Data Processing Agreement

1. Purpose and scope

1.1 Incorporation

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Customer", "you" or "your") and Armand Digital Limited ("Armand Digital", "we", "us" or "our") concerning use of the Zuzo software platform ("Zuzo" or the "Service").

Armand Digital Limited is registered in England and Wales under company number 13081571, with its registered and business address at 12 Fore Street, Chudleigh, Devon, TQ13 0HX, United Kingdom.

This DPA is incorporated into and should be read alongside our Terms and Conditions.

1.2 Application

This DPA applies where Armand Digital processes personal data on behalf of a Customer who acts as a data controller.

This may include personal data in accounting records, financial reports, bookkeeping integrations and other business information submitted to Zuzo.

Not all financial information constitutes personal data, and not all processing by Armand Digital is carried out as a data processor.

1.3 Purpose

This DPA sets out the parties' respective obligations for processing Customer Personal Data and is intended to satisfy the applicable requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR").

Where Australian privacy legislation applies, the parties must also comply with their respective obligations under that legislation.

1.4 Commencement

This DPA takes effect when the Customer accepts the applicable Terms and Conditions and continues for as long as Armand Digital processes Customer Personal Data on the Customer's behalf.

1.5 Precedence

If this DPA conflicts with the Terms and Conditions in relation to Customer Personal Data processed on the Customer's behalf, this DPA will prevail to the extent of the conflict.

1.6 Independent controller activities

Armand Digital may independently act as a data controller for activities including:

• Account registration and authentication.
• Customer administration.
• Subscription management and billing.
• Customer support.
• Marketing and customer communications.
• Platform security and fraud prevention.
• Compliance with legal obligations.
• Personal financial planning information submitted by individuals for their own use, where Armand Digital determines the purposes and means of processing.

These activities are covered by our Privacy & Cookie Policy and applicable law.

The classification of the parties depends on their actual processing activities and legal responsibilities.

2. Definitions

Customer Personal Data means personal data processed by Armand Digital on behalf of the Customer in connection with the Service, where the Customer acts as controller.

Data Protection Legislation means applicable data protection and privacy laws, including the UK GDPR, the Data Protection Act 2018, applicable provisions of the Australian Privacy Act 1988 (Cth), and any amendments or replacement legislation.

Personal Data means information relating to an identified or identifiable living individual.

Sub-processor means a third-party organisation engaged by Armand Digital to process Customer Personal Data on its behalf.

Processing includes collecting, recording, storing, using, analysing, transmitting, retrieving, organising and deleting personal data.

Other data protection terms have the meanings assigned to them by applicable Data Protection Legislation.

3. Roles and responsibilities

3.1 Customer as controller

Where the Customer determines the purposes and means of processing Customer Personal Data, the Customer acts as data controller and Armand Digital acts as data processor.

3.2 Customer obligations

The Customer is responsible for:

1. Establishing a lawful basis for collecting and using personal data submitted to Zuzo.
2. Providing relevant privacy information to individuals.
3. Obtaining necessary permissions and authorisations.
4. Ensuring that personal data submitted to the Service is lawful and appropriate.
5. Managing the permissions of authorised users.
6. Ensuring appropriate authority to connect third-party accounting systems.
7. Complying with applicable Data Protection Legislation.

3.3 Armand Digital as processor

Armand Digital will process Customer Personal Data in accordance with this DPA, the Customer's documented instructions and applicable law.

3.4 Details of processing

Details concerning the nature, purpose, duration and categories of processing are set out in Annex A.

4. Processing instructions

4.1 Documented instructions

Armand Digital will process Customer Personal Data only on the Customer's documented instructions, including instructions concerning international transfers, unless otherwise required by applicable law.

4.2 Instructions through the Service

Documented instructions include the Customer's authorised use and configuration of Zuzo, such as:

• Connecting accounting software.
• Uploading Profit & Loss reports.
• Importing and synchronising accounting information.
• Entering financial information.
• Generating cash flow forecasts and management reports.
• Generating optional AI-assisted financial insights.
• Adding authorised users.
• Exporting or deleting information.

Additional instructions may be agreed in writing.

4.3 Legal requirements

Where processing is required by applicable law, Armand Digital will inform the Customer before processing unless legally prohibited.

4.4 Unlawful instructions

Armand Digital will inform the Customer without undue delay if it believes an instruction infringes applicable Data Protection Legislation.

