Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the Terms of Service between ZeroLapse Limited and the Customer where ZeroLapse processes Customer Personal Information to provide the service. If this DPA conflicts with the Terms on Customer Personal Information, this DPA prevails for that subject matter.

• Customer Personal Information means personal information contained in Customer Data that ZeroLapse processes to provide the service on the Customer’s behalf.
• Privacy Law means the New Zealand Privacy Act 2020 and any other privacy or data-protection law that applies to the relevant processing.
• Security Incident means unauthorised or accidental access, disclosure, alteration, loss, destruction or material unavailability of Customer Personal Information.
• Subprocessor means a third-party service provider engaged by ZeroLapse to process Customer Personal Information in connection with the service.

The Customer determines why Customer Personal Information is entered into ZeroLapse and is responsible for lawful collection, transparency, indirect-collection notices where required, accuracy, retention decisions, user permissions and responses to individuals. ZeroLapse processes Customer Personal Information to provide, secure, support and maintain the service, follow Customer instructions expressed through the agreement and service configuration, comply with law, and protect the service and users.

ZeroLapse limits access to people who need it for authorised support, maintenance, security, legal or operational purposes and requires appropriate confidentiality. Customer Data must not be accessed for unrelated purposes.

• Authenticated access and role-based permissions for Admin, Manager and Staff roles.
• Database-level row-level security on tenant data.
• Organisation identity derived from the authenticated session rather than trusted client-supplied organisation identifiers.
• Database-enforced ownership controls for staff proposal workflows.
• Private evidence storage with organisation-scoped storage controls and authenticated access.
• Audit events for mutations, including approval and decline actions.
• Risk-based testing and release controls that prioritise cross-tenant isolation.
• Monitoring and incident investigation processes appropriate to the size and risk of the service.

ZeroLapse may update its security measures as the service evolves, provided the overall protection of Customer Personal Information is not materially reduced without a reasonable substitute. No specific certification, penetration-test status, uptime SLA, backup retention, RPO or RTO is included unless expressly agreed in writing.

The Customer authorises ZeroLapse to use subprocessors reasonably necessary to operate the service. Current key providers that may process Customer Personal Information depending on the feature or interaction include Supabase (database, authentication and private storage; Sydney region), Vercel (application hosting; Sydney region), Stripe (payments), Resend (transactional email), Sentry (error monitoring), Cloudflare (DNS/security services), and Microsoft 365 (business communications and administration). ZeroLapse will keep its provider/subprocessor position under review so the customer-facing list reflects actual processing rather than treating every supplier as a subprocessor by default.

ZeroLapse will keep a current subprocessor list and will use reasonable efforts to notify Customers of a new subprocessor that materially changes the processing of Customer Personal Information. A Customer may raise a reasonable privacy or security objection. The parties will work in good faith to address it; if no reasonable alternative is available, either party may terminate the affected service in accordance with the Terms.

Customer Personal Information may be processed outside New Zealand, including in Australia. Where an overseas provider acts only as ZeroLapse’s agent for storage or processing, the Privacy Act 2020 treats that arrangement differently from a disclosure to a foreign recipient. Where an overseas disclosure is subject to Information Privacy Principle 12, ZeroLapse will use an available lawful basis and appropriate safeguards. The Customer remains responsible for its own privacy notices and assessment of its use of the service.

Where Customer Personal Information is collected indirectly, the Customer is responsible for assessing whether IPP 3A requires notice to the individual and for providing that notice unless an exception applies. ZeroLapse will provide reasonable information about its service and processing to support that notice.

Taking account of the nature of the processing and information available, ZeroLapse will provide reasonable assistance with access, correction and privacy enquiries relating to Customer Personal Information. Where ZeroLapse receives a request concerning Customer-controlled records, it may direct or transfer the request to the Customer unless law requires otherwise.

ZeroLapse will notify the Customer without undue delay after confirming a Security Incident that materially affects Customer Personal Information and will provide information reasonably available about the nature of the incident, affected information, containment and remediation. Each party remains responsible for notifications it is legally required to make. ZeroLapse will make its own Privacy Act notifications as soon as practicable where the statutory serious-harm threshold is met.

During an active subscription, the Customer may use available export features. ZeroLapse’s current operating intention is to provide up to 30 days after cancellation or termination for an available export request where access is not restricted for security or legal reasons. After that period, ZeroLapse may delete or de-identify Customer Personal Information from active systems, subject to technical deletion cycles and retention required for law, accounting, fraud prevention, security or disputes. Backup copies, where they exist under the applicable provider plan, remain protected and are not treated as active customer access copies.

On reasonable request, ZeroLapse will provide information reasonably necessary to explain its material compliance with this DPA, subject to confidentiality, security, proportionality and protection of other customers. Formal audits require reasonable notice, must avoid disruption and access to other customers’ data, and will normally rely first on available policies, architecture information, security responses and evidence.

The liability provisions in the Terms apply to this DPA to the extent lawful. A material breach of this DPA may constitute a material breach of the Terms. Provisions that by their nature should survive termination, including confidentiality and permitted retention limitations, continue to apply.

Privacy and DPA enquiries: hello@zerolapse.co.nz (subject: Privacy / DPA)