Data processing addendum

This data processing addendum ("DPA") forms part of the Agreement between Zantrey and the Customer under our Terms of service for customers of Zantrey Cloud (the "Cloud Service"). It sets out how Zantrey processes personal data on the Customer's behalf. Capitalized terms not defined here have the meaning given in the Terms of service.

1. Scope

This DPA applies when Zantrey processes Customer Personal Data in providing the Cloud Service. It also applies when the Customer gives Zantrey access to personal data in any Modulix installation in order to receive support, to the extent of that access.

It does not apply to self-hosted installations of Modulix in which Zantrey does not process customer data. There, the Customer operates the software on its own infrastructure, Zantrey has no access to the data in it, and Zantrey is neither controller nor processor of that data.

No separate signature is needed: this DPA takes effect when the Agreement does. If the Customer needs a countersigned copy, it can ask at privacy@zantrey.com.

2. Definitions

• "Data Protection Laws" means the laws on the protection of personal data that apply to the processing under this DPA, which may include the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, Canada's Personal Information Protection and Electronic Documents Act and provincial privacy laws, and US state privacy laws such as the California Consumer Privacy Act.
• "Customer Personal Data" means personal data within Customer Data that Zantrey processes on the Customer's behalf.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.
• "Sub-processor" means a third party engaged by Zantrey that processes Customer Personal Data.
• "Controller", "processor", "data subject" and "processing" have the meanings given in the GDPR, and equivalent terms in other Data Protection Laws (such as "business" and "service provider") are read accordingly.

3. Roles of the parties

The Customer is the controller of Customer Personal Data, or a processor acting for its own controllers, and Zantrey is the Customer's processor or sub-processor. Each party will comply with the Data Protection Laws that apply to it. The Customer is responsible for having a lawful basis for the processing and for giving data subjects any notices required.

Under the California Consumer Privacy Act, Zantrey acts as a service provider. It will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Services, and will not combine it with personal data from other sources except as the law permits.

4. Processing on instructions

Zantrey will process Customer Personal Data only on the Customer's documented instructions. The Agreement, including this DPA, and the Customer's configuration and use of the Cloud Service are the Customer's complete instructions; further instructions must be consistent with the Agreement. Zantrey will inform the Customer if it believes an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or changed. If the law requires Zantrey to process Customer Personal Data otherwise, it will inform the Customer before doing so, unless the law prohibits that.

5. Details of the processing

• Subject matter and duration: provision of the Cloud Service for the Subscription Term, and until deletion under section 12.
• Nature and purpose: hosting, storage, backup, retrieval, display, transmission and other processing needed to provide, secure and support the Cloud Service as described in the Agreement and the Documentation.
• Categories of data subjects: determined by the Customer, typically its Users, employees and contractors, and the contacts, customers, suppliers and other business partners whose records the Customer keeps in Modulix.
• Categories of personal data: determined by the Customer, typically names, contact details, job titles, account and sign-in details, communications, transaction, invoice and payment records and, where the Customer uses human resources or payroll modules, employment, compensation and bank account details.
• Special categories of data: none are required by the Cloud Service. If the Customer chooses to store such data, it is responsible for making sure it may lawfully do so and for configuring access to it appropriately.

6. Confidentiality of personnel

Zantrey will ensure that all personnel authorized to process Customer Personal Data are bound by written obligations of confidentiality or an appropriate statutory duty, receive appropriate training, and have access only as needed for their role.

7. Security measures

Zantrey will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to individuals. These measures include:

• Encryption: encryption of data in transit over public networks using TLS, and encryption at rest of the databases and backups that store Customer Data.
• Access control in the product: individual user accounts, passwords stored only as salted hashes, role-based permissions that let the Customer decide which Users can see and change each kind of record, and the ability for the Customer to revoke access at any time.
• Audit log: a record of significant actions in the Cloud Service, such as sign-ins, changes to records and settings, and administrative actions, available to the Customer's administrators.
• Separation: logical separation of each customer's data from that of other customers.
• Access to production systems: limited to a small number of authorized personnel on a least-privilege basis, protected by strong authentication including multi-factor authentication, and logged.
• Backups and resilience: regular automated backups, stored separately from the primary systems and kept for no more than 35 days, with periodic restore tests, and monitoring of the availability of the Cloud Service.
• Vulnerability management: timely application of security updates to software and infrastructure, review of code changes before release, and monitoring of third-party components for known vulnerabilities.
• Incident response: documented procedures for detecting, investigating and responding to security incidents.
• Organizational measures: confidentiality obligations and security awareness for personnel, and due diligence on Sub-processors.

