Legal
Data Processing Agreement
Standard DPA for ZevoFlow enterprise customers subject to EU GDPR, UK GDPR and GCC data protection regimes.
Enterprise DPA
This Data Processing Agreement ("DPA") forms part of the master services agreement between the customer (as data controller) and ZevoFlow (as data processor). It reflects Article 28 of the EU/UK GDPR and equivalent obligations under UAE PDPL, KSA PDPL and Qatar PDPPL.
Subject matter and duration
ZevoFlow processes personal data on behalf of the customer for the term of the underlying service agreement.
Categories of data and data subjects
- Data subjects: customer employees, contingent workers, agency staff.
- Data: identity, contact, employment, availability, messaging metadata.
Sub-processors
ZevoFlow uses vetted sub-processors (e.g. cloud infrastructure, messaging providers). A current list is available on request.
Security
ZevoFlow maintains organisational and technical measures including access control, encryption in transit and at rest for sensitive fields, audit logging, and least-privilege service accounts.
International transfers
Where required, Standard Contractual Clauses (EU/UK) and the applicable GCC transfer safeguards apply.
How to execute
Enterprise customers can request a signed DPA by emailing legal@zevoflow.com. This page is a placeholder summary; the executed DPA controls in case of conflict.