Back to App/
Zeeply
Zeeply Legal
GDPR Article 28 Addendum

Data Processing Addendum (DPA)

Last modified: · Standard B2B Enterprise Agreement

1. Background and Purpose

This Data Processing Addendum (“DPA”) supplements the Zeeply Terms of Service between Zeeply AI Ltd (“Processor”) and the Customer (“Controller”). This DPA governs the processing of Personal Data in connection with the Customer’s use of the Zeeply platform pursuant to Article 28 of the General Data Protection Regulation (GDPR).

2. Technical & Organizational Measures (TOMs)

Zeeply maintains comprehensive administrative, technical, and physical safeguards designed to preserve the confidentiality, integrity, and availability of Customer Data:

Encryption at Rest & Transit

All data stored in Neon PostgreSQL is encrypted at rest via AES-256. All communications enforce TLS 1.3 encryption.

Multi-Tenant Isolation

Workspaces are strictly isolated at the application and query layers. Row-level workspaceId constraints ensure zero cross-tenant leakage.

Authentication & RBAC

Cryptographic session tokens, 6-digit OTP two-factor verification, and role-based access control (Owner, Admin, Member, Viewer).

Automated Incident Response

Automated DLP masking for sensitive prospect credentials, real-time error telemetry, and a mandatory 48-hour breach notification SLA.

3. Sub-Processor Engagement

Controller grants Processor general written authorization to engage the sub-processors listed in our Privacy Policy. Processor shall remain fully liable to Controller for the performance of each sub-processor’s obligations.

Sub-Processor Notification: We will provide notice of any intended changes concerning the addition or replacement of sub-processors at least 14 days in advance via platform notifications or email.

4. Security Breach Notification & SLAs

Processor shall notify Controller without undue delay, and in any event within 48 hours of becoming aware of a confirmed personal data breach affecting Customer Data. The notification shall describe the nature of the breach, the data categories involved, and the remedial actions undertaken.

5. Data Deletion and Return Upon Termination

Within 30 days of termination of the Service, Processor will delete or return all Customer Personal Data from its production systems upon request, retaining only cryptographic suppression records strictly necessary for compliance with statutory legal obligations.

To request an executed copy of this DPA: dpa@zeeply.com
Zeeply AI Ltd · London, UK