Data Processing Agreement

How this DPA applies

Upon completion of review by external counsel, this DPA is automatically incorporated into the Master Terms of Service for all customers whose use of the Services involves the processing of personal data on the customer’s behalf — no separate signature is required; acceptance of the Terms constitutes acceptance of this DPA.

Enterprise customers may alternatively execute a countersigned copy of this DPA, which then governs in place of the incorporated version for that customer. Request one at privacy@zephyra.tech.

Our current public list of sub-processors is maintained at /legal/subprocessors.

DPA text

This Data Processing Agreement (“DPA”) forms part of the agreement between the Customer and Zephyra for the provision of the Services (the “Principal Agreement”) and is entered into by and between:

(1) the Customer — the legal entity that has accepted the Terms of Service or executed an Order Form referencing this DPA (the “Controller”); and

(2) QTOOL S.r.l., trading as Zephyra, registered office at Via Sarus 4, 11026 Pont Saint Martin (AO), Italy, C.F. / P.IVA 01248980078, REA AO-79488 (the “Processor” or “Zephyra”),

each a “Party” and together the “Parties”. This DPA is effective on the date the Customer accepts the Terms of Service or, where separately executed, on the date of last signature (the “Effective Date”).

1. Definitions

1.1 Capitalised terms not defined here have the meaning given in Regulation (EU) 2016/679 (“GDPR”). “Controller”, “Processor”, “Processing”, “Personal Data”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have their GDPR meanings.

1.2 “Applicable Data Protection Law” means the GDPR and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, and any other applicable data-protection law.

1.3 “Customer Personal Data” means Personal Data contained in the data the Customer or its users upload to or generate within the Services and that the Processor Processes on the Customer’s behalf, as described in Annex 1.

1.4 “Sub-processor” means a third party engaged by the Processor to Process Customer Personal Data.

1.5 “Standard Contractual Clauses” / “SCCs” means the clauses approved by Commission Implementing Decision (EU) 2021/914.

1.6 “Services” and “Order Form” have the meanings given in the Principal Agreement; “EEA” means the European Economic Area; “Privacy Notice” means the Processor’s privacy notice at zephyra.tech/legal/privacy; “Deletion/Return Capability” means the operational capability described in clause 9.2.

2. Scope and roles

2.1 In respect of Customer Personal Data, the Customer is the Controller and Zephyra is the Processor. The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.

2.2 This DPA governs only Zephyra’s Processing of Customer Personal Data as a Processor. Zephyra’s Processing of account-administration, billing and marketing data, and of in-platform product analytics (usage events processed for Zephyra’s own product-improvement purposes, as described in its Privacy Notice), for which Zephyra is an independent controller (Article 28(10) GDPR) with its own legal basis, is governed by its Privacy Notice and is outside the scope of this DPA.

2.3 The Customer is responsible for the lawfulness of the Processing it instructs, including having a valid legal basis under Articles 6 and 9 GDPR and providing all required information to Data Subjects.

2.4 Local processing via the desktop edition. Where the Customer uses the desktop edition of the Services in a configuration in which files are read and processed locally on the Customer’s own hardware, and the data concerned is not transmitted to or stored on systems operated by the Processor or its Sub-processors, the Processor does not Process that data and this DPA does not apply to it. This DPA governs only Customer Personal Data that actually reaches systems operated by the Processor or its Sub-processors.

3. Processing on documented instructions

3.1 The Processor shall Process Customer Personal Data only on the Customer’s documented instructions, including as to international transfers, unless required by Union or Member State law, in which case it shall inform the Customer (unless legally prohibited).

3.2 The Customer’s instructions are constituted by this DPA, the Principal Agreement, the Customer’s configuration of the Services, and any further written instructions. Annex 1 sets out the initial instructions.

3.3 The Processor shall immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

3.4 AI-assisted features. The Services include optional AI-assisted analysis, chat and drawing-review features. When a user invokes such a feature, the content the user submits and the project context needed to answer are transmitted to the AI provider(s) identified in Annex 3 (as at the Effective Date, Google’s Gemini API); Customer Personal Data is transmitted to an AI provider only in the course of responding to such a user-invoked request. Under Google’s service terms applicable to this use, submitted content is not used to train or improve Google’s models. AI providers are Sub-processors under clause 6, and the transfer safeguards recorded in Annex 4 apply to them.

