Legal
Data Processing Agreement
Last updated 28 October 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer and Astrizon Technology Solutions Private Limited, a company registered in India, with its registered office at A103 MJ Lifestyle Astro, Chikkanagamangala Road, Bengaluru 560099, Karnataka, India ("Processor"). It applies whenever the Processor processes personal data on the Customer's behalf through Zolensa. If the Customer acts as a processor for its own client, the Processor is its sub-processor and the terms apply accordingly.
1. Definitions
"Data Protection Law" means the laws that apply to the processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India's Digital Personal Data Protection Act 2023, and US state laws such as the California Consumer Privacy Act. "Personal Data", "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Processing" have the meanings given in the GDPR. "Customer Personal Data" means Personal Data processed by the Processor for the Customer through the Service.
2. Roles and instructions
The Customer is the Controller (or a Processor acting for its client) and the Processor processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and settings of the Service are those instructions. The Processor tells the Customer if it believes an instruction breaks Data Protection Law. The details of the processing are in Annex I.
3. Confidentiality
The Processor makes sure that everyone authorised to process Customer Personal Data is bound by confidentiality and only has the access their role needs.
4. Security
The Processor implements the technical and organisational measures in Annex II, appropriate to the risk, and may update them as long as the overall level of protection does not decrease.
5. Sub-processors
The Customer gives general authorisation for the sub-processors listed on the Subprocessors page. The Processor gives at least 30 days' notice of a new sub-processor by updating that page and emailing workspace owners. The Customer may object on reasonable data protection grounds within that period; if the parties cannot agree a solution, the Customer may end the affected service and receive a refund of prepaid fees for the remaining period. The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for them.
6. International transfers
The Processor hosts the Service in India and some sub-processors are in other countries. For transfers of Personal Data from the European Economic Area, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) and, where the Customer is a processor, Module Three (processor to processor), which are incorporated by reference with these choices: Clause 7 does not apply; under Clause 9 option 2 (general authorisation) applies with 30 days' notice; the optional wording in Clause 11 does not apply; Clause 13 follows the Customer's establishment; under Clauses 17 and 18 the law and courts of Ireland apply; Annexes I and II of this DPA complete the Annexes of the Clauses. For transfers from the United Kingdom the International Data Transfer Addendum issued by the Information Commissioner applies, and for Switzerland the Clauses apply with references read as references to Swiss law. If these Clauses conflict with this DPA, the Clauses prevail.
7. Helping the Customer
Taking into account the nature of the processing, the Processor helps the Customer, mainly through features of the Service, to answer Data Subjects' requests, and with security, breach notifications, data protection impact assessments and consultations with authorities. If a Data Subject contacts the Processor directly, the Processor passes the request on to the Customer without answering it, unless the law requires otherwise.
8. Personal Data Breaches
The Processor notifies the Customer without undue delay, and in any case within 48 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations, and keeps the Customer informed as more becomes known. The Processor takes reasonable steps to contain the breach and reduce its effects.
9. Deletion and return
The Customer can export and delete Customer Personal Data at any time through the Service, and sets the retention period of each study. When the agreement ends, the Processor deletes all Customer Personal Data, including files in storage, within 30 days after the export period in the Terms, unless the law requires it to keep some of it, in which case it keeps that data confidential and processes it only for that purpose.
10. Audits
The Processor makes available the information reasonably needed to show compliance with this DPA. The Customer may audit, or have an independent auditor bound by confidentiality audit, once a year with 30 days' notice, during working hours and without disrupting the Service or other customers' data, at its own cost; or more often if a Personal Data Breach or an authority requires it.
11. US state privacy laws
Where the California Consumer Privacy Act or similar laws apply, the Processor is a service provider and will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than the Service, or combine it with other personal information except as those laws allow. The Processor will tell the Customer if it can no longer meet these obligations.
12. Liability and order of precedence
Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law does not allow them. If this DPA conflicts with the Terms on data protection, this DPA prevails.
13. Annex I: Details of the processing
| Controller | The Customer (agency), as set out in its workspace. Contact: the workspace owners. |
|---|---|
| Processor | Astrizon Technology Solutions Private Limited, Bengaluru, India. Contact: support@astrizon.com. |
| Data Subjects | Research participants invited by the Customer; the Customer's staff and clients who use the Service. |
| Categories of data | Identification and contact details (name, email, mobile number), language and time zone, consent records, study answers, videos, photos and voice recordings, messages, device and connection information, sign-in and audit records. |
| Sensitive data | Not requested by the Service. Recordings may reveal special categories of data (for example health, religion or ethnic origin) depending on the Customer's study; the Customer decides whether to collect such data and is responsible for its lawful basis. Safeguards: those in Annex II. |
| Nature and purpose | Hosting, storage, conversion of media for playback, display to authorised users, sending invitations, reminders and messages, translation of study texts, transcription and translation of recordings, AI analysis of answers when the Customer uses it, export and deletion, to provide the Service to the Customer. |
| Frequency | Continuous, for the duration of the agreement. |
| Retention | As set by the Customer for each study, and at the latest until deletion after the agreement ends (section 9). |
| Sub-processors | As listed on the Subprocessors page, for hosting, email delivery and, when used, translation, transcription, AI analysis, payments and text messages. |
14. Annex II: Technical and organisational measures
- Encryption in transit with TLS for all connections; recordings stored privately and served through signed links that expire.
- Passwords hashed with Argon2id; two-factor authentication required for workspace owners and platform staff; provider keys and two-factor secrets encrypted at rest.
- Role-based access within each workspace; clients see participants by code only; contact details limited to the study team.
- Separation of customers' data in the application by workspace; every request checked against the user's workspace and role.
- Rate limits on sign-in, invitations and uploads; protection against cross-site request forgery; security headers.
- Audit log of sign-ins, invitations, consent, exports, downloads and deletions.
- Data minimisation: location data removed from photos; uploads checked by type and size; downloads expire after seven days.
- Retention per study set by the Customer; deletion of participants, studies and whole workspaces including files.
- Server hardening, regular security updates, firewalling, and backups held by the hosting provider.
- Staff with access bound by confidentiality, access limited to what their work requires.
- A process to detect, assess and notify Personal Data Breaches within 48 hours.