Data Processing Agreement
Last updated: 2 November 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between V.O.F. Zenntic (a Dutch general partnership), registered with the Dutch Chamber of Commerce (KvK) under number 42182452, VAT number NL870077065B01, based in Groningen, the Netherlands ("Zenntic", "processor"), and the business that uses the Zenntic Assistant or the Email Sorter ("Customer", "controller"). It applies as soon as the Customer uses either of them, and it sets out how Zenntic processes personal data on the Customer's behalf, as required by Article 28 of the General Data Protection Regulation (GDPR).
1. Scope
This DPA covers the personal data Zenntic processes for the Customer:
- Assistant: when the Assistant talks with the Customer's visitors and customers through the Customer's website, chat page, email, and, if included in the Customer's plan, WhatsApp or phone;
- Email Sorter: when the Email Sorter reads, sorts, and drafts replies to the email in the mailbox the Customer connects, which contains personal data of the people who write to the Customer.
The people whose data this is are the "data subjects". This DPA does not cover the Customer's own account data on zenntic.com, for which Zenntic is the controller under its Privacy Policy.
2. Details of the Processing
| Assistant | |
|---|---|
| Subject and purpose | Answering the Customer's visitors on the Customer's behalf, taking messages, recording sales enquiries, booking appointments in the Customer's calendar, and, if the Customer uses Projects, keeping track of jobs under way for the Customer's clients and telling a client the status the Customer wrote |
| Nature | Receiving, storing, analysing with AI models, showing to the Customer, sending by email, and deleting |
| Data subjects | Visitors of the Customer's website and other channels who talk with the Assistant, and the Customer's clients for whom the Customer records a job |
| Personal data | The content of conversations; name, email address, and phone number when the data subject gives them; appointment details; what the data subject said they need; for a job under way, its name or address, the client it belongs to, a reference number, and the status and background the Customer writes; technical data such as the time of a request and the IP address, used for rate limiting and kept in memory only |
| Special categories | The Assistant is not designed to process special categories of personal data, such as health data. The Customer will not set up the Assistant to ask for them. |
| Duration | For as long as the Customer uses the Assistant, and the deletion period in section 11 after that |
| Email Sorter | |
| Subject and purpose | Sorting the email in the Customer's mailbox into labels or categories, marking what is handled, and placing suggested replies in the Customer's drafts |
| Nature | Reading new messages through the Gmail API or Microsoft Graph, analysing them with an AI model, writing labels, categories, and drafts in the mailbox, storing a processing record, and deleting |
| Data subjects | People who send email to, or receive email from, the connected mailbox |
| Personal data | Sender and recipient addresses and names, subject, the body of the message (read for processing and not stored in Zenntic's database, except for a limited time in the record of a processing run that failed, so the error can be fixed), the time it was received, and the result of the processing: category, urgency, a short summary, and a suggested reply. Attachments are not read. |
| Special categories | The Email Sorter does not look for special categories of personal data, but an email may contain them. They are processed only as part of sorting that message, in the same way as any other content. |
| Duration | For as long as the mailbox is connected, and the deletion period in section 11 after that |
3. Instructions
Zenntic processes personal data only on the Customer's documented instructions. The Terms of Service, this DPA, and the settings the Customer chooses on its Assistant page, such as the retention period and the channels that are switched on, are the Customer's instructions. Zenntic will tell the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law. Zenntic may also process personal data where Union or Dutch law requires it; in that case Zenntic will tell the Customer first, unless the law forbids that.
4. Confidentiality
Zenntic ensures that everyone it authorises to process the personal data is bound to confidentiality. People at Zenntic do not read conversations, unless the Customer asks for help, it is needed for security, or the law requires it.