3.5 Proprietary machine-learning models. The Services also include Zephyra’s proprietary machine-learning models (physics surrogates and costing / manufacturing-time prediction). These run on the Processor’s own infrastructure described in Annex 3 — or on the Customer’s own infrastructure where deployed on-premise, in which case clause 2.4 applies to data that does not reach the Processor’s systems — and involve no third-party AI provider. Models trained for a customer organisation are trained on that organisation’s data and serve only that organisation. Customer Personal Data is not used to train models made available to other customers.

4. Confidentiality

4.1 The Processor shall ensure that persons authorised to Process Customer Personal Data are bound by an appropriate obligation of confidentiality and Process the data only as instructed.

5. Security

5.1 Taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risks to Data Subjects, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. The measures in place as at the Effective Date are described in Annex 2, and are reviewed and updated as the Services evolve.

6. Sub-processors

6.1 The Customer grants the Processor general written authorisation to engage Sub-processors. The Sub-processors engaged as at the Effective Date are listed in Annex 3 and maintained at /legal/subprocessors.

6.2 The Processor shall inform the Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days in advance, by updating the sub-processor page and/or by email notice, giving the Customer the opportunity to object on reasonable data-protection grounds within that period. The Parties shall work in good faith to resolve any objection; if it cannot be resolved, the Customer may terminate the affected part of the Services as its sole remedy.

6.3 The Processor shall impose on each Sub-processor, by written contract, data-protection obligations equivalent to those in this DPA, in particular the obligations under Articles 28 and 32 GDPR; the data-processing terms applicable to each Sub-processor are identified in Annex 3. The Processor remains fully liable to the Customer for the performance of each Sub-processor’s obligations.

7. Assistance to the Controller

7.1 Taking into account the nature of the Processing, the Processor shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer’s obligation to respond to requests to exercise Data Subject rights under Chapter III GDPR: (a) for access, rectification, restriction and objection, via the access controls and audit logging described in Annex 2; (b) for erasure and data portability, via the Deletion/Return Capability (clause 9.2).

7.2 The Processor shall assist the Customer in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of Processing and the information available to the Processor.

7.3 Assistance under this clause 7 beyond routine support may be charged at reasonable rates as set out in the Principal Agreement, save where the GDPR requires it to be provided free of charge.

8. Personal Data Breach

8.1 The Processor shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and shall provide the information reasonably required for the Customer to meet its obligations under Articles 33 and 34 GDPR.

9. Return or deletion

9.1 At the Customer’s choice, the Processor shall delete or return all Customer Personal Data to the Customer after the end of the provision of the Services, and delete existing copies, unless retention is required by Union or Member State law.

9.2 Deletion/Return Capability. The Processor maintains, as part of the Services: (a) a self-serve export of a user’s complete data (profile, database records and stored files, in commonly used electronic formats), available at any time; (b) a self-serve account-deletion path that irreversibly removes the user’s database records, stored files and account; and (c) a support-run per-tenant purge for offboarding and Article 17 requests, confirmed to the Customer in writing on completion. Service levels: export immediately (self-serve) or within fourteen (14) days when run by support; deletion and purge actioned within thirty (30) days of a verified request.

9.3 Any residual copies of Customer Personal Data in backups, where maintained, remain subject to all obligations of this DPA (in particular confidentiality and security), are not Processed for any other purpose, and are deleted or overwritten no later than ninety (90) days after the deletion or return under clause 9.1.

10. Audits

10.1 The Processor shall make available to the Customer information necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates. Audits are limited to once per twelve (12) months (and additionally following a Personal Data Breach or at the request of a Supervisory Authority), on reasonable prior notice, during business hours, subject to confidentiality, and with the Customer bearing its own audit costs. Where the scope of a requested audit is addressed in a certification or audit report issued by a qualified independent auditor within the preceding twelve (12) months, the Customer agrees to accept that report in satisfaction of the request. The Processor may charge reasonable costs for on-site inspections exceeding one business day, save where the audit reveals material non-compliance.

10.2 The Processor shall maintain a record of all categories of Processing activities carried out on behalf of the Customer in accordance with Article 30(2) GDPR and shall make it available to the Customer and, on request, to the Supervisory Authority.

11. International transfers

11.1 The Processor shall not transfer Customer Personal Data outside the EEA, nor permit such access from outside the EEA, without ensuring an appropriate safeguard under Chapter V GDPR, such as an adequacy decision, the SCCs (in the applicable module), or the EU-US Data Privacy Framework (“DPF”) where the recipient’s certification is current and verified. Transfer details are set out in Annex 4.