5. Armand Digital's obligations

Armand Digital will:

1. Process Customer Personal Data only in accordance with documented instructions, except where legally required otherwise.
2. Ensure authorised persons are subject to appropriate confidentiality obligations.
3. Implement appropriate technical and organisational security measures.
4. Appoint sub-processors in accordance with Section 6.
5. Assist the Customer with data subject rights requests.
6. Provide appropriate assistance concerning security incidents, data protection impact assessments and legally required regulatory consultations.
7. Make available information reasonably necessary to demonstrate compliance.
8. Allow and contribute to audits and inspections as required by applicable law.
9. Return or delete Customer Personal Data in accordance with Section 12.

6. Sub-processors

6.1 General authorisation

The Customer grants Armand Digital general written authorisation to engage appropriate sub-processors necessary to operate, maintain, support and secure Zuzo.

6.2 Approved providers

Relevant providers are identified in Annex B.

6.3 Contractual safeguards

Armand Digital will ensure that sub-processors processing Customer Personal Data are subject to written contractual obligations providing an equivalent level of data protection to the applicable obligations imposed on Armand Digital under this DPA.

6.4 Responsibility

Armand Digital remains responsible to the Customer for the performance of its sub-processors' applicable data protection obligations.

6.5 Sub-processor changes

Armand Digital will provide reasonable advance notice of intended additions or replacements of sub-processors processing Customer Personal Data, including through email or a maintained sub-processor register.

Customers may object on reasonable data protection grounds.

Where an objection cannot reasonably be resolved, the parties may agree an alternative arrangement or terminate the affected Service in accordance with applicable contractual terms and law.

6.6 Emergent infrastructure

Zuzo is hosted using infrastructure managed by Emergent Labs Inc. ("Emergent").

Emergent operates under a Data Processing Agreement incorporated into its Terms of Service.

Emergent maintains a register of its own sub-processors at:

https://app.emergent.sh/subprocessors

Under Emergent's stated arrangements, proposed sub-processor changes may be objected to on reasonable data protection grounds within 20 business days of notice by contacting privacy@emergent.sh.

This is an arrangement between Armand Digital and Emergent. Customers of Zuzo should raise objections with Armand Digital at support@getzuzo.com rather than contacting Emergent directly.

Armand Digital remains responsible for managing its own processor obligations and applicable sub-processor notification procedures.

6.7 Independent third-party integrations

Where a Customer authorises a direct connection to a third-party service, such as Xero, that provider may also process information independently under its own terms.

Such providers will be classified according to their actual role in the relevant processing activity.

7. Security of processing

7.1 Security measures

Armand Digital will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against unauthorised access, accidental loss, destruction, alteration and unlawful disclosure.

The measures will take account of the nature of the processing, the risks to individuals and applicable legal requirements.

7.2 Application security

Zuzo's application-level controls include:

• HTTPS/TLS encryption for data transmitted through the Service.
• Secure and HttpOnly session cookies.
• User authentication and access controls.
• Optional two-factor authentication using authenticator applications.
• Two-factor authentication backup codes.
• Restricted administrative access through an approved email allow-list.
• Additional encryption of Xero OAuth tokens.
• Controlled access for authorised personnel and developers.
• Automated account deletion processes.

7.3 Hosting provider security

Zuzo's hosting and database infrastructure is provided through Emergent's managed environment.

According to Emergent's documented security arrangements, it maintains:

• ISO 27001 certification.
• SOC 2 Type II attestation.
• Independent annual security audits.
• Role-based personnel access restrictions.
• Periodic reviews of personnel access.
• Confidentiality obligations for authorised personnel.
• Security incident response arrangements.
• Business continuity and disaster recovery procedures.

These are security measures and certifications maintained by Emergent, not certifications independently held by Armand Digital or Zuzo.

7.4 Confidentiality

Armand Digital will ensure that employees, contractors and other authorised personnel who have access to Customer Personal Data are subject to appropriate confidentiality obligations.

7.5 Access restrictions

Access to Customer Personal Data will be limited to authorised personnel and service providers who require it for legitimate operational, maintenance, security, development or support purposes.

7.6 Review

Armand Digital will review its security measures periodically and following material changes in risks, technology or the Service.

Further technical and organisational measures are described in Annex C.

8. Personal data breaches

8.1 Notification

Armand Digital will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data processed on the Customer's behalf.

8.2 Information provided

Notification will include, to the extent known:

1. The nature and circumstances of the breach.
2. The categories and approximate numbers of affected individuals and records.
3. The likely consequences.
4. The measures taken or proposed to address and mitigate the breach.
5. Appropriate contact details.

Information may be provided in stages where an investigation is ongoing.

