Data Processing Addendum

Draft, last updated 21 July 2026 · pending final legal review

This addendum applies where ZooLog (Marks AI) processes personal data on your behalf, for example keeper names and any personal data within the records your team enters. For that data you are the controller and we are the processor.

Scope & roles

We process customer data only to provide the service and on your documented instructions (including as set out in our Terms). The subject matter is zoo/collection record-keeping; the data subjects are your staff and, where relevant, contacts you record.

Our commitments

• Process personal data only on your instructions.
• Ensure people authorised to process it are bound by confidentiality.
• Apply appropriate technical and organisational security measures (encryption in transit and at rest, access controls, audit logging).
• Engage sub-processors only under written terms with equivalent obligations, and tell you of intended changes.
• Assist you with data-subject requests, security, breach notification and DPIAs.
• On termination, delete or return customer data as you choose, subject to legal retention.

Sub-processors

Current sub-processors include our hosting and database provider (Cloudflare) and our email delivery provider. We keep data in the UK/EU where possible. A current list is available on request.

International transfers

Where any transfer outside the UK/EEA is necessary, we rely on an approved safeguard (such as the UK IDTA or Standard Contractual Clauses).

Breach notification

We notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own obligations.

Contact

Data protection queries: [email protected].