Data Processing Addendum

1. Purpose and Scope

1.1

This addendum applies when Zensets processes personal data on Customer's behalf in providing the Services. It is incorporated where the applicable Terms of Service, order form, or separately signed customer agreement expressly incorporates or otherwise validly accepts this addendum. It does not govern Zensets' independent processing as a controller.

1.2

This addendum controls conflicts about customer-directed processing. Mandatory law and any applicable mandatory transfer clauses take precedence.

2. Definitions

• Agreement: The Zensets Terms of Service, order form, or separately signed contract governing Customer's use of the relevant Services and incorporating this addendum.
• Customer Personal Data: Personal data Zensets processes on Customer's behalf under the Agreement.
• Services: The software, data, information and related services made available to Customer under the Agreement, including authorized customer-directed processing, related support, diagnostics and security.
• Subprocessor: A provider engaged by Zensets to process Customer Personal Data on its behalf.

Other data-protection terms have their meanings under applicable law.

3. Roles of the Parties

3.1

Customer is the controller, or a processor authorized by its controller. Zensets acts as processor or subprocessor for the relevant customer-directed processing.

3.2

Zensets may separately act as controller for enrichment records it independently collects and maintains for its own purposes. Those activities are governed by applicable law, the data license and privacy notice. Customer-supplied lookup inputs, customer-specific request histories and copies of results processed on Customer's behalf remain Customer Personal Data. Independently maintained enrichment records do not become Customer Personal Data solely because the same professional information appears in a result. Actual processing determines each party's role; calling information usage data does not remove it from this addendum.

4. Processing Requirements

4.1

The Agreement and Customer's authorized requests and configurations constitute instructions to perform the Services described in Annex I. Zensets will flag instructions it considers unlawful and explain when a legal requirement prevents following them, unless notification is prohibited.

4.2

Zensets will not use Customer Personal Data for its own advertising, disclose it to other customers, add it to a shared enrichment database, or train shared or general AI models on it. These limits override broader content licenses in the Agreement.

4.3

Customer is responsible for having the rights and lawful bases needed for its inputs and use of results. Sensitive personal data is not supported without a separate written arrangement.

4.4

Where Zensets acts as a California service provider or contractor, it will use Customer Personal Data only for Annex I's purposes or as legally permitted; will not sell it, share it for cross-context behavioral advertising, use it outside the direct customer relationship, or combine it with other personal data except as legally permitted; and will provide the legally required level of protection. Zensets certifies it understands these limits, will notify Customer if it cannot meet them, and will permit reasonable steps to verify compliance and stop or remedy unauthorized use.

5. Authorized Personnel

Access to Customer Personal Data will be limited to authorized personnel subject to confidentiality obligations.

6. Processing Locations and Transfers

Customer authorizes processing in the locations described in Annex I. Before any restricted international transfer begins, the parties will establish a valid transfer mechanism and any necessary supplemental safeguards. Where required, they will complete and enter into a separate transfer supplement containing the applicable EU Standard Contractual Clauses and UK Addendum, with the relevant parties, roles, processing details and safeguards. Zensets will not begin the affected transfer until the required arrangements are effective. This addendum alone does not execute Standard Contractual Clauses.

7. Security

Zensets will maintain security appropriate to the risks and applicable law. Implemented measures are described in Annex II. This addendum makes no claim of a particular certification or independent audit.

8. Subprocessors

8.1

Customer provides general written authorization for the subprocessors listed in Annex III and additions or replacements made under Section 8.2. This authorization applies only to Customer Personal Data processed on Customer's behalf for the stated purposes; it does not mean every listed provider receives lookup inputs or results. Providers processing account or billing information for separate controller activities are addressed in the privacy notice. Zensets will impose appropriate written data-protection obligations on subprocessors and remain responsible for subcontracted processing as required by law.