8.3 Infrastructure provider incidents

Emergent has stated that it will notify Armand Digital within 72 hours after becoming aware of a relevant personal data breach under its contractual arrangements.

This is an upstream provider commitment and does not extend the period within which Armand Digital must notify its own controller customers without undue delay.

8.4 Cooperation

Armand Digital will provide reasonable assistance to support investigation, containment, remediation and applicable reporting obligations.

8.5 Regulatory responsibility

Where the Customer acts as controller, it remains responsible for assessing whether notification to a supervisory authority or affected individuals is legally required.

Armand Digital remains responsible for notifications required of it in its own capacity.

9. Data subject rights and compliance assistance

9.1 Customer responsibility

Where the Customer acts as controller, it is responsible for responding to relevant data subject rights requests.

9.2 Assistance

Armand Digital will, taking account of the nature of the processing and information available, provide appropriate technical and organisational assistance to enable Customers to meet their applicable obligations.

This may include assistance with:

• Access to personal data.
• Correction of inaccurate personal data.
• Erasure of personal data.
• Data portability.
• Restrictions or objections to processing.
• Security and data breach compliance.
• Data protection impact assessments.

9.3 Direct requests

Where Armand Digital receives a request relating to Customer Personal Data for which the Customer is controller, it will refer the request to the Customer where appropriate and without undue delay.

Armand Digital will not independently determine the outcome unless legally required or permitted, or instructed by the Customer.

9.4 Contact

Requests may be submitted to:

support@getzuzo.com

10. Audits and compliance

10.1 Compliance information

Armand Digital will make available information reasonably necessary to demonstrate compliance with the applicable obligations under Article 28 of the UK GDPR.

10.2 Audits

Armand Digital will permit and contribute to audits and inspections conducted by the Customer or an appropriately appointed auditor as required by applicable Data Protection Legislation.

10.3 Reasonable arrangements

Audits will be arranged in a manner that reasonably protects security, confidentiality, other customers' information and business operations.

Where sufficient, Armand Digital may initially provide relevant documentation, policies, contractual assurances or available independent security reports.

Nothing in this section restricts mandatory statutory audit or inspection rights.

11. International data transfers

11.1 Processing locations

Zuzo is hosted through Emergent's managed infrastructure.

Based on information provided by Emergent, its infrastructure includes:

• MongoDB Atlas database hosting in the United States.
• AWS hosting and S3 object storage in the United States.
• Service-related processing and authorised access that may occur in the United States, European Union and India.

11.2 International safeguards

Where Customer Personal Data is transferred internationally, Armand Digital will ensure that applicable data protection requirements are satisfied.

Where required for restricted transfers under the UK GDPR, appropriate safeguards may include:

• UK adequacy regulations.
• The UK International Data Transfer Agreement.
• The European Commission's Standard Contractual Clauses together with the UK Addendum.
• Another lawful transfer mechanism.

Applicable transfer risk assessments and supplementary measures will be implemented where required.

11.3 Emergent transfer arrangements

Emergent has stated that its DPA incorporates the European Commission's Standard Contractual Clauses and the UK Addendum for relevant international transfers.

Emergent Labs Inc. is based in Pleasanton, California, United States.

Its contractual documentation identifies the Irish law framework for its DPA and the UK Information Commissioner's Office in relation to relevant UK transfer arrangements.

Those contractual arrangements govern Emergent's obligations to Armand Digital and do not replace Armand Digital's obligations to its Customers.

11.4 Australian customers

Where Australian privacy legislation applies, the parties will comply with their respective obligations, including applicable Australian Privacy Principles concerning disclosure of personal information to overseas recipients.

11.5 Provider information

Relevant provider locations, processing activities and transfer arrangements will be maintained in Annex B or the associated provider register.

12. Term and termination

12.1 Duration

This DPA remains effective for as long as Armand Digital processes Customer Personal Data on the Customer's behalf.

12.2 Access following cancellation or termination

Where a Customer cancels their Zuzo subscription, they will retain full access to the Service until the end of their current paid subscription period.

At the end of that period, the subscription will terminate and access to the Service will cease immediately.

The Customer will no longer be able to log into or use subscription features, including financial reporting, forecasting, planning tools and in-app data exports.

12.3 Right to request data export

Following termination of the subscription, the Customer will have 90 calendar days to request an export of their available Customer Personal Data by emailing:

support@getzuzo.com

The 90-day period begins on the date the paid subscription period expires, not the date on which the Customer submits their cancellation.

