Data Processing Agreement

Proposed terms · 30 September 2026

How Sunzu processes personal data on behalf of its business customers.

Draft for review. The supplier and transfer schedules must be completed for the applicable service before this DPA is used. This draft does not replace an existing contract, authorise an unlisted supplier or establish a transfer safeguard merely by being published.

1. Parties and scope

This DPA forms part of the customer agreement or other contract that expressly incorporates it. The parties are the Customer and the Sunzu provider named in the accepted order. Alpha Base OS Ltd serves UK, Swiss and EEA customers; Sunzu, Inc. serves customers elsewhere. Their identities, addresses and privacy contact are on the company details page. The Customer’s legal name, address and authorised contact must appear in the order.

Customer Personal Data means personal data in inputs, research materials, generated outputs and other information Sunzu processes on the Customer’s behalf. Applicable Data Protection Law means the EU GDPR, UK GDPR and Data Protection Act 2018, Swiss Federal Act on Data Protection, and other privacy laws applicable to that processing. Relevant statutory definitions apply.

The Customer acts as controller, or as processor on behalf of its own controller. Sunzu acts respectively as processor or subprocessor. A Customer acting as processor must have the controller’s authority to appoint Sunzu and pass on lawful instructions. Account administration, billing and Sunzu’s other independently determined purposes are separately addressed in the privacy notice. Roles follow the actual purpose and conduct, not a contractual label.

2. Instructions and processing details

Sunzu will process Customer Personal Data only on documented instructions in the agreement, order and authorised use of the service, including instructions about transfers, unless law requires otherwise. Sunzu will inform the Customer of a legal requirement before processing unless legally prohibited. It will immediately inform the Customer if, in its opinion, an instruction infringes applicable data-protection law and may pause the affected processing while the parties resolve it.

Subject matter: Provision, support and security of Sunzu AI research services, including the web app and customer-enabled integrations.
Duration: The service term, followed by the return, deletion and restricted backup periods in section 8.
Operations: Collection and upload, storage, retrieval, organisation, analysis and model inference, generation of research outputs, authorised export, support, backup and deletion.
Purposes: Carrying out the Customer’s research instructions and maintaining the security and operation of its service.
Individuals: Customer personnel, research participants, customers, prospective customers and other people identified in materials supplied by the Customer. Children may be included where lawful and specifically identified in the instructions.
Data categories: Contact and account identifiers, demographic information, research responses, behaviour and preference information, transcripts, recordings, images, documents and personal data in generated outputs, as selected by the Customer.

Sensitive or special-category information may include health, ethnicity, beliefs, sexual orientation or biometric identifiers if present in the supplied materials. Criminal-offence data may also be present. The Customer must identify the actual categories, purposes, safeguards and applicable legal conditions in the order or written processing instructions before those categories are processed. This list does not authorise indiscriminate collection. The Customer is responsible for lawful collection, necessary notices, rights to provide the data and the lawfulness of its instructions; Sunzu retains its own statutory obligations.

3. Boundary for improvement and model training

Enterprise data is excluded. Sunzu will not use enterprise inputs, outputs or derivatives to improve services or train models without a separate express written agreement. Providers receive no independent rights to reuse content or train their models.

Pay-as-you-go. A separately accepted pay-as-you-go content licence may permit Sunzu’s future service improvement and own-model training. This DPA does not itself authorise independent reuse of Customer Personal Data. Before changing from instructed processing to its own purpose, Sunzu must document the applicable role and lawful basis, satisfy transparency and other applicable conditions, and respect existing restrictions. Where Sunzu determines its own training purpose, it is responsible for the controller obligations attaching to that activity. A customer’s content licence does not replace these requirements.

Data processed under statutory service-provider or contractor restrictions may not be diverted into incompatible own-purpose training. The licence does not override this restriction. Any preparation of genuinely anonymous data while Sunzu is acting as processor must itself be covered by lawful documented instructions. Removing names alone is not sufficient anonymisation.

4. Confidentiality and security

Sunzu will ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations and receive appropriate instruction. It will maintain technical and organisational measures appropriate to the risks, including the measures in Schedule 1. Measures may evolve, but Sunzu will not materially reduce the overall level of protection during the service term.