11.2 The third-country flows on which the Services depend are those identified in Annex 3, with the safeguard relied on for each recorded in Annex 4. These records are reviewed as certifications are renewed; the SCCs recorded in Annex 4 serve as the fallback mechanism where a certification lapses.

12. Deployment

12.1 The Services are provided under a standard multi-tenant deployment operated by the Processor, unless the Principal Agreement or an Order Form specifies a single-tenant deployment in the Customer’s own cloud account in an EU region, in which case Customer Personal Data is stored and Processed within the Customer’s tenancy.

13. Liability

13.1 Each Party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Principal Agreement, save that nothing limits liability that cannot be limited under Applicable Data Protection Law. If the Principal Agreement contains no limitation of liability that expressly applies to claims under this DPA, or excludes data-protection claims from its cap, each Party’s aggregate liability under this DPA shall not exceed the fees paid or payable by the Customer in the twelve (12) months preceding the event giving rise to liability.

14. Term

14.1 This DPA takes effect on the Effective Date and survives in full for as long as the Processor or any Sub-processor retains any Customer Personal Data, including copies retained under clause 9.1 or 9.3.

15. Governing law and contact

15.1 This DPA is governed by Italian law; the courts of Milan, Italy have exclusive jurisdiction, without prejudice to Data Subjects’ rights.

15.2 In case of conflict between this DPA and the Principal Agreement on data-protection matters, this DPA prevails.

15.3 Data-protection contact at Zephyra: Data Protection Contact, QTOOL S.r.l. — privacy@zephyra.tech.

Execution

For customers on the standard Terms of Service, this DPA is concluded in electronic form through acceptance of the Terms (Article 28(9) GDPR) — no signature page is required. Enterprise customers executing a countersigned copy use the signature version available from privacy@zephyra.tech.

Annex 1 — Particulars of Processing

• Subject matter: provision of Zephyra’s cloud-based industrial mould/die optimisation platform.
• Duration: the term of the Principal Agreement.
• Nature and purpose: hosting, storage, computation, simulation, machine-learning-based prediction (physics surrogates, costing and manufacturing-time estimation — clause 3.5), collaboration and support, to deliver the Services on the Customer’s instructions. AI-assisted analysis occurs only when a user actively invokes an AI-assisted feature (clause 3.4). Data read and processed solely locally by the desktop edition on the Customer’s hardware, and not transmitted to the Processor’s systems, is not Processed by the Processor (clause 2.4).
• Types of Personal Data: identification and contact data of the Customer’s authorised users (name, business email, phone, role); authentication identifiers; usage and audit data relating to the Customer’s tenancy (project audit logs and related records); and any Personal Data the Customer embeds within uploaded project/CAD files.
• Special categories: none intended; the Customer shall not upload special-category data (Article 9 GDPR — e.g. health or biometric data), data relating to criminal convictions (Article 10), children’s data, payment-card data or government-issued identifiers without a separate written agreement.
• Categories of Data Subjects: the Customer’s personnel and authorised users; the Customer’s business contacts as included by the Customer.

Annex 2 — Technical and Organisational Measures (Article 32)

Measures in place as at the Effective Date (reviewed and enhanced over time):

• Access control: role-based access control at organisation, project and team level; least-privilege application access.
• Authentication: single sign-on via Microsoft Entra ID; credential hashing for local accounts; opt-in multi-factor authentication (TOTP) available on all accounts, with one-time recovery codes.
• Tenant isolation: logical separation of each customer organisation’s data, enforced at the application layer.
• Encryption in transit: TLS for all client–server and service traffic.
• Encryption at rest: provider-managed encryption at rest on Google Cloud infrastructure (persistent disks and storage).
• Network security: application and processing services are not exposed to the public internet; the public tier applies rate-limiting and origin allow-listing behind TLS-terminating reverse proxies.
• Logging: application audit logging of actions on projects (actor, action, resource, timestamp).
• Data lifecycle: self-serve data export and account deletion; support-run per-tenant purge with a written deletion statement and zero-remaining verification (clause 9.2).
• Secure development & operations: version-controlled code with review before merge, containerised deployment, and separation of production and test environments.

The Processor operates its security programme in alignment with ISO/IEC 27001 and reviews and enhances these measures over time.

Annex 3 — Authorised Sub-processors

Annex 4 — International Transfer Details

For each Sub-processor Processing Customer Personal Data outside the EEA, the Chapter V safeguard relied on is recorded below:

DPF participation can be checked on the official Data Privacy Framework list.

Certification status is reviewed at each provider’s annual DPF recertification; the SCCs recorded above serve as the fallback mechanism (clause 11.2).