Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the ZIPATO Terms of Service between you and Tri plus grupa d.o.o. (“ZIPATO”, “we”, “us”). It applies if you are a paying subscriber to the Service and ZIPATO processes Personal Information contained in User Content on your behalf in the provision of the Service. Terms that are not defined here have the meaning given in the Terms of Service.

Definitions

  • “GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation), and, where applicable, the national laws that implement or supplement it.
  • “Personal Information” means any information relating to an identified or identifiable natural person that ZIPATO processes on your behalf as part of User Content in the provision of the Service.
  • “Controller”, “Processor”, “Data Subject”, “Processing”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the GDPR.
  • “Sub-processor” means any third party that ZIPATO engages to process Personal Information on your behalf.
  • “Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914.

Roles of the parties

  • For the Personal Information, you are the Controller (or a Processor acting on behalf of your own Controller) and ZIPATO is your Processor (or Sub-processor).
  • You are responsible for having a lawful basis for the Processing and for the instructions you give, and for providing any information to Data Subjects that the GDPR requires.

Details of the processing

  • Subject matter and duration: the provision of the Service to you, for the term of your subscription and until the Personal Information is deleted as set out in this DPA.
  • Nature and purpose: hosting, storing, transmitting and otherwise processing User Content so that you can monitor, control and automate the homes, devices and users connected to the Service, and providing support.
  • Categories of Data Subjects: you, your end users and the members of the homes you manage through the Service, and any other persons whose data you submit to the Service.
  • Categories of Personal Information: names, email and postal addresses and other contact details; account and user data; data about homes, rooms, devices, automation rules and groups created through the Service; device status, sensor and event data; and any other Personal Information you submit to the Service. You should not submit special categories of personal data to the Service unless it is necessary for your use of the Service.

ZIPATO’s obligations

  • ZIPATO will process Personal Information only on your documented instructions, including with regard to transfers to third countries, unless required to do so by EU or member state law, in which case ZIPATO will inform you of that legal requirement before processing, unless the law prohibits this. The Terms of Service, this DPA and your use and configuration of the Service are your instructions. ZIPATO will tell you if, in its opinion, an instruction infringes the GDPR.
  • ZIPATO will ensure that persons authorised to process Personal Information have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  • ZIPATO will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR (see “Security measures” below).
  • Taking into account the nature of the processing, ZIPATO will assist you by appropriate technical and organisational measures, insofar as possible, in responding to requests from Data Subjects exercising their rights under the GDPR. If ZIPATO receives such a request directly, it will refer the Data Subject to you.
  • ZIPATO will assist you in ensuring compliance with your obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to ZIPATO.
  • ZIPATO will make available to you all information necessary to demonstrate compliance with Article 28 of the GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, on reasonable prior written notice, during normal business hours and no more than once a year unless required by a Supervisory Authority or following a Personal Data Breach. You bear the costs of any audit.

Personal Data Breaches

ZIPATO will notify you without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting your Personal Information, and will provide the information you reasonably need to meet your own obligations to notify Supervisory Authorities and Data Subjects.

Sub-processors

  • You give ZIPATO general authorisation to engage Sub-processors, such as hosting and infrastructure providers, to provide the Service. The current list of Sub-processors is available on request from hello@zipato.com.
  • ZIPATO will inform you of any intended addition or replacement of Sub-processors, giving you the opportunity to object on reasonable data protection grounds. If we cannot reasonably address your objection, you may terminate the affected part of the Service.
  • ZIPATO will impose on each Sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, and remains fully liable to you for the performance of its Sub-processors’ obligations.

International transfers

  • ZIPATO may process Personal Information, or have it processed by Sub-processors, outside the European Economic Area only where the transfer complies with Chapter V of the GDPR, for example on the basis of an adequacy decision of the European Commission or the Standard Contractual Clauses.
  • Where the Standard Contractual Clauses apply to a transfer between you, as data exporter, and ZIPATO, as data importer, they are incorporated into this DPA by reference, with Module Two (controller to processor) or Module Three (processor to processor) as applicable, and with the following choices: Clause 7 (docking clause) applies; under Clause 9, option 2 (general written authorisation) applies, with notice as set out under “Sub-processors” above; the optional wording in Clause 11 does not apply; Clause 17 is governed by the laws of the Republic of Croatia; and under Clause 18, disputes are resolved by the courts of the Republic of Croatia. Annex I of the Standard Contractual Clauses is completed with the parties and the details of the processing in this DPA, Annex II with the security measures below, and Annex III, where applicable, with the list of Sub-processors. The competent Supervisory Authority is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka).
  • If the Standard Contractual Clauses conflict with this DPA or the Terms of Service, the Standard Contractual Clauses prevail.

Security measures

ZIPATO maintains technical and organisational measures appropriate to the risk, which include:

  • encryption of data in transit between devices, controllers, apps and the Service;
  • access controls that limit access to Personal Information to authorised personnel who need it to provide and support the Service;
  • authentication of users and controllers connecting to the Service;
  • regular backups of the Service’s databases;
  • logging and monitoring of the Service’s systems; and
  • regular review of these measures, which ZIPATO may update as long as the overall level of security is not reduced.

Return and deletion

When your subscription ends, ZIPATO will, at your choice, delete or return the Personal Information, and delete existing copies within a reasonable period, unless EU or member state law requires ZIPATO to store it. To receive a copy of your Personal Information, contact us at hello@zipato.com before your subscription ends.

General

This DPA applies for as long as ZIPATO processes Personal Information on your behalf. If this DPA conflicts with the Terms of Service, this DPA prevails with respect to the processing of Personal Information. The limitation of liability in the Terms of Service applies to this DPA, to the extent permitted by the GDPR. The governing law and jurisdiction provisions of the Terms of Service also apply to this DPA, except where the Standard Contractual Clauses provide otherwise. ZIPATO may update this DPA by publishing a new version on this page, provided that the update does not reduce the level of protection of Personal Information. You can contact us at hello@zipato.com.