5. Subprocessors

The Customer gives general written authorisation only for subprocessors identified in the completed supplier schedule supplied with its order. That schedule must state each legal entity, service, personal-data access and processing locations. A supplier mentioned elsewhere on the marketing website is not automatically authorised for customer research data.

Sunzu will give at least 30 days’ prior written notice of a proposed addition or replacement, allowing the Customer to raise reasonable data-protection objections before the provider receives the affected data. The parties will try to agree a suitable alternative. If no compliant resolution is available, either party may terminate the affected service, and Sunzu will refund unused prepaid fees and credits for the portion that cannot continue.

Sunzu will impose written obligations giving at least the protection required by this DPA and applicable law, restrict providers to authorised services without independent content or training rights, and remain responsible for their performance of the delegated processing obligations.

6. Incidents and assistance

Sunzu will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. Initial notice will include available information about the nature of the breach, affected data and individuals, likely consequences, contact point and mitigation. Information may be supplied in stages without undue delay. Sunzu will investigate, take appropriate containment and remediation steps, preserve relevant evidence and cooperate with the Customer. Notice is not an admission of fault.

Taking account of the processing and information available, Sunzu will assist with individual rights requests, breach notifications, impact assessments and prior regulatory consultations. Requests received directly will be forwarded promptly to the Customer, and Sunzu will not respond substantively on its behalf without instructions unless legally required. Each party retains its own notification duties. Assistance must be timely enough to support applicable legal deadlines.

7. Information and audits

Sunzu will provide information reasonably necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the Customer or its mandated independent auditor. The parties will normally begin with relevant documentation and agree reasonable scope, confidentiality and arrangements protecting other customers. These arrangements cannot prevent a legally necessary audit, regulatory access or an urgent investigation. No ISO certification or independent audit report is promised unless actually held and identified.

8. Return deletion and retention

At termination, Sunzu will, at the Customer’s choice, return or delete Customer Personal Data from active systems within 30 days, and delete remaining copies unless law requires retention. The Customer can request an export before deletion. Residual backup copies may persist for up to 90 days after deletion from active systems; they remain protected, isolated from ordinary processing and expire through the backup lifecycle. If a backup is restored, applicable deletions must be reapplied.

Data retained under a legal obligation will be limited to what that obligation requires and will not be used for unrelated purposes. On request Sunzu will confirm completion of its return or deletion obligations. A surviving intellectual-property licence does not authorise indefinite retention of personal data, including personal data retained in a training artefact or model.

9. Regional processing and access

Customer research data for customers in the EEA, UK and Switzerland is processed in Europe. For customers elsewhere, the contracted US service will process research data in the United States. Europe means the EEA, UK and Switzerland for these commitments. Authorised Sunzu personnel access data from Switzerland, including where the customer environment is in the US. The provider and service locations must be recorded in the order and supplier schedule. Supplier support access and onward processing must also be covered; a regional storage setting alone is not proof of regional processing.

Sunzu will not move Customer Personal Data outside the agreed processing arrangement without an authorised change and any required transfer safeguards. Remote access and onward disclosures must be assessed as well as hosting. For transfers subject to adequacy decisions, reliance is limited to the scope and continued validity of the applicable decision. The safeguards in Schedule 3 apply where adequacy or another valid basis is unavailable.

10. US state privacy provisions

Where applicable US state privacy law treats Sunzu as a processor, service provider or contractor for the instructed processing, Sunzu will process personal information only for the specified contracted business purposes, comply with applicable obligations and provide the required level of protection. It will not sell or share that information, retain, use or disclose it outside the permitted purposes or direct business relationship, or combine it with other sources except as the applicable law permits.

Sunzu will notify the Customer if it can no longer meet those obligations. The Customer may take reasonable steps to verify compliance and require cessation and remediation of unauthorised use. Sunzu will support applicable assessments and rights requests and apply equivalent requirements to its authorised subprocessors. Sunzu certifies that it understands these restrictions and will comply with them when this DPA is accepted. These restrictions take precedence over an inconsistent content licence.

