Data Processing Agreement

The controller is the customer that holds a Zyberon workspace and accepts this DPA (“you”). The processor is Zyberon (“we”, “us”), identified in Annex I. Where you are yourself a processor for your own clients, we act as your sub-processor and this DPA applies in the same way.

This DPA covers all personal data that we process on your behalf while providing the Zyberon platform (the “Service”). It does not cover personal data for which we are the controller ourselves, such as your account and billing details; our Privacy Policy describes that processing.

If this DPA conflicts with the Terms of Service, this DPA prevails for everything that concerns the protection of personal data. Nothing in this DPA limits the rights of data subjects or the obligations of either party under the General Data Protection Regulation (the “GDPR”).

You accept this DPA on behalf of your organization when you accept the Terms of Service, when you create a workspace, or when an owner or admin accepts it in the workspace settings. We record for every workspace which version was accepted, when, and by whom.

This is version 2026-10. It applies for as long as we process personal data on your behalf, and it ends once all such data has been deleted or returned as described in section 11.

We may update this DPA when the law or the Service changes. We announce a material change at least 30 days before it takes effect, and an update never lowers the level of protection that this version gives.

We process personal data only on your documented instructions. Your instructions are this DPA, the Terms of Service, the settings you choose in your workspace and the actions you take in the Service, such as connecting a store, enabling an AI tool or sending a reply.

We do not process the data for our own purposes, we do not sell it, and we do not use it to train AI models. We process it beyond your instructions only when European Union or Member State law requires us to; in that case we tell you first, unless that law forbids it.

If we believe that an instruction infringes the GDPR or other data protection law, we tell you immediately, and we may suspend that instruction until you confirm or change it.

We give access to personal data only to people who need it to provide, secure or support the Service, and only to the extent they need. Everyone with that access is bound by a duty of confidentiality, by contract or by law.

We apply the technical and organizational measures described in Annex III to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure and unauthorized access. We review them regularly and may improve them, but we never lower the overall level of protection.

You are responsible for the security of the accounts and credentials you control, for the permissions you give your team, and for the data you choose to bring into the Service.

The Service is not designed for special categories of personal data or for data about criminal convictions, and you do not instruct it to process such data. If your use of the Service nevertheless involves it, you are responsible for the legal basis and you tell us, so that we can agree on additional safeguards.

You give us general authorization to engage the sub-processors listed on our sub-processor page, which forms Annex IV of this DPA.

We inform you of any intended addition or replacement of a sub-processor at least 30 days in advance, by email to the owner of each workspace and by updating that page. Within that period you can object on reasonable data protection grounds by writing to hello@zyberon.ai. If we cannot resolve your objection, you may end the affected part of the Service before the change takes effect, without penalty.

We engage every sub-processor under a written contract that imposes data protection obligations at least as protective as this DPA, and we remain fully responsible to you for how they perform those obligations.

Services you connect yourself, such as your store platform, your advertising accounts, your mailbox or your email marketing platform, are not our sub-processors. We exchange data with them on your instructions, and your own agreement with each of those providers governs what they do with it.

The servers that hold your data are in the European Union. Some sub-processors, in particular the AI providers, process data in the United States or elsewhere outside the European Economic Area. We transfer personal data outside the EEA only in compliance with Chapter V of the GDPR, for example on the basis of an adequacy decision such as the EU-US Data Privacy Framework, or of the standard contractual clauses of the European Commission together with supplementary measures where needed.

We promptly forward to you any request we receive from a data subject about personal data we process on your behalf, and we do not answer it ourselves unless you authorize us to. Taking into account the nature of the processing, we help you answer such requests, in particular through the export, correction and deletion functions of the Service.

Taking into account the information available to us, we also help you with data protection impact assessments, with prior consultation of a supervisory authority, and with your obligations on security and on the notification of breaches.

We notify you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach that affects personal data we process on your behalf. We send the notification by email to the owner of each affected workspace.

The notification describes, as far as is then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we have taken or propose to take, and a contact point for more information. Where we cannot give everything at once, we give it in phases without further undue delay.

We take the measures needed to contain the breach and limit its consequences, we keep a record of every breach, and we cooperate with you so that you can meet your own obligation to notify the supervisory authority and, where required, the data subjects.

You can export your data and delete your workspace from your dashboard at any time. When you delete your workspace or account, or when the Service ends, we delete the personal data we process on your behalf within 30 days, unless European Union or Member State law requires us to keep it. Encrypted backups expire on their own schedule within 90 days.

If you want a copy returned before deletion, use the export functions of the Service, or ask us at hello@zyberon.ai before you delete your workspace.

We make available to you the information needed to demonstrate compliance with this DPA and Article 28 GDPR. On request we provide a description of our security measures, the current list of sub-processors and, once available, the results of independent audits.

You may audit our compliance, yourself or through an independent auditor bound by confidentiality, once a year, or more often when a breach or a supervisory authority gives reason to. You give at least 30 days of notice, the audit takes place during business hours, and it may not disrupt the Service or expose the data of other customers. Each party bears its own costs, unless the audit shows a material breach of this DPA by us.

Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where the GDPR does not allow such a limitation.

If we breach this DPA and do not remedy it within a reasonable period, you may suspend our processing of your data and end the affected part of the Service.

This DPA is governed by the law of the Netherlands, and disputes are submitted to the competent court in the Netherlands, in line with the Terms of Service.

Controller: the customer that holds the Zyberon workspace, as identified by the details in its account. Contact: the owner of the workspace.

Processor: Zyberon, with the company details below. Contact for data protection: hello@zyberon.ai. Contact for security: security@zyberon.ai.

Special categories of personal data: none intended (see section 6).

Nature of the processing: collection through the integrations you connect and the pages you publish, storage, organization, analysis, generation of content with AI, transmission to the services you connect, and deletion.

Purpose: providing the parts of the Service you enable, such as customer support, product pages and funnels, advertising creative and measurement, email marketing, analytics and research, and the operations that keep them running.

Duration: for as long as your workspace exists, followed by deletion under section 11. Operational records are deleted earlier on fixed schedules, as described in our Privacy Policy.

Frequency: continuous while the Service is in use.

These measures describe how the Service operates today. We update this annex when a measure changes, and never in a way that lowers the overall level of protection.

The current sub-processors, with the purpose and location of each, are listed below and on our sub-processor page, which also shows the date of the last change.