Armand Digital will provide available Customer Personal Data in a reasonably accessible electronic format, subject to identity verification, applicable law and reasonable technical limitations.

Customers will not need to maintain an active subscription to request their data during this period.

12.4 Customer-initiated account deletion

Where a Customer actively requests account deletion through Zuzo, the account will enter a 30-day recovery period.

Following this period, the Service will initiate permanent deletion of the relevant account data through its automated deletion process, subject to backup retention, technical limitations and legally required retention.

12.5 Deletion timeframe

Unless otherwise required by law or agreed in writing, Customer Personal Data will be retained for up to 90 calendar days following the effective termination date of the subscription.

At the end of the 90-day post-termination retention period, Armand Digital will arrange for the secure deletion of the relevant Customer Personal Data from active application systems, subject to applicable backup retention arrangements, technical limitations and legally required retention.

12.6 Backups and infrastructure retention

Customer Personal Data may remain temporarily within infrastructure backups after deletion from active application systems.

Emergent has indicated that its contractual retention arrangements may permit data to remain for 45 days following deletion of an Emergent customer account, and that residual backups are isolated from further ordinary processing until removed through the applicable backup cycle.

This 45-day period must not be assumed to apply automatically to deletion of an individual Zuzo user's records.

During any residual backup retention period, Customer Personal Data will remain subject to appropriate confidentiality and security measures and will not be used for unrelated purposes.

12.7 Legally required retention

Where personal data must be retained to comply with legal or regulatory obligations, Armand Digital will retain only the information required, restrict its use appropriately and continue to protect it until deletion is permitted.

12.8 Independent controller records

Certain subscription, accounting, billing, security and compliance records held by Armand Digital as controller may be retained separately under the Privacy & Cookie Policy and applicable law.

13. Notices

13.1 Contact details

Notices relating to this DPA may be sent to:

Armand Digital Limited
12 Fore Street
Chudleigh
Devon
TQ13 0HX
United Kingdom

Email: support@getzuzo.com

13.2 Customer notices

Armand Digital may send notices to the email address associated with the Customer's Zuzo account or another designated contact address.

13.3 Emergent notices

Formal notices concerning Armand Digital's processing arrangements with Emergent are managed through Emergent's designated privacy contact:

privacy@emergent.sh

Customers of Zuzo should direct their own requests and notices to Armand Digital.

14. General provisions

14.1 Relationship to Terms and Conditions

This DPA supplements the applicable Zuzo Terms and Conditions.

14.2 Liability

Liability arising under this DPA is governed by the applicable Terms and Conditions, to the extent permitted by law, without excluding or restricting any liability or statutory right that cannot lawfully be limited.

14.3 Changes

Armand Digital may update this DPA to reflect changes to the Service, legal requirements, sub-processors or data processing arrangements.

Where a change materially affects the Customer's data protection rights or processing arrangements, appropriate notice will be provided.

14.4 Governing law

This DPA is governed by the laws of England and Wales, subject to applicable mandatory data protection requirements.

Annex A — Details of processing

A1. Subject matter

Zuzo is a cloud-based financial education, forecasting, reporting and money management platform for business owners and individuals.

A2. Nature and purpose

Processing may include collecting, importing, recording, storing, analysing, retrieving, displaying, exporting and deleting financial or related information.

Processing may be carried out through the following features.

The Money System

Educational guidance, checklists and implementation roadmaps for establishing financial management routines.

Cash Flow Forecast

Importing accounting information through customer-authorised connections to Xero, including bank accounts, chart of accounts, invoices, bills, bank summaries and Profit & Loss information.

Relevant information is synchronised into Zuzo's database to support financial forecasting and analysis.

The integration is read-only and does not create or modify entries in Xero.

Profit Engine

Receiving uploaded Profit & Loss spreadsheets or accounting data, storing extracted financial figures, grouping income and expenses, calculating financial metrics and creating management reports.

Optional AI-generated insights may be produced using selected financial metrics.

Uploaded Excel spreadsheets are processed through temporary files which are deleted after parsing. Extracted report data may be retained.

Monthly Money Date

Recording financial figures entered by customers, including figures agreed with accountants, tax reserves, planned transfers, financial targets and completion records.

Monthly Life Date

Recording personal and business goals, time allocations, income sources, financial targets and planning information.

Net Worth Tracker

Recording assets, investments, property, liabilities, savings, business valuations and historical financial snapshots.

Debt Triage

Recording debt balances, interest rates, repayment amounts, debt classifications and progress towards repayment.

