This Data Processing Addendum ("DPA") forms part of the agreement between VZENN LABS PRIVATE LIMITED ("Vzenn", "Processor") and the organisation using the Service (the "Customer", "Controller"). It governs Vzenn's processing of personal data on the Customer's behalf and reflects the requirements of India's Digital Personal Data Protection Act, the GDPR, the UK GDPR, and comparable data protection laws. Capitalised terms not defined here have the meaning given in the Terms of Service.
1. Roles of the parties
For personal data contained in Customer Data, the Customer is the Controller and Vzenn is the Processor, processing only on the Customer's documented instructions. Where the Customer is itself a processor for a third party, Vzenn acts as a sub-processor and the same obligations apply.
2. Subject matter & duration
Subject matter: Vzenn's provision of the Service. Duration: the term of the agreement plus any period during which Vzenn retains Customer Data as permitted by section 11. Nature & purpose: hosting, transmitting, and processing Customer Data to provide HR, projects, knowledge-base, chat, and calls/meetings functionality, including (where enabled) transcription and AI summaries.
3. Processing instructions
Vzenn processes personal data only on the Customer's documented instructions, including as set out in the agreement, the Service's configuration, and this DPA, unless required otherwise by law (in which case Vzenn will inform the Customer unless legally prohibited). Vzenn ensures that personnel authorised to process personal data are bound by confidentiality.
4. Categories of data & data subjects
| Data subjects | Categories of personal data |
|---|---|
| Customer's employees, contractors, and admins | Identity & contact details, profile, role/department, HR records (attendance, leave, overtime, probation, payroll inputs), messages and files, meeting participation, and — where enabled — recordings, transcripts, and summaries. |
| External guests invited to meetings | Name, email, and meeting participation data; recording/transcript data where capture is enabled and consent captured. |
The Customer must not submit special-category data except as contemplated by the Service and the applicable law, and is responsible for the lawfulness of the personal data it provides.
5. Security measures
Vzenn implements appropriate technical and organisational measures, including: encryption of data in transit (TLS) and at rest; token-gated, scoped access to files; least-privilege access controls and authentication; audit logging; segregation of Customer data; secure software-development practices; and optional end-to-end encryption for meeting media. Measures are reviewed and improved over time; a current summary is available on request.
6. Subprocessors
The Customer authorises Vzenn to engage the subprocessors listed below to process personal data. Vzenn imposes data-protection obligations on each subprocessor no less protective than those in this DPA and remains responsible for their performance.
| Subprocessor | Purpose | Location |
|---|---|---|
| DigitalOcean | Cloud hosting & object storage (Spaces) | India (Bangalore) |
| Cloudflare | Edge / content delivery & security | Global |
| Deepgram | Speech-to-text transcription (when enabled) | United States |
| Anthropic | AI meeting summaries (when enabled) | United States |
| Resend | Transactional email | United States |
| Apple / Google | Mobile push notifications (APNs / FCM) | Global |
| Google & Microsoft | Calendar integration (Google Calendar / Outlook via Graph), when connected | Global |
Vzenn will give the Customer at least 30 days' notice before adding or replacing a subprocessor (by email to the Customer's workspace administrators), during which the Customer may object on reasonable data-protection grounds. Note that self-hosted call media (LiveKit) runs on Vzenn's own infrastructure and is not a third-party subprocessor.
7. Assistance with data-subject requests
Taking into account the nature of the processing, Vzenn will provide reasonable assistance — through the Service's features and, where necessary, additional support — to help the Customer respond to data-subject requests (access, rectification, erasure, restriction, portability, and objection). Where a data subject contacts Vzenn directly about Customer Data, Vzenn will refer them to the Customer.
8. Personal-data breach notification
Vzenn will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data, and will provide information reasonably available to help the Customer meet its own notification obligations.
9. Audits
Vzenn will make available information reasonably necessary to demonstrate compliance with this DPA — including, where available, summary documentation and third-party reports — and will allow for and contribute to audits, including inspections, conducted by the Customer or an appointed auditor on reasonable prior notice, subject to confidentiality and to reasonable frequency and scope limits.
10. International transfers
Customer Data is primarily hosted in India. Where Vzenn transfers personal data outside India, the EEA, the UK, or another jurisdiction with data-transfer restrictions, it will do so under an appropriate transfer mechanism — such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum — which are incorporated by reference where applicable, and in accordance with applicable Indian data-protection law.
11. Return & deletion
On termination of the Service, and on the Customer's request, Vzenn will delete or return Customer Data within 30 days, except to the extent retention is required by law. The Service also lets the Customer delete specific data during the term, including a meeting's transcript and AI summary; call recordings are removed automatically under a fixed retention schedule.
12. General
If there is a conflict between this DPA and the Terms of Service on the processing of personal data, this DPA controls. This DPA is governed by the same law as the Terms. All other provisions of the agreement remain in effect.
DPA enquiries: [email protected].