Zantrey may update these measures over time, provided that the overall level of protection is not reduced.

8. Sub-processors

The Customer gives Zantrey general authorization to engage Sub-processors, such as hosting, backup storage and email delivery providers, to process Customer Personal Data. The current list of Sub-processors, with their function and location, is available on request at privacy@zantrey.com.

Zantrey will give the Customer at least 30 days' notice before a new Sub-processor starts processing Customer Personal Data, by email to the account's administrators or by notice in the Cloud Service. Within that period, the Customer may object on reasonable grounds relating to data protection. The parties will then discuss the objection in good faith; if Zantrey cannot reasonably accommodate it, the Customer may terminate the affected part of the Services and receive a refund of prepaid Fees for the remainder of the Subscription Term.

Zantrey will impose on each Sub-processor data protection obligations no less protective than those in this DPA, and remains responsible for its Sub-processors' performance of those obligations.

9. Assistance

The Cloud Service lets the Customer find, export, correct and delete personal data in Modulix. Taking into account the nature of the processing, Zantrey will provide reasonable further assistance to help the Customer respond to requests from data subjects exercising their rights. If Zantrey receives such a request directly, it will refer the data subject to the Customer, or forward the request to the Customer, and will not respond to it itself unless the Customer authorizes it.

Taking into account the information available to it, Zantrey will also provide reasonable assistance with the Customer's data protection impact assessments, prior consultations with supervisory authorities, and security obligations.

10. Personal Data Breaches

Zantrey will notify the Customer of a Personal Data Breach without undue delay, and in any event within 72 hours of becoming aware of it. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it, and will be supplemented as more information becomes available. Zantrey will take reasonable steps to contain and remedy the breach and will cooperate with the Customer in meeting its own notification obligations. Notifying a Personal Data Breach is not an acknowledgement of fault or liability.

11. International transfers

Zantrey and its Sub-processors may process Customer Personal Data in countries other than the one in which the Customer or the data subjects are located, subject to this section. Where Customer Personal Data subject to the GDPR, the UK GDPR or Swiss law is transferred to a country that is not recognized as providing an adequate level of protection, the Standard Contractual Clauses adopted by the European Commission (Module Two, controller to processor, or Module Three, processor to processor, as applicable), together with the UK International Data Transfer Addendum or the adjustments required by Swiss law where relevant, are incorporated into this DPA and apply to that transfer. Zantrey will put equivalent safeguards in place with its Sub-processors.

12. Deletion and return

When the Cloud Service ends, the Customer may export Customer Personal Data for 30 days as described in the Terms of service. Zantrey will then delete Customer Personal Data from its live systems within a further 30 days. Copies held in backups are deleted when the backups are rotated out, within 35 days. Where the law requires Zantrey to keep any Customer Personal Data, it will continue to protect it under this DPA and process it only for that purpose. Zantrey will confirm deletion in writing on request.

13. Audits

Zantrey will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires and any independent audit reports or summaries it has available. If that information is not enough to demonstrate compliance, or a supervisory authority requires it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, no more than once a year, on at least 30 days' written notice, during normal business hours, and in a way that does not disrupt Zantrey's operations or compromise the security or confidentiality of other customers' data. The parties will agree the scope in advance, and the Customer bears its own costs. Additional audits are permitted after a Personal Data Breach affecting the Customer or where a supervisory authority requires them.

14. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of service, except where Data Protection Laws do not allow it. If this DPA and the Terms of service conflict on a matter of data protection, this DPA prevails; if this DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses prevail.

15. Contact

Questions about this DPA, requests for the Sub-processor list, or a countersigned copy: privacy@zantrey.com, or 12565544 Canada Inc. (Zantrey), Attention: Privacy, 7030 Woodbine Ave, Suite 500, Markham, Ontario L3R 6G2, Canada. This DPA is effective as of October 19, 2026.