Company data processing

The customer company remains responsible for its customers’, suppliers’ and employees’ data. For remote operations requested by this company, Zentra acts as a processor. Data relating to Zentra’s own commercial account is covered by the privacy policy.

Instructions are features selected by an authorised person, company settings and written requests accepted by support. Zentra uses entrusted data for these features without reusing it for advertising or remote model training. An instruction that appears contrary to data protection is reported to the customer.

Depending on the features enabled: contact details, project identifiers, photos, plans, business documents, salary information and attachments. The people concerned are in particular customers, suppliers and employees. Operations include receipt, storage, organisation, authorised access, synchronisation, backup, return and deletion, as well as, if the company enables them, the classification of Support messages and the preparation of draft quotes by Autopilote, always validated by an authorised person. Processing lasts while the service is used, then according to return instructions and applicable obligations. Do not import sensitive data that the feature does not need.

If the company turns them on, Zentra also processes on its behalf: Autopilote’s analysis of received e-mails and documents, on filtered excerpts; the publication of quotes and invoices on the client portal, with clients’ decisions and booking requests; the read copy used by the public API, the MCP server and webhooks; orders received from Shopify and WooCommerce shops; handing invoices to Pingen for sending by post; sending documents through the company’s mailbox; the file status published for the fiduciary; and the encrypted second copy of the legal archive, which Zentra cannot read.

Drafts received through the API, the MCP server or a shop, and Autopilote’s proposals, only enter the company’s books after approval by an authorised person or by a rule the company has turned on.

Zentra restricts access to the people and services that need it and requires appropriate confidentiality from them. Protections include HTTPS communication, individual accounts, roles, logical separation of companies, device revocation and the integrity checks described on the security page. The customer protects their devices and keeps independent backups. This annex does not promise end-to-end encryption, hosting exclusively in Switzerland or certification.

The customer authorises the use of necessary providers listed in the provider list, according to their scope. Data protection obligations must be reflected in the applicable commitments with subprocessors. Zentra remains responsible for its own obligations.

Services the company connects with its own account, such as Pingen, Payrexx, an SMS provider, Shopify, WooCommerce, its mailbox or a tool connected to the API, are not Zentra’s subprocessors. The company chooses and uses them under its own contract with them, even when Zentra passes data to them at its request.

Before adding or materially replacing a subprocessor, Zentra informs the customer and allows an objection based on data protection grounds. The parties seek a solution; failing that, the customer may stop the affected feature and request the return of their data.

An international transfer requires a country recognised as adequate or another applicable legal mechanism, including appropriate contractual safeguards. Listing a provider here does not by itself prove that such commitments have been concluded. Locations, safeguards and documents must be confirmed for any specific requirement before the relevant transfer.

Within the scope of the data accessible to the service, Zentra helps the customer respond to requests for access, correction, return and deletion and carry out the necessary assessments. If a breach involving the entrusted data is identified, Zentra informs the customer without undue delay, shares the available information and cooperates on corrective measures. The customer assesses the notifications required to individuals and authorities.

The customer exports their data and backups before the service ends. They may ask support to return or delete hosted copies. Zentra verifies their authorisation and specifies the data deleted, remaining records or copies and reasons for retention. Archives subject to a mandatory retention period are not deleted before it ends. The customer manages copies on their devices and those sent to third parties.

The customer may request the information necessary to verify this addendum at info@zentraapp.ch. Any additional review is organised proportionately, protecting other customers and service security. Particular constraints of the customer’s activity require separate validation.