Roles and documented instructions
This is an unexecuted draft. A binding processing agreement is needed where Zrelay processes personal data on customer instructions. The customer is controller or an authorized processor; Zrelay is processor or subprocessor. Zrelay's own account, billing and security processing is covered by the privacy policy.
The proposed duties below require an executed agreement. Instructions comprise the service agreement, customer requests and agreed written instructions. Processing follows those instructions unless law requires otherwise, with notice where permitted. Zrelay flags instructions it considers unlawful. Marketplace checkout is a separate relationship, not DPA acceptance.
Confidentiality and security
Require confidentiality duties for authorized personnel, appropriate access controls and risk-appropriate security measures. Annex II describes implementation features; organizational measures and suitability for the customer's data need review.
Subprocessors
Before authorizing a route, complete Annex III with the actual supplier chain and binding processing duties. Commercial confidentiality cannot replace required customer information or authorization. Provide advance notice and an opportunity to object to additions or replacements; Zrelay remains responsible for subprocessor obligations.
The supplier register does not establish complete contractual coverage. Content storage is not inherently prohibited, and absence of storage does not mean absence of processing.
Rights requests and customer assistance
Assist, taking account of the processing, with access, correction, erasure, restriction, objection and portability. Forward customer-controlled data requests; respond on the customer's behalf only on instructions or where legally required.
Assist with security, breach assessment and notifications, impact assessments and prior consultation using available information. Any agreed charges for substantial assistance must not prevent required assistance.
Personal-data breaches
Notify the customer without undue delay after becoming aware of a breach affecting its data, supplying available details and updates. Agree incident contacts and verify the response process before execution.
Deletion or return
At processing end, return or delete customer data at its choice, including copies unless law requires retention. Agree backup schedules and lawful exceptions. Ordinary gateway conversation history is not stored, but upstream content capture exists; this draft does not establish end-to-end return or erasure capability. Those duties need coverage throughout the applicable chain.
Information and audits
Provide compliance information and allow and contribute to customer or mandated-auditor inspections as legally required. Proportionate confidentiality, security and scheduling arrangements must preserve those rights. No independent certification or audit report is represented as available.
International transfers
Identify processing countries, onward transfers, applicable legal mechanisms and supplementary measures for the actual route. Verify safeguards before representing them as established. Zrelay's hosts in Spain do not establish exclusively Spanish or EU processing.
Annex I — Processing details
Purpose: requested inference, routing, metering, necessary troubleshooting and abuse prevention. Operations: receiving and transmitting content, delivering responses, storing usage metadata, limited diagnostics and derived abuse signals. Duration: service and applicable record-retention periods.
Data subjects include customer personnel, application users and others included in requests. Data includes selected text, images, files, outputs and linked operational records. Customers provide lawful instructions, permissions and notices, minimize data and secure credentials. No special-purpose safeguards for highly sensitive data are offered; assess suitability before submission.
Annex II — Technical and organizational measures
Current features include public HTTPS, hashed customer credentials and sessions, protected upstream credentials, account authorization, spending limits, CSRF controls and secure cookies. Request limits and forwarding-header removal reduce exposure. These are implementation features, not certification, encryption of every field or TLS on every internal hop. Verify operational controls and retention for the agreed scope.
Annex III — Subprocessor information
Complete the restricted route-specific annex with legal entities, functions, data categories, countries, binding duties, transfer evidence and change procedures. Request details through support@zrelay.net; the public register alone is insufficient.