11. Precedence and duration

This DPA continues while Sunzu retains Customer Personal Data. It prevails over conflicting commercial terms for the processing it governs; mandatory transfer clauses prevail over both. Contractual liability arrangements do not limit statutory rights, regulatory powers or rights conferred by mandatory transfer clauses. Changes must follow the agreed contract process and may not reduce mandatory protections.

Schedule 1 Technical and organisational measures

The measures below describe Sunzu’s documented security arrangements. They do not claim certification, a guaranteed recovery time or protection against every incident.

Tenant separation: tenant-scoped data access and logically separate tenant database and storage paths restrict cross-customer access.
Access protection: authorised infrastructure access uses managed identities or individual accounts with multi-factor authentication. Administrative privileges and secrets are controlled using the cloud provider’s access controls and managed secret storage.
Confidentiality and devices: personnel with customer-data access are subject to confidentiality obligations; remote-working device disks are encrypted and managed-device controls are used.
Encryption: customer data is encrypted in transit using HTTPS/TLS and at rest through Azure-managed encryption. Azure Storage is configured with a TLS 1.2 minimum and encryption at rest using AES-256 with provider-managed keys.
Recovery: database backups are continuously replicated to regional Azure Blob Storage. Restore integrity is checked through scripted recovery drills, with monthly production drills described in Sunzu’s security documentation. Recovery and rollback procedures are maintained; no fixed recovery-time commitment is made by this schedule.
Logging: application access and error logs are centrally collected with restricted access. Operational application logs are retained for 90 days. Logs do not grant a right to retain customer research content for an additional purpose.
Application protection: tenant-scoped authentication and token validation, protected storage access and short-lived access links for private media are used. Infrastructure is patched through established operating-system update mechanisms.
Change control: changes pass build and automated test checks, with post-deployment smoke tests. Model and prompt changes are evaluated before release.
Incident handling: an identified security lead coordinates investigation and the documented customer-notification process. Recovery procedures support restoration and rollback.

Sunzu is not currently ISO 27001 certified, and this schedule does not represent that Sunzu carries out regular independent penetration tests. A cloud provider’s certification is not a certification of Sunzu.

Schedule 2 Subprocessors and regional services

The research service uses Microsoft Azure, including Azure OpenAI, and Google Cloud Vertex AI for Gemini. OpenAI models are accessed through Azure OpenAI; this description does not authorise sending customer research data to a separate direct OpenAI or Anthropic API.

Microsoft Azure: Hosting, database and file storage, backups, secrets management, operational logs and model inference through Azure OpenAI. Data may include study inputs, outputs, files, identifiers and operational records necessary for these services. European service: Sweden Central, Sweden. US service: East US 2, Virginia, with Azure OpenAI processing restricted to the United States.
Google Cloud Vertex AI: Gemini model inference, including visual and video analysis. Data may include the prompts, relevant research materials, media and generated responses submitted for the requested task. European service: a European deployment within the agreed processing boundary. US service: the us-east4 endpoint in Northern Virginia, with model processing restricted to the United States.
Sunzu personnel: Authorised operational and support access from Switzerland, subject to confidentiality and access controls. Any separately incorporated support affiliate receiving data must be identified in the order’s supplier schedule.

The US locations are contractual specifications that apply when the US service begins. Model inference may be routed within the agreed US processing boundary under the selected provider service; the endpoint does not promise all computation occurs in one building or state. Sunzu must use compatible deployment types and model versions, and must not enable global processing or a fallback outside that boundary for covered research content.

Before processing starts, the order’s supplier schedule must identify the exact Microsoft and Google contracting entities, the applicable European Vertex AI location, supplier support-access countries and any additional provider with access to Customer Personal Data, such as an edge, email or telemetry service. The schedule must describe each provider’s service, data access and applicable transfer safeguards. Providers are not authorised to use customer content for their own training or improvement. Sunzu will provide the completed schedule to the Customer; subsequent changes follow section 5.

