Data processing agreement

We don't expect special category data (such as health data), and Zulu isn't designed for it. Please don't put it on invoices.

• We only process the data on your documented instructions, which are these terms and how you use Zulu, unless EU or Irish law requires otherwise. If it does, we'll tell you first, unless the law forbids that.
• If we think an instruction breaks data protection law, we'll tell you.
• You're responsible for having a lawful basis for the data you put into Zulu, and for telling the people concerned, as your own privacy notice requires.

• Everyone who can access the data is bound to keep it confidential.
• We protect it as Article 32 requires, including:
  • encryption in transit (HTTPS) and at rest, in Ireland
  • passwords stored only as secure hashes, and login sessions that can be ended on every device
  • each business's data kept apart, and access limited to the people its owners invite, with the roles they choose
  • the database reachable only from Zulu's servers, with daily backups kept for 7 days
  • access to production limited to the operator, with multi-factor authentication

You authorise us to use these sub-processors for your data:

We'll tell account owners by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us, and if we can't resolve it, you may close your account before the change, and we'll refund any time you've paid for and not used. Each sub-processor is bound by a written agreement with the same data protection obligations as this one, and we're responsible to you for its work.

Our website host (Vercel) and payment provider (Stripe) don't receive the data you put into Zulu.

Where a sub-processor handles data outside the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework, where the sub-processor is certified, and by the EU Standard Contractual Clauses.

• People's rights. Most requests (access, correction, erasure, portability) you can handle yourself in Zulu, including Settings → Export. Where you can't, we'll help. If someone contacts us directly about your data, we'll pass the request to you rather than answer it ourselves.
• Breaches. If we become aware of a breach of your data, we'll tell you without undue delay, and within 48 hours, with what we know: what happened, the data and people affected, the likely consequences, and what we're doing about it. We'll keep you updated as we learn more.
• Other obligations. We'll give you the information you reasonably need for data protection impact assessments and consultations with a supervisory authority.

• Deleted records, and all the data of a deleted business, are erased 30 days after deletion, and from backups 7 days after that.
• Issued invoices and credit notes are kept for six years, because Irish law requires them to be kept. They're used for nothing else in that time.
• Before deleting, you can export your data in Settings → Export.
• If we stop offering Zulu, we'll give you at least 90 days' notice to export your data. Within 30 days of the closing date we'll delete all of it, including issued invoices and backups, and confirm when it's done. Keeping your issued invoices from then on is up to you.

We'll make available the information needed to show we meet this agreement, and answer your written questions about it. If that isn't enough, and a supervisory authority requires it or there's been a breach, we'll allow a reasonable audit, at your cost, with 30 days' notice, during business hours, and under confidentiality.

• This agreement lasts as long as we process your data.
• Liability under it is as set out in the Terms.
• If it conflicts with the Terms about personal data, this agreement wins.
• If you need a signed copy, email support@zulu.ie.