8.2

Zensets will publish intended additions or replacements to Annex III on the public webpage hosting this addendum at least 30 days before the new provider processes Customer Personal Data. Customer may object on reasonable data-protection grounds at george@zensets.com within that period. The parties will work in good faith to resolve the objection. Zensets will not begin the objected-to processing while a reasonable objection remains unresolved; if no resolution is reached, either party may terminate the affected Services by written notice before that processing begins. This website-notice procedure does not limit any additional notification or objection rights required by applicable law.

9. Data Breaches and Assistance

9.1

Zensets will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, provide available information and updates, and take reasonable response measures.

9.2

Zensets will reasonably assist with individual rights, security obligations, impact assessments and regulator requests as required by applicable law.

10. Compliance Information

Zensets will provide information necessary to demonstrate compliance and allow legally required audits, subject to reasonable confidentiality and security safeguards.

11. Return and Deletion

Customer may request return or deletion at george@zensets.com. Zensets will retain Customer Personal Data only as needed for the documented service purposes and within Annex I's maximum periods. When processing ends, Zensets will return or delete Customer Personal Data at Customer's choice, including remaining copies unless law requires retention. Earlier requests and the end of processing take precedence over the 24-month maximum. Residual backups remain protected and beyond ordinary use until deletion; deletion instructions will be reapplied if restored. Annex I's maximum periods include routine deletion processing and all copies in primary, analytics, diagnostic and backup systems.

12. Duration

This addendum applies throughout the relevant processing and continues to protect Customer Personal Data while retained.

13. Liability

The Agreement's liability terms apply only as permitted by mandatory law and any applicable mandatory transfer clauses. This addendum creates no separate indemnity or increased liability cap and does not limit individuals' statutory rights.

14. Applicable Law

The Agreement's governing law and dispute provisions apply, subject to mandatory data-protection law and any applicable mandatory transfer clauses.

Annex I — Parties and Processing

A. Parties

Customer's legal name, address, contact and acceptance details are recorded in the Agreement or account records. Zensets' details appear in Section 15. The parties' roles are described in Section 3.

B. Processing Details

• Purpose: Processing authorized customer requests, delivering results or other contracted Services, and related diagnostics, support and security.
• Individuals: Professional contacts in requests/results and authorized API users.
• Data: Customer-provided identifiers and professional contact information, customer-directed requests and resulting customer-specific records, and related service metadata, including account identifiers, timestamps, response status and diagnostic information.
• Frequency: As requested or configured by Customer during the Services and related service operations.
• Raw inputs and analytics events: Retained only as needed for lookup delivery, troubleshooting, customer support, security and abuse investigation, for up to 24 months from collection, including routine deletion processing and backup expiry. Earlier deletion under Section 11 applies.
• Other identifiable records and outputs: Customer-specific enrichment results and copies retained for troubleshooting or support are subject to the same maximum of 24 months from collection, including routine deletion processing and backup expiry, and earlier deletion under Section 11. Retention of account, billing and independently maintained enrichment records processed for separate controller purposes is addressed in Zensets' privacy notice.
• Return/deletion and backup expiry: Zensets completes return or deletion from active systems within 30 days of Customer's request or the end of processing, according to Customer's choice. Residual backup copies remain protected and expire within 90 days after deletion from active systems and no later than the overall 24-month maximum, whichever is earlier, unless retention is required by law.
• Locations: United States for the processing described in this addendum. The relevant providers, roles and locations are listed in Annex III, subject to verification against actual data flows.
• Sensitive data: Not authorized without the separate arrangement described in Section 4.3.

Annex II — Security Measures

Zensets uses encrypted connections for data transmission and encryption at rest provided by its hosting and storage providers. Production access is restricted to authorized personnel using individual accounts and multifactor authentication where supported. API access requires authentication, and credentials are protected from unauthorized disclosure. Zensets maintains procedures for responding to security incidents, recovering service data and carrying out deletion requests. Recovery and backup arrangements follow the configurations of its hosting and storage providers.

Annex III — Subprocessors