Zenkit and GDPR Legislation
At Zenkit, protecting the personal data of our users is of utmost importance to us. We only collect and store information that is necessary to provide our service and fulfill our legal obligations. We do not evaluate or analyze your content and usage data for our own purposes, such as product improvement, analytics, or benchmarking, nor do we use them to train AI models. Our approach to data protection and data security aligns directly with the objectives of the General Data Protection Regulation (GDPR). We have taken all necessary measures to ensure complete compliance with these regulations.
About the GDPR
GDPR stands for the General Data Protection Regulation. It is the European Union’s (EU’s) in 2016 released regulation that safeguards the personal data of individuals in the EU, as well as the export of personal data abroad.
The GDPR gives EU residents greater control over how any organization worldwide collects, processes, stores, and shares their personal data. Personal data is broadly defined in the regulations, but in general it can be thought of as any data that can be used to personally identify an individual. It applies to any organization that processes EU citizens’ personal data, regardless of the organization’s location.
The regulation encompasses the steps to be taken in all areas of protecting an individual’s privacy, including setting up security mechanisms, compliance, and repercussions. Failure to comply with the GDPR incurs a heavy fine for the non-compliant organization.
Our Stance on Privacy and the GDPR
Here at Zenkit, we strongly support data privacy legislation because we believe that strong privacy practices are good for our customers, and thus good for us. We are fully committed to the protection of our users’ data.
Our servers are located in Germany, which means that we need to meet not only the GDPR but also the European Data Protection Directives, as well as the German Federal Data Protection Act. This has set us up in good stead to meet GDPR compliance.
We will do our best to support your GDPR compliance efforts by providing information about the data that Zenkit collects, transmits, and stores for your account. That being said, we are unable to offer legal advice pertaining to how you or your organization achieve compliance.
Please read our app privacy policy and web privacy policy to learn more.
What We’re Doing to Comply
Just like any other software company with users and customers based inside the EU, we implemented a compliance strategy leading up to May 25th, 2018. Our data privacy practices are now in compliance with the GDPR.
We understand that our customers have GDPR requirements that are directly affected by their use of Zenkit and to that effect we worked hard with everyone on our team to ensure that, to the extent Zenkit directly collects the personal data of EU residents, it is GDPR compliant. Here are some of the steps we’ve taken:
- Committed to upholding the security and privacy measures required by the GDPR.
- Committed to appropriate data transfer mechanisms when transferring data outside to the EU.
- Ensured that any subprocessors or third-party services to which we transfer our users’ data uphold the security and privacy measures required by the GDPR.
- Ensured that all of our staff are appropriately educated about the proper handling of personal data.
- Ensured that staff who have access to, and process, our user’s personal data are bound to maintain the confidentiality and security of that data.
- In the event of a personal data breach involving data that Zenkit processes on behalf of an organization, we notify the affected organization without undue delay so that it can meet its obligation to notify the supervisory authority on time. For data for which we are the controller, we report breaches to the competent supervisory authority.
- Created awareness within the company regarding the Privacy by Default and Privacy by Design principles for ongoing development.
- We have appointed an external Data Protection Officer. She can be reached at privacy@zenkit.com.
GDPR FAQ
Does Zenkit Process Personal Data?
Yes, we process some personal data to provide the Zenkit service. To learn more about the data we process, please read our Privacy Policy and Terms of Service.
Content that you enter into Zenkit, such as items, comments, and files, is stored exclusively in Germany. When using AI features, processing takes place within the EU. For individual accompanying services such as payment processing, spam protection, and support chat, as well as for integrations that you activate yourself, processing may occur outside the EU. Details regarding processing locations and safeguards can be found in our App Privacy Policy.
If you would like more information about our privacy practices, please feel free to contact us at privacy@zenkit.com.
Where Does Zenkit Send User Data?
Zenkit is used by people all over the world. We follow standard practices commonly used by SaaS providers in order to offer you this service. Data from Zenkit is stored on Amazon Web Services (AWS) in Frankfurt, Germany (RDS & S3, contractual partner AWS Luxembourg. Learn more about the AWS data protection policies here). Additionally, regular encrypted backups of your data are created, which are also stored in Germany, separate from the production environment. When using AI features, processing takes place within the EU.
We have entered into a data processing agreement pursuant to Art. 28 GDPR with all service providers that process personal data on our behalf. The current list of these sub-processors is an integral part of our Data Processing Agreement (DPA).
Why does the privacy policy list more service providers than the DPA?
Our privacy policy describes all processing of personal data by Axonic GmbH. The DPA pursuant to Art. 28 GDPR, on the other hand, only governs data that we process on behalf of our customers—that is, the content you enter into Zenkit. Therefore, the list of sub-processors in the DPA exclusively contains service providers that we use to provide Zenkit and that have access to this data in the process.
Service providers that we use for our own contractual relationship with you, such as PayPal and Chargebee for payment processing and billing of your subscription, are not sub-processors. For these processing activities, we ourselves are the controller.
What User Data Does Zenkit Collect?
You can find and download all data we store about you from your Zenkit profile, under ‘Your privacy rights’.
Can I Exercise My Privacy Rights?
Yes, you can find an option to exercise your rights in your Zenkit profile under ‘Your privacy rights’. Please read the following to learn how your requests to exercise your rights are handled.
How Can I Remove All of My Data from Zenkit?
As a Zenkit user, you have the right to be forgotten. You can permanently remove all of your data from Zenkit by deleting your account. Learn more about how to delete your account in our documentation.
After your confirmation, your Collections will no longer be accessible and will be deleted from our production systems. Remaining copies in our encrypted backups will be deleted automatically, at the latest upon expiration of the retention period in accordance with our deletion policy.
Data that we are required by law to keep for a certain period of time, such as invoices or offers, will be properly disposed of once the retention period is over.
Can I Access My Data?
Yes. As a Zenkit user, you have the right to request access to all data we have stored about you. You may request a copy of your purchase history and any other personal information we have about you. To request this information, please contact privacy@zenkit.com. We will respond to your request within the one-month response time.
Can I Transfer My Data to Another Provider?
Yes, you have the right to transfer. To do so, please export your collections as CSV files using the CSV export function. Please note that this will not delete your data.
Can I Sign a DPA with Zenkit?
Yes. If you would like to sign a DPA with Zenkit, please contact privacy@zenkit.com with the name and email address of the person in your organization authorized to sign.
Note: We will continue to update this page as information and practices evolve.