Data Processing Addendum
Baseline processor commitments for employer-controlled personal data, subject to a signed customer agreement and counsel review.
Roles and instructions
For Customer Personal Data processed to provide payroll and accounting workflow services, Customer acts as controller/business and the ZentroPayroll operator acts as processor/service provider unless law assigns another role. We process only documented instructions in the agreement, configured features, authorized user actions, and applicable law, and will notify Customer if an instruction appears unlawful where permitted.
Confidentiality and security
Personnel with access are bound by confidentiality and receive access based on job need. We maintain technical and organizational measures appropriate to risk, including access control, tenant scoping, encryption in transit, managed secret storage, logging, backups, change control, vulnerability remediation, and incident procedures. A final exhibit should state production-specific measures and restoration objectives.
Subprocessors
Customer generally authorizes service providers and subprocessors needed for hosting, email, payroll infrastructure, subscription billing, support, and authorized accounting sync. The current production register identifies provider purpose, service boundary, and change-notice process. Production activation remains blocked until that register and the applicable contracts are approved. Subprocessors receive data only for contracted services and must provide appropriate protections.
Assistance and incidents
Taking into account the service and information available, we assist Customer with verified data-subject requests, security assessments, breach obligations, impact assessments, and regulator inquiries. We will notify Customer without undue delay after confirming a Personal Data breach affecting Customer Data and provide known scope, consequences, mitigation, and updates; notification is not an admission of fault.
Return, deletion, transfers, and audit
On termination, we return or delete Customer Personal Data as agreed, except legally required retention and backups that remain protected until deletion. Cross-border transfer mechanisms and any supplemental safeguards must be stated in the signed DPA. We will provide reasonable compliance information and support proportionate audits subject to confidentiality, security, scope, scheduling, and cost protections.