeker”) and an organization customer (“Customer”) only to the extent Zeeker processes Customer Personal Data as Customer’s processor or service provider. It does not apply to processing for which Zeeker independently determines purposes, including account management, cross-customer or platform-wide security and abuse prevention, platform moderation, legal compliance, product-wide analytics, and public Zeeker services. Tenant-specific security measures applied solely to deliver the Customer-configured service remain within this DPA.
1. Definitions and scope
“Customer Personal Data” means personal data submitted to an eligible organization-controlled feature and processed by Zeeker solely on Customer’s documented instructions. “Data Protection Law” means privacy and data-protection law applicable to that processing.
The subject matter is delivery and support of the contracted Zeeker feature. Duration is the agreement term plus deletion/return. Categories and people depend on Customer configuration and may include community members, website visitors, administrators, public commenters, profile and content data, device/activity data, and support records. Customer must not submit special-category or highly sensitive data unless an order expressly permits it.
2. Roles and instructions
Customer is controller/business and Zeeker is processor/service provider for Customer Personal Data. Customer instructs Zeeker to process it to provide, secure, support, troubleshoot, and comply with documented feature settings and the agreement. Additional instructions require written agreement and may incur reasonable cost.
Customer is responsible for lawful collection, notices, consents, instructions, data accuracy, rights in content, and configuration. Zeeker will inform Customer if an instruction appears to violate Data Protection Law, unless prohibited.
3. Zeeker obligations
Zeeker will:
- process Customer Personal Data only on documented instructions, except where law requires otherwise;
- ensure authorized personnel are bound by confidentiality;
- implement appropriate technical and organizational security measures;
- assist reasonably with data-subject requests, impact assessments, consultations, incidents, and compliance information;
- maintain required processing records;
- delete or return Customer Personal Data after termination, at Customer’s choice, unless law requires retention; and
- not sell Customer Personal Data, share it for cross-context behavioral advertising, or combine it outside permitted service-provider purposes.
4. Security
Measures include, as appropriate: encryption in transit; protected cloud storage; identity and least-privilege access; secret management; logging and monitoring; network and tenant controls; secure development and change management; backups and resilience; vulnerability and incident management; personnel confidentiality; and periodic review.
Customer is responsible for account security, role assignments, endpoints, integration code, backups it exports, and lawful feature configuration.
5. Incidents
Zeeker will notify Customer without undue delay after confirming a personal-data breach affecting Customer Personal Data and provide information reasonably available about nature, likely consequences, affected data/people, mitigation, and contact. Notification is not an admission of fault. Customer is responsible for regulator and individual notices unless law assigns them to Zeeker.
6. Subprocessors
Customer generally authorizes subprocessors listed at Subprocessors. Zeeker will impose materially equivalent data-protection duties and remains responsible for their performance to the extent required by law.
Zeeker will post notice of a new material subprocessor before use where practicable. Customer may object on reasonable data-protection grounds within 15 days. The parties will work toward a reasonable alternative; if none is feasible, either may terminate only the affected feature.
7. Rights requests
Taking into account the nature of processing, Zeeker will provide reasonable technical and organizational assistance for Customer to respond to rights requests. If Zeeker directly receives a request identifiable as Customer-controlled, Zeeker may direct the person to Customer unless law requires a response.
8. International transfers
For restricted transfers from the EEA, the EU Standard Contractual Clauses apply as appropriate: Module Two for controller-to-processor and Module Three for processor-to-processor, with Customer as exporter, Zeeker as importer, this DPA supplying Annexes I and II, and optional docking. Customer party details come from its verified account, Publisher Terms acceptance, or applicable order. Unless an applicable order lawfully selects another eligible Member State, Clause 17 is governed by Irish law and the courts of Ireland have jurisdiction under Clause 18; the competent supervisory authority is determined under Clause 13 and, where that clause does not identify one, is the Irish Data Protection Commission. For UK transfers, the UK Addendum applies; for Switzerland, references adapt to the Swiss FADP. A Customer must provide any exporter detail that applicable transfer terms require and that is not already in the service before relying on those terms.
