1. Parties and scope
This DPA forms part of the RecordLint agreement between the Zendesk customer (Controller) and Mykhailo Ihnatiev, NIP 8971938345, Komuny Paryskiej 58, lok. 40, 30-389 Krakow, Poland (Processor). GDPR terms have their statutory meanings where applicable.
2. Documented instructions
Processor will process Customer Data only under the agreement, product configuration, and explicit administrator actions, unless law requires otherwise. Processing is limited to authentication, administrator-requested read-only scanning, deterministic rule evaluation, explainable findings, reporting, security, support, retention, and deletion.
Controller determines the lawful basis, notices, scope, configuration, and any remediation it performs in Zendesk. RecordLint findings are recommendations and are not autonomous decisions.
3. Confidentiality and security
Authorized personnel are subject to confidentiality. Technical measures include signed Zendesk requests, account-bound read-only OAuth, short-lived sessions, tenant-scoped database access with forced row-level security, TLS in transit, AES-256-GCM field encryption, tenant-scoped HMAC values, data-minimized logs, bounded retries, a maximum 24-hour raw-profile workspace, and tested tenant-erasure controls.
Production-specific infrastructure, key-management, backup, access-review, vulnerability-management, incident-response, and business-continuity evidence will be completed before this DPA is offered for customer acceptance.
4. Subprocessors
Controller authorizes the providers on the Subprocessors page. Processor remains responsible for equivalent contractual protection and will provide at least 30 days' notice of a material new subprocessor where required. Controller may object on reasonable data-protection grounds.
5. Assistance
Considering the nature of processing, Processor will reasonably assist with data-subject rights, data protection impact assessments, regulator consultations, and information needed to demonstrate compliance.
6. Security incidents
Processor will notify Controller without undue delay and no later than 48 hours after confirming a Customer Data breach, and provide available information about its nature, likely consequences, affected data, and remediation. Information may be provided in phases as it becomes available. Security contact: security@recordlint.com.
7. Return, deletion, and audit
CSV reports are generated only on explicit request and are not retained by Processor. On termination or verified instruction, Processor will delete Customer Data unless law requires retention. Protected production backups expire after 30 days and are permanently deleted within the following 7 days. They remain unavailable for ordinary use and are restored only for disaster recovery.
Processor will provide current security documentation or third-party reports where available. If legally required and those materials are insufficient, Controller may conduct one reasonable audit per year with advance notice, confidentiality, minimal disruption, and no access to another customer's data or Processor secrets.
8. International transfers
Processing locations appear on the Subprocessors page. For restricted transfers from the EEA, UK, or Switzerland, the parties will use an adequacy decision or the applicable EU Standard Contractual Clause modules adopted under Commission Implementing Decision (EU) 2021/914 and the UK Addendum where selected, together with supplementary measures where required.
Annex A — processing details
- Subject: administrator-requested audit of Zendesk end-user data quality.
- Duration: agreement term plus disclosed retention and deletion periods.
- Nature and purpose: read-only collection, encryption, deterministic comparison and rule evaluation, display, local review decisions, streamed reporting, security, and deletion.
- Data subjects: Customer's Zendesk administrators and end users.
- Data: numeric identifiers; name; email or phone identity and verification; external ID; organization membership; profile status and dates; selected custom fields; aggregate related-record counts; and audit identifiers.
- Sensitive data: not intentionally requested. Customer must not configure special-category processing unless separately agreed and lawful.
- Frequency: connection verification and administrator-requested actions only; no scheduled background customer-data collection.