Data Processing Agreement

Zynthoro processes personal data on behalf of the Controller solely to provide the Zynthoro platform and the four AI Assistants. The DPA remains in force for as long as Zynthoro processes such data.

• Hosting Controller's workspace data (HR records, customers, invoices, inventory, etc.).
• Running AI Assistants on Controller's prompts and data.
• Sending transactional emails on behalf of Controller (e.g. team invites).
• Generating analytics and dashboards visible only to Controller.

• Data subjects: Controller's employees, customers, suppliers, leads, end-users.
• Categories: identifiers, contact info, employment data, financial data, communications, AI prompt content.
• Special categories (Art. 9): Controller decides whether to upload such data. Where uploaded (e.g. HR sick-leave notes), Zynthoro applies the same security controls.

• Process personal data only on documented instructions from the Controller.
• Ensure persons authorised to process data are bound by confidentiality.
• Implement appropriate technical and organisational measures (Annex A).
• Engage sub-processors only under written contracts with equivalent obligations.
• Assist the Controller in responding to data-subject requests within statutory deadlines.
• Notify the Controller of any personal data breach without undue delay and at the latest within 72 hours.
• On termination, delete or return all personal data within 90 days, unless EU/NL law requires retention.

All Customer Data is hosted on EU-based infrastructure, primarily in the Republic of Ireland (eu-west). Zynthoro uses the following sub-processors (versioned list available on request):

• Stripe Payments Europe Ltd. (Ireland, EU) — payments.
• Anthropic PBC (USA, SCCs + zero-retention) — Claude AI inference.
• Google LLC (USA, SCCs + zero-retention) — Gemini AI inference.
• Resend Inc. (USA, SCCs) — transactional email.
• MongoDB Atlas (Ireland, eu-west region) — primary database.
• Amazon Web Services EMEA SARL (Ireland, eu-west) — file/object storage and backups.
• Cloudflare Inc. (USA, SCCs) — DNS / CDN / WAF.

Zynthoro will notify Controller at least 30 days before adding or replacing a sub-processor; Controller may object on reasonable grounds.

• TLS 1.3 in transit, AES-256 at rest.
• Bcrypt password hashing (cost 12) and optional 2FA (TOTP).
• Role-based access control with least-privilege defaults.
• Quarterly third-party penetration tests; annual code audit.
• Centralised logging with 30-day immutable retention.
• Encrypted, geo-redundant backups (RPO 24h, RTO 4h).
• Documented incident-response runbook and 24/7 on-call.
• Background checks for all engineers with production access.

Where personal data is transferred outside the EEA (e.g. to Anthropic or Google in the US), Zynthoro relies on the European Commission's Standard Contractual Clauses (Module 3, 2021) and applies supplementary measures including end-to-end encryption and zero-retention AI inference contracts.

On request, Zynthoro will provide an annual SOC 2 Type II report (or equivalent) once available, and respond to reasonable written audit questionnaires within 30 days. On-site audits may be conducted at Controller's cost once per year with 60 days' notice.

Each party's liability under this DPA is subject to the limits in the main Terms of Service. The DPA terminates automatically with the main Terms.

Casa Haya International BV (KvK 99196581) — Data Protection contact: info@zynthoro.ai