The parties will reasonably cooperate on transfer assessments and supplementary measures. A separately executed transfer addendum controls if needed.
9. Audit
Zeeker will make reasonably current third-party certifications, summaries, and security information available under confidentiality. If that is insufficient for a legal requirement, Customer may conduct one proportionate audit per year on reasonable advance notice, during business hours, avoiding disruption and other customers’ data, at Customer’s cost. A regulator-required or confirmed-incident audit is not subject to the annual limit.
10. Deletion and return
At termination or valid instruction, Zeeker will delete or return Customer Personal Data from active systems within a commercially reasonable period and allow backups to age out under protected cycles. Legal holds, security records, and Zeeker-independent controller data are excluded and remain governed by the Privacy Policy.
11. Liability and precedence
The agreement’s liability limits apply to this DPA to the maximum lawful extent. This DPA controls on a processor-specific data-protection conflict; the Standard Contractual Clauses control over this DPA where they cannot be altered.
12. White-label processing schedule
This section applies when Customer operates an entitled White-Label Integration under the Publisher, Embed & White-Label Terms.
For Customer Personal Data in an Operator-branded site, app, community, embed, widget, managed legal hub, SSO flow, moderation flow, or rights-request flow, Customer is controller/business and Zeeker is processor/service provider to the extent Zeeker processes that data solely to carry out Customer’s documented configuration and instructions. The processing may include collection, transmission, storage, organization, display, moderation tooling, preference management, request routing, support, security, deletion, and return. Data subjects may include Customer visitors, members, contributors, moderators, administrators, and requesters. Data may include account identifiers, public and nonpublic content, moderation records, consent and preference records, device and activity data, configuration, and support or request correspondence, subject to the prohibition on unapproved sensitive data.
Customer instructs Zeeker to apply the configured Operator name and verified domain, approved branding, enabled features, regional configuration, and Customer choices to a standard Operator Legal Hub and related controls where Customer selects that service. Customer may use the managed defaults without re-entering facts already available in the service, but remains responsible for reviewing accuracy, ensuring the configured name identifies the responsible Operator, supplying facts Zeeker cannot derive, selecting lawful settings, and maintaining a lawful basis and public notices for Customer-controlled processing. Hosting or routing a legal page, consent control, or request form does not make Zeeker the controller of Customer’s processing or transfer Customer’s response duties to Zeeker.
Customer instructs Zeeker to receive and triage Customer-controlled privacy, content, and safety requests and, where Customer action is required, coordinate through the authorized administrator channels already associated with the Operator Experience. This managed intake is not a representation that every request is automatically forwarded or decided by Customer. Customer is responsible for decisions and communications unless law assigns a duty directly to Zeeker. Customer will keep an authorized administrator channel available and will not instruct Zeeker to load optional tracking before consent where prior consent is required or to disregard an applicable opt-out signal.
White-label presentation does not change the parties’ data-protection roles, the subprocessors authorized under section 6, or Zeeker’s independent processing identified in the opening paragraph. It does not require public use of Zeeker’s name where omission is permitted by the agreement and law, but Customer remains responsible for a complete and non-misleading disclosure of categories of recipients and must identify Zeeker if applicable law requires it in the circumstances. This schedule allocates responsibilities between the parties and is not a representation that either party’s use is compliant in every jurisdiction.
13. Details
Exporter: Customer identified by its verified account, Publisher Terms acceptance, and applicable order, using the address/contact in those records. Missing exporter details required for a restricted transfer must be supplied before Customer relies on these transfer terms.
Importer: Zeeker Platforms, Inc., 230 E Ohio St., 410-1590, Chicago, IL 60611, USA.
Frequency: Continuous for the feature term.
Purpose: Provide and secure the contracted feature.
Retention: Feature term plus the deletion schedule above.
Supervisory authority: Determined under the applicable transfer terms.
To request an executed DPA or raise a data-protection objection, use the Request Center.
Version 2026-07-29 is preserved in the policy archive.