Data Processing Agreement
Last updated: 25 October 2026 · version 2026-10-27b
This Data Processing Agreement (“DPA”) under Article 28 of the GDPR is part of the Terms & Conditions between you, the business using Zaags (the “Controller”), and RUDLU Unipessoal Lda (NIPC 516730304, 27A Rua da Bela Vista à Graça, 1170-058 Lisboa, Portugal, the “Processor”). It applies whenever Zaags processes personal data of your customers, prospects, guests, staff or contacts on your behalf. You accept it when you activate a business feature (a website with bookings or a shop, ZaagsForce, Presence, CRM, Request Desk, Follow-up); we record the date and version.
1. Subject matter, duration, nature and purpose
Processing consists of hosting, storing, displaying, transmitting, backing up and deleting the data your use of the features generates, for as long as you use them and until the data is deleted under section 8. Purpose: to provide the features you configure, nothing else.
2. Data and data subjects
Data subjects: your customers and guests, prospects and leads, suppliers, staff and contractors, website visitors. Data: identity and contact details, booking and order details, messages and enquiries, payment status (never full card numbers), attendance records (times, locations, check-in photos), CRM notes and activity, cookie-consent proofs. You must not upload special-category data (health, biometrics beyond the attendance photo, criminal data) unless you have a lawful basis and tell us.
3. Your obligations
You are the Controller: you decide why and how the data is used, you have a lawful basis and give the required information to data subjects (privacy notice on your site, notice to your staff), and you use the features lawfully. Your instructions to us are the settings you make in the product and the documented instructions in the Terms.
4. Our obligations
- We process the data only on your documented instructions and never for our own purposes; we do not use it to train AI models and do not sell it.
- Our staff are bound by confidentiality and do not access your customer data except when you grant time-limited support access or the law requires it.
- We implement the security measures in section 6.
- We help you answer data-subject requests (export, deletion and correction tools are built in) and support you with security assessments and, where relevant, data-protection impact assessments.
- We inform you if an instruction, in our opinion, infringes the GDPR.
- When you use the AI assistant on data of your customers (bookings, orders, enquiries, CRM records), only the records needed for your question are processed, for that reply, under the same sub-processor terms as the rest of the service.
5. Sub-processors
You authorise the sub-processors listed below (also in our Privacy Policy). We impose equivalent data-protection obligations on them and remain liable for their performance. We give you at least 14 days’ notice of any addition or replacement, in the app or by e-mail; you may object on reasonable data-protection grounds, in which case you may stop using the affected feature.
| Provider | Location | Purpose |
|---|---|---|
| Google LLC (Google Cloud, Google APIs, Google Maps/Places) | USA (EU SCCs) | sign-in; Drive, Calendar, Contacts and Photos features you connect; business data for the website maker |
| Stripe Payments Europe Ltd | Ireland / USA | card payments, subscriptions, invoices |
| PlanetHoster (N0C) | Canada / France | hosting of zaags.app (servers, backups) |
| Hetzner Online GmbH | Germany | AI gateway (routes AI requests) |
| Mistral AI SAS | France (EU) | AI chat in Full Privacy mode and with the 🔒 EU-private models; not used for training |
| OpenAI, OpenRouter (and the model providers it routes to), Replicate, Black Forest Labs | USA | AI text, image, logo and video generation in Open mode; audio transcription and voices |
| remove.bg (Kaleido AI GmbH) | Austria | logo background removal |
| Brave Software, DuckDuckGo, Steel.dev, Scrapling sidecar (own server) | USA / Germany | web search and page reading when you use search or import features |
| Meta Platforms Ireland (WhatsApp Business), Kapso | Ireland / USA | WhatsApp inbox and messages when you connect a number |
| Telegram FZ-LLC | UAE | alerts you choose to receive on Telegram |
| GoCardless Ltd | UK | open-banking bank feed when you connect an account |
| Firma.dev | EU | electronic signature requests |
| Supabase Inc | USA / EU region of your choice | your own data store when you connect one (you hold the keys) |
| Pexels, Openverse, Gravatar (Automattic) | USA | stock photos and profile-picture lookups |
| Revolut, Moloni, WooCommerce stores you connect | EU / your choice | payment links, invoicing and back-office orders for your own business, under your own accounts |
6. Security measures
- Encryption in transit (TLS) and encryption at rest of credentials with a key held outside the database.
- Access control: owner-only access to customer data; no administrator screen exposes it; time-limited, owner-granted support access, logged.
- Authentication: Google sign-in or e-mail link, optional two-step verification with step-up for sensitive changes, idle time-out, session management, security notices.
- Application security: CSRF and clickjacking protection, outbound-fetch restrictions, input validation, rate limiting, audit log of security events.
- Hosting in the EU/Canada with daily backups; AI processing in the EU in Full Privacy mode.
- Data minimisation and retention limits as set out in the Privacy Policy (truncated IPs, automatic purge of location pings and check-in photos).
7. Personal data breaches
We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information needed for your own notification to the supervisory authority and to data subjects, and we assist you with containment.
8. Deletion and return
You can export your data at any time (CSV and JSON exports, Google Drive mirrors) and delete it in the product. When you delete a site, a feature or your account, the related personal data is deleted within the grace period stated in the product (7 days for accounts) and from backups within 35 days, except where EU or Portuguese law requires us to keep it (accounting records).
9. Audits and information
We make available the information needed to demonstrate compliance with Article 28 and allow audits, including inspections, by you or an auditor you mandate, at most once a year, on 30 days’ notice, during business hours, at your cost, subject to confidentiality.
10. International transfers
Where a sub-processor is outside the EEA, transfers rely on the European Commission’s Standard Contractual Clauses (module 3, processor-to-processor, with our module-2 obligations to you), on the EU–US Data Privacy Framework where certified, and on additional safeguards. On request we provide the relevant clauses.
11. Liability and law
Liability under this DPA follows the Terms (section 10) and Article 82 GDPR. This DPA is governed by Portuguese law. If it conflicts with the Terms on data protection, this DPA prevails.
12. Contact
Data-protection contact: contact@zaags.app — RUDLU Unipessoal Lda, 27A Rua da Bela Vista à Graça, 1170-058 Lisboa, Portugal.