A3. Duration

Processing continues while the Customer uses the Service and during applicable post-termination retention, export and deletion periods.

A4. Data subjects

Depending on the information supplied, data subjects may include:

• Business owners and directors.
• Employees and contractors.
• Customers and clients.
• Suppliers.
• Spouses and partners.
• Other individuals identified in financial records.

A5. Categories of data

Depending on customer inputs and connected systems, processed information may include:

• Names and contact information.
• Business affiliations.
• Accounting transactions and invoice information.
• Financial balances and financial account information.
• Income and expenditure.
• Remuneration or payroll-related information.
• Financial assets and liabilities.
• Goals and financial planning information.
• Other personal data contained in relevant records.

A6. Special category information

Zuzo is not designed to collect special category personal data as part of its standard functionality.

Customers should avoid entering unnecessary sensitive information in free-text fields, support screenshots and uploaded records.

Where such data is nevertheless processed, applicable data protection requirements continue to apply.

A7. Processing instructions

The Customer's authorised use and configuration of Zuzo constitute documented instructions, subject to the terms of this DPA.

Annex B — Sub-processors and third-party services

The following providers are used in connection with Zuzo.

The list distinguishes services used in processing customer-controlled information from services used by Armand Digital for its own administration.

B1. Customer data processing and infrastructure

MongoDB Atlas and AWS are identified for transparency as underlying infrastructure providers. Their position in the contractual sub-processor chain will follow Emergent's applicable provider arrangements.

B2. Other services and integrations

GitHub is used for source-code management and is not intended to receive live Customer Personal Data.

QuickBooks will be assessed and added when its integration becomes operational.

B3. AI processing safeguards

The Profit Engine may send selected Profit & Loss-derived metrics to Anthropic's Claude model through Emergent's AI service for the purpose of generating insights.

According to Emergent's stated contractual arrangements, Emergent does not use Customer Personal Data to train AI models and requires its AI sub-processors not to use such data for model training.

B4. Changes

Armand Digital will maintain and update its applicable provider information as processing arrangements change.

Emergent's own provider register is available at:

https://app.emergent.sh/subprocessors

Annex C — Technical and organisational security measures

C1. Infrastructure

Zuzo operates on Emergent-managed Kubernetes infrastructure using MongoDB database storage.

Based on the information supplied by Emergent, the infrastructure uses US-based hosting and database services, with possible processing and access from other regions.

C2. Security certifications

Emergent reports maintaining ISO 27001 and SOC 2 Type II certifications or attestations, supported by independent security audits.

These relate to Emergent's infrastructure and operations and do not mean Armand Digital or Zuzo independently holds those certifications.

C3. Encryption

Zuzo uses:

• HTTPS/TLS for data transmitted between users and the Service.
• Secure and HttpOnly session cookies.
• Fernet encryption for stored Xero OAuth tokens.

C4. Authentication and access controls

Zuzo uses authenticated accounts and restricted administrative access.

Two-factor authentication using TOTP/authenticator applications is available but optional.

Administrators are restricted through an approved email allow-list. Authorised personnel with database-level access may access underlying records where necessary for legitimate operational purposes.

C5. Personnel controls

Emergent reports maintaining role-appropriate personnel access, confidentiality arrangements and periodic access reviews.

Armand Digital will apply appropriate confidentiality and access restrictions to its own authorised employees, contractors and developers.

C6. Third-party accounting access

The Xero integration operates using read-only permissions.

Zuzo stores synchronised accounting information for forecasting and reporting.

On disconnection, Zuzo clears relevant synchronised accounting collections from the associated workspace.

C7. Data minimisation

Uploaded Profit & Loss spreadsheets are temporarily processed and the temporary upload files deleted after parsing.

Only extracted information required for the report and related Service functionality is intended to be retained.

C8. AI services

AI processing is limited to customer-requested financial insights based on selected report metrics.

Emergent states that Customer Personal Data is not used to train its AI models and that equivalent restrictions apply to its AI sub-processors.

C9. Retention and deletion

Zuzo currently operates a 30-day recovery period for customer-initiated account deletion, followed by an automated purge.

A separate 90-day post-termination export and retention arrangement is specified in Section 12.

C10. Backups and disaster recovery

Emergent maintains business continuity and disaster recovery arrangements.

C11. Incident management

Emergent maintains documented incident-response arrangements.

Armand Digital will maintain its own process for identifying, investigating, escalating and responding to security incidents affecting the Service.

C12. Ongoing security review

Armand Digital will review security and access controls periodically and as necessary following material changes to the Service, infrastructure or identified security risks.