Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Waheed Zen LLC ("Processor") and the Client ("Controller") where we process personal data on the Client's behalf.

Subject matter and duration

We process personal data only to deliver the services described in the Client's Order, for the duration of the engagement.

Nature and purpose

Marketing services including advertising, analytics, lead capture, CRM operation, and communications.

Categories of data subjects

The Client's customers, prospects, website visitors, and enquirers.

Categories of personal data

Name, email address, phone number, postal address, IP address, usage data, and communication content. We do not process special category data.

Our obligations

We process personal data only on the Client's documented instructions; ensure personnel are bound by confidentiality; implement appropriate technical and organizational security measures; assist the Client with data subject requests and breach notification; and delete or return personal data at the end of the engagement, unless retention is legally required.

Sub-processors

The Client consents to our use of the sub-processors listed on our Sub-processors page. We will give 30 days' notice before adding a new one and the Client may object on reasonable grounds.

International transfers

Where personal data is transferred out of the EEA or UK, the Standard Contractual Clauses and the UK Addendum apply and are incorporated by reference.

Audit

We will make available information necessary to demonstrate compliance and will accept one audit per year on 30 days' notice.

Breach

We will notify the Client without undue delay and within 48 hours of becoming aware of a personal data breach affecting their data.

Contact

legal@waheedzen.com