Legal
Data Processing Agreement
Version 1.0, 3 November 2026
1. Who this agreement is between
This agreement is between the adviser firm that uses a Z3nith adviser workspace (the firm) and Cain Blythe trading as Z3nith, a UK sole trader (the processor, we, us).
Contact for this agreement is [email protected].
The firm accepts this agreement when it applies for an adviser workspace and ticks the acceptance box. We store the version, the time in UTC, the accepting email and the application id.
It sits alongside our Terms of Service (section 11, Adviser packs) and our Privacy Policy (Adviser workspaces). It covers the processing UK GDPR Article 28(3) requires a contract to cover.
2. Roles
The firm is the controller of the client records it uploads. We are the firm's processor for those records.
For the firm's own account and billing records we are the controller, and the lawful basis is contract. This agreement does not cover those records.
3. Details of the processing
- Subject matter: AI readiness scans, reports, client questionnaires and quarterly re-runs for the firm's clients.
- Duration: while the adviser pack is active, and for 90 days after it ends, as section 11 describes.
- Nature and purpose: storing the records the firm supplies and using them to produce the reports the firm asks for.
- Personal data: company name, website URL, contact email where the firm supplies one, Companies House number where the firm supplies one, questionnaire answers, and scan results (the score, grade, sector and the stored assessment).
- Special-category data: none. The firm must not upload it (Terms, section 11).
- Data subjects: people at the firm's client companies whose details are in those records.
- The firm's duties: to have a lawful basis for the client data it uploads, to tell its clients about the processing where the law requires it, and to give only lawful instructions.
4. Instructions
We process the client records only to run the scans, reports, questionnaires and quarterly re-runs the firm asks for in the workspace, and to send the report links and questionnaire invitations the firm asks us to send.
An email from the firm to [email protected] is also an instruction.
If the law requires us to process the records in another way, we will tell the firm first unless the law forbids it. If we think an instruction breaks data protection law, we will tell the firm.
5. Confidentiality
The processor named in section 1 keeps the client records confidential.
6. Security
- The site is served over HTTPS.
- Client records are stored in Cloudflare D1.
- The workspace is limited to invited email addresses. Firm members sign in with a magic link.
- A report link emailed to a client expires after 30 days. A questionnaire link expires after 14 days.
- We do not store card numbers. Pack payment uses Stripe Checkout.
7. Sub-processors
The firm authorises these sub-processors for the purposes below:
| Sub-processor | What for | Its terms |
|---|---|---|
| Cloudflare | Hosting the application and storing the records in D1. | Link |
| Google (Gemini API) | Writing the scan narrative from the client's website and public company signals. A Premium upgrade sends the client's questionnaire answers to Google Gemini for analysis. | Link |
| Companies House | Looking up a public company record from a Companies House number, or from the name taken from the website. | Link |
| Resend | Emailing a report link or a questionnaire invitation to the client email the firm supplies. | Link |
| Stripe | Taking payment for the firm's adviser pack. Checkout sends the firm member's email and the pack, not client records. | Link |
Before we add or replace a sub-processor for client records, we will email the firm and change the version of this page, and the firm can object by replying to [email protected]. We remain responsible to the firm for those sub-processors' processing of the client records. Each sub-processor is bound by written terms that protect the client records to the standard this agreement sets.
We will send that email at least 30 days before the change takes effect. If the firm objects, it can end its adviser pack and we will refund the whole months it has not used.
8. International transfers
Cloudflare hosts the service on its network. Companies House is a United Kingdom public API. Google, Resend and Stripe may process data outside the United Kingdom. The firm authorises those transfers for the purposes in section 7. The privacy policy names the same providers.
Each of those providers names its transfer safeguard in its own data processing terms. Google relies on the UK Extension to the EU-US Data Privacy Framework, and on standard contractual clauses where that framework does not apply. Resend relies on the EU standard contractual clauses with the UK International Data Transfer Addendum, and is also certified to the UK Extension to the EU-US Data Privacy Framework. Stripe relies on the UK Extension to the EU-US Data Privacy Framework first, and on the UK International Data Transfer Addendum where that framework does not apply.
9. Helping the firm
The firm can delete a client row in the workspace. For any other request about the client records, email [email protected].
We will help the firm answer requests from people using their data protection rights, such as access or deletion, as far as the information we hold allows.
We will help the firm with security, breach reporting and data protection impact assessments, as far as the information we hold allows.
10. Personal data breaches
If we become aware of a personal data breach affecting the firm's client records, we will email the firm without undue delay.
The firm decides whether to tell the ICO and the people affected.
11. Deletion
Adviser client records, including clients, client scans, questionnaire invites and answers, and branding, are kept while the pack is active, and deleted 90 days after it ends. If the firm deletes a client, that client row is removed.
While the client row and the scan are still stored, the firm can open or download that client's report from the workspace.
Before the pack ends, the firm can download its clients' reports from the workspace, or ask us by email to [email protected] to delete its client records sooner.
Billing and payment records for an adviser pack are kept for 6 years, as the Privacy Policy says. This agreement does not delete them on the 90-day timetable.
12. Information
On a written request to [email protected], we will provide the information the firm reasonably needs to show that this agreement is being followed, including this page and the sub-processor list. We will also allow for and contribute to audits, including inspections, by the firm or an auditor it appoints, on reasonable written notice.
Reasonable notice means at least 30 days' written notice. We will answer an audit first with documents and a remote review, and each side pays its own costs.
13. Liability and law
Liability under this agreement follows section 7 of our Terms of Service. This agreement is governed by the law of England and Wales, and the English courts, as section 9 of the Terms of Service says.
14. Changes
If we change this agreement we publish the new text on this page and change the version number. The version stored with the firm's application is the version the firm accepted.