Data processing addendum.

Who this is for: B2B customers (agencies, enterprises, research teams) whose use of Zodiacs involves us processing their end-users' data on their behalf. For individual consumer accounts, our Privacy Policy governs.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Zodiacs ("Processor," "us") and the customer entity ("Controller," "you"). It sets out the parties' obligations regarding Personal Data processed by us on your behalf, in alignment with GDPR Article 28.

1. Definitions

"Personal Data," "Processing," "Data Subject," "Supervisory Authority," and "Controller" / "Processor" carry the meanings given by GDPR, UK GDPR, CCPA, and other applicable data protection laws.

2. Scope and purpose

We process Personal Data only to:

• Provide the Zodiacs Service as described in the Terms of Service.
• Follow your documented instructions (including via our product UI and API).
• Comply with applicable law (where law requires processing, we inform you unless legally prohibited from doing so).

We will not process Personal Data for any other purpose.

3. Categories of data & subjects

• Categories of Personal Data: name, email, password hash, birth date, birth time (encrypted), birth location, reading content, outcome feedback, payment-method reference, log/usage data.
• Categories of Data Subjects: end users of your deployment; relationship subjects entered by end users.
• Duration of processing: the term of the Terms of Service plus deletion windows documented in the Privacy Policy.

4. Sub-processors

We use the following sub-processors to deliver the Service:

We will give you 30 days' advance notice before adding or replacing any sub-processor. If you object on reasonable data-protection grounds, we'll work in good faith to resolve; if unresolved, you may terminate for cause.

5. International transfers

Where Personal Data of EU/UK subjects moves to the US, we rely on the EU-US Data Privacy Framework (where certified), Standard Contractual Clauses, and supplementary measures (encryption at rest, access logging) to ensure protection equivalent to GDPR.

6. Security measures

We implement the technical and organisational measures described on our Security page, and will maintain them at a level commensurate with the risk throughout the term.

7. Data subject rights

We'll assist you in responding to data subject requests under applicable law (access, rectification, erasure, restriction, portability, objection). For requests we receive directly from your end users, we'll forward them to you within 7 days unless they concern our own processing.

8. Breach notification

We'll notify you without undue delay — and no later than 72 hours after becoming aware — of any Personal Data breach affecting your data, with enough information for you to meet your own regulatory obligations.

9. Audit rights

On reasonable notice and no more than once per year, you may request documentation of our security program and processing records. We may provide summary audit reports (e.g. sub-processor SOC 2 attestations) in lieu of direct audits.

10. Deletion and return

On termination, we will, at your election, delete or return all Personal Data. Deletion follows the retention schedule in our Privacy Policy — within 2 years, zero personal data remains in any system, including backups.

11. Execution

This DPA is accepted automatically when you accept the Terms of Service. For entities requiring a signed copy, email support@zodiacs.ai with "[DPA signature]" in the subject.

Contact

Data protection inquiries: support@zodiacs.ai.

Legal entity details are available on request via support@zodiacs.ai.