Web-search grounding, optional model tools and other features with different processing or retention arrangements may be used with Customer Personal Data only if they meet the agreed boundary and are included in the authorised processing. This DPA does not promise zero provider retention where abuse monitoring, caching or other permitted service processing applies.

Schedule 3 International transfer terms

Each transfer must have a valid basis under the applicable law. Adequacy may be used only within the scope and continued validity of the relevant decision. A content licence, group ownership or a regional endpoint alone is not a transfer safeguard. Before a restricted transfer begins, the parties must complete the necessary role assessment, transfer assessment, supplementary measures and execution information. The provisions below apply only where the selected clauses are legally available for the relevant transfer.

EU transfers

For an in-scope restricted transfer of Customer Personal Data from the Customer to Sunzu, the standard contractual clauses in the Annex to Decision (EU) 2021/914 (EU SCCs) are incorporated into an accepted DPA by reference. Module Two applies where the Customer is controller and Sunzu processor; Module Three applies where the Customer is processor and Sunzu subprocessor. The mandatory text is not amended. Clause 7 applies; Clause 9(a) uses Option 2 with the 30-day notice period in section 5; the optional wording in Clause 11 is not used; Clause 17 uses Option 1 with Irish law; and Clause 18 selects the courts of Ireland. The SCCs prevail over inconsistent terms.

Annex I.A: the exporter is the Customer identified in the accepted order, at its stated address and privacy contact, acting as controller or processor as applicable. The importer is the contracting Sunzu provider, at the address in the customer agreement, contact hello@sunzu.com, acting as processor or subprocessor. Activities are the research service described in section 2. Acceptance by authorised representatives on the date of the accepted order constitutes execution where legally effective.

Annex I.B: data subjects, categories, sensitive-data safeguards, purposes, operations and duration are described in section 2 and the Customer’s specific processing instructions. Transfers are ongoing as users request the service. Retention follows section 8. Subprocessor processing is limited to the services and period identified in Schedule 2 and the completed order schedule. Any additional safeguards needed for sensitive or children’s data must be recorded before that processing begins.

Annex I.C: the competent supervisory authority is determined under Clause 13 from the exporter’s establishment or other applicable connection and must be identified in the order’s transfer record. Sunzu’s EU representative does not make the Estonian authority the default for every transfer. Annex II: Schedule 1 and any supplemental customer-specific measures apply. The authorised subprocessor information is Schedule 2 together with the completed order schedule. A Module Three customer must also identify its underlying controller where required.

UK transfers

For an in-scope UK restricted transfer relying on EU SCCs, the ICO International Data Transfer Addendum, version B1.0 (UK Addendum), including its mandatory Part 2, is incorporated into the accepted DPA. Table 1 uses the start date, exporter, importer, addresses and key contacts identified above and in the accepted order. Table 2 uses the EU SCCs and applicable modules and selections stated above. Table 3 uses the Annex information above, Schedule 1, Schedule 2 and the completed order details. In Table 4, both importer and exporter may end the Addendum as provided in its Section 19. Its mandatory adaptations and precedence rules apply.

Swiss transfers

Where the Swiss Federal Act on Data Protection applies, references in the EU SCCs to the GDPR include the Swiss Act as necessary to protect the Swiss transfer; the competent Swiss authority is the Federal Data Protection and Information Commissioner. References to Member States include Switzerland to the extent required to preserve Swiss individuals’ ability to exercise rights in Switzerland under Clause 18(c). These adaptations do not restrict protections under the EU GDPR where it also applies.

Other transfers and completed information

Sunzu must put appropriate onward-transfer safeguards in place with its providers and assess access from Switzerland and other locations. Own-purpose controller processing requires its own role and transfer assessment; a processor module does not authorise a change of purpose. Where these SCCs are not legally available or sufficient, the parties must use another valid mechanism before proceeding. No supplier’s Data Privacy Framework participation is assumed without checking the relevant entity, scope and current status.

The identities and contact information in the accepted order, competent authority, completed supplier schedule and any processing-specific safeguards are part of the execution information. Missing information must be completed before a transfer requiring these clauses begins. Publication of this draft alone does not execute the DPA or its transfer terms.