Data Processing Addendum

Roles of the parties

For personal data you submit through the Services, you act as the controller (or processor on behalf of your own customers) and Zumik acts as your processor (or sub-processor). Zumik processes such data only on your documented instructions, which include the configuration choices you make in the console.

Scope and nature of processing

Zumik processes data to route inference requests, measure reuse, produce diagnostics, enforce policy, and bill usage. The categories of data and data subjects are determined by your use of the Services. Default tracing is metadata-only; content processing depends on the trace mode you select per project.

Sub-processors

Zumik engages the sub-processors listed on the sub-processors page, each bound by data-protection terms consistent with this DPA. We provide advance notice of material changes so you may object where you have that right.

Security measures

Zumik maintains technical and organizational measures appropriate to the risk, including tenant isolation, opaque handles, layered access controls, secret hygiene, supply-chain integrity, and audit logging. These measures are described further in the security overview.

Data subject rights and assistance

Taking into account the nature of processing, Zumik assists you in responding to data subject requests and implements right-to-erasure handling via delete and purge workflows that emit deletion evidence.

International transfers

Where personal data is transferred across borders, the DPA incorporates appropriate safeguards (such as Standard Contractual Clauses) where required by applicable law. BYOC and regional profiles can constrain processing to specific regions.

How to execute

To put the DPA in place, contact [email protected]. We will provide the current executable version for signature.