5. Security
Zenntic takes appropriate technical and organisational measures to protect the personal data, including:
- HTTPS for all data in transit
- encryption (AES-256-GCM) of mailbox and calendar access keys, bound to the Customer's account
- row-level security on the database, so that only Zenntic's backend can reach the data
- separation between customers: every request for a Customer's data is limited to that Customer
- access to the database and the admin tools limited to Zenntic's founders
- limits per visitor and per Customer against abuse
- automatic deletion of conversations, messages, and contact details after the retention period the Customer chooses
- a log of changes to settings and of deletions
Zenntic may improve these measures over time, as long as the level of protection does not go down.
6. Sub-processors
The Customer gives Zenntic general authorisation to engage the following sub-processors:
| Sub-processor | What for | Where |
|---|---|---|
| Render | Runs the service | Frankfurt, Germany |
| Supabase | Database | Ireland |
| Anthropic | The AI model that writes the Assistant's replies | United States |
| Google (Gemini API) | Searching the Customer's own information | United States |
| Resend | Sending and receiving email | United States |
| Meta (WhatsApp Business Platform) | Delivering WhatsApp messages, when the Customer connects WhatsApp | Per Meta's WhatsApp Business terms |
| Google, Microsoft | The Customer's calendar, when the Customer connects it | Per the Customer's own account |
| Google (Gemini API) | Email Sorter: categorising messages and drafting replies | United States |
| n8n | Email Sorter: the workflow that moves messages between the services above | European Union |
| Google (Gmail API), Microsoft (Graph) | Email Sorter: access to the mailbox the Customer connects | Per the Customer's own account |
Phone (Vapi) is added as a sub-processor only when that channel is switched on for the Customer.
Zenntic will inform the Customer by email at least 14 days before adding or replacing a sub-processor. The Customer may object in that time on reasonable grounds; if we cannot resolve the objection, the Customer may end the subscription concerned without further cost. Zenntic imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible to the Customer for their performance.
7. Transfers Outside the EEA
Where a sub-processor processes personal data outside the European Economic Area, Zenntic relies on the safeguards the GDPR provides for such transfers, such as an adequacy decision (including the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses.
8. Data Subject Requests
Zenntic helps the Customer respond to requests from data subjects to see, correct, delete, or receive their data, or to object to its processing. Zenntic can find a person's data by email address or phone number and delete it on the Customer's request. If a data subject contacts Zenntic directly, Zenntic will forward the request to the Customer, or handle it in agreement with the Customer.
9. Personal Data Breaches
Zenntic will notify the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Customer's data. The notification describes what happened, which data and data subjects are likely affected, the likely consequences, and the measures taken or proposed. Zenntic will help the Customer meet its own obligations to report to the Dutch Data Protection Authority and to inform data subjects.
10. Other Assistance
Zenntic gives the Customer the information it reasonably needs for a data protection impact assessment or a prior consultation with the supervisory authority, as far as it relates to the Assistant or the Email Sorter.
11. End of the Processing
When the Customer ends its Assistant subscription, Zenntic deletes the Customer's Assistant data, including conversations, messages, contact details, leads, and knowledge, within 30 days, unless the Customer asks for a copy first or Union or Dutch law requires Zenntic to keep it. When the Customer disconnects its mailbox or ends its Email Sorter subscription, Zenntic stops processing at once, deletes the mailbox access keys immediately, and deletes the processing records within 30 days. On request, Zenntic confirms the deletion in writing.
12. Information and Audits
Zenntic makes available to the Customer the information necessary to demonstrate compliance with this DPA. The Customer may audit this, or have an independent auditor bound to confidentiality do so, once a year with at least 30 days notice, at the Customer's own cost. Where possible, Zenntic will first answer the Customer's questions in writing.
13. Liability
The limitation of liability in the Terms of Service applies to this DPA, as far as the law allows.
14. Duration and Law
This DPA applies for as long as Zenntic processes personal data for the Customer. If this DPA and the Terms of Service conflict about the processing of personal data, this DPA prevails. This DPA is governed by the laws of the Netherlands.
15. Contact
For questions about this DPA or to make a request:
Email: [email protected]
Zenntic, Groningen, the Netherlands