zerofive
Request access

Draft: the amber chips are details still to be filled in.

Data Processing Agreement

How zerofive handles the personal data of a merchant's customers on the merchant's behalf: our roles, the security we keep, the providers we use, and what happens after a breach or when the account ends. Customers don't need to read this; the Privacy Policy covers them.

Effective DPA effective date

1.This agreement and who does what

This Data Processing Agreement ("DPA") is between ZeroFive, established in Hong Kong with its registered address at Hong Kong (full address to follow) ("zerofive", "we"), and the business that holds a merchant account ("you"). It forms part of your agreement with us under the Terms of Service at /terms and applies automatically when you use the service. Where it conflicts with that agreement on the protection of personal data, this DPA applies. Where the Standard Contractual Clauses in section 7 apply, they prevail over both if there is a conflict.

For the personal data of your customers, supporters and other payers that we handle to provide the service to you ("customer personal data"), you are the controller and we are your processor. Under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), you are the data user and we are your data processor.

We are an independent controller, not your processor, for data we use for our own purposes: running and securing merchant accounts, screening transfers for sanctions and other risk, preventing fraud and misuse, keeping financial records and meeting our own legal obligations. The Privacy Policy at /privacy describes that processing. This DPA does not cover it.

"Data protection law" means the laws that apply to the processing, which can include the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection and the Personal Data (Privacy) Ordinance. Terms such as controller, processor, personal data breach and supervisory authority have the meanings those laws give them.

2.What we process

ItemSubject matter and nature
DetailsHosting, storing, transmitting and displaying data to create invoices, run hosted checkout, take subscriptions, tips and customer deposits, send receipts and renewal emails, deliver webhooks and process refunds.
ItemPurpose
DetailsProviding the service you request through the dashboard, the API and your account settings, and supporting you in using it.
ItemDuration
DetailsFor as long as you use the service, then until the data is deleted or returned under section 10.
ItemData subjects
DetailsYour customers, subscribers, supporters and other payers, and any person whose details you send us in invoice or customer data.
ItemCategories of data
DetailsNames or customer references, email addresses, invoice and order details, subscription status, metadata you submit, tip names, amounts and messages, blockchain addresses, transaction identifiers and amounts, refund details, and technical information such as the IP address and browser details of a checkout visit.
ItemSpecial categories
DetailsNone intended. Do not send health, biometric, political, religious or other special category data, identity documents or criminal records in invoice metadata, descriptions or tip messages.
ItemFrequency
DetailsContinuous, while the service is in use.

3.Your instructions

Apart from the processing we carry out as controller under section 1, we process customer personal data only on your documented instructions. Your instructions are this DPA and your agreement with us, the choices you make in the dashboard and API (for example the webhooks, emails and public tip pages you turn on), and any other written instruction we agree to.

If a law requires us to process the data in another way, we will tell you first unless that law forbids it. We will tell you promptly if we believe an instruction breaches data protection law; we may then decline to follow it until you confirm or change it.

You are responsible for having a lawful basis for the processing you instruct, for giving your customers the privacy information the law requires, and for the accuracy of the data you send us.

4.Confidentiality

Only people who need access to provide, support or secure the service may access customer personal data. Everyone with access is bound by a duty of confidentiality, by contract or by law.

5.Security measures

We keep technical and organisational measures appropriate to the risk, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing. They include:

  • Encrypted connections (HTTPS) between browsers, API clients and the service, and for live webhooks to your endpoint, behind a network proxy and security layer that limits abuse.
  • Password hashing, two-factor authentication, recovery codes, short-lived login challenges and server-side sessions.
  • Team roles, and API key permissions that limit what each key can change; signed webhooks.
  • Restricted administrative access, with sensitive administrative actions recorded in security logs.
  • Hosting and encrypted off-site backups in the EU, with locked backup copies to support recovery after an incident.
  • Monitoring of errors and service health, and a process for handling security incidents under section 8.

We may update these measures as long as the overall level of protection does not decrease. You are responsible for the security of your own account, team access, API keys, webhook endpoints and the systems that receive data from us.

6.Sub-processors

You authorise us to use the sub-processors below. We engage each one under written terms that include the data protection commitments data protection law requires of a sub-processor, to the extent they apply to the service it provides. We remain responsible to you for their performance of those commitments.

Sub-processorHetzner Online GmbH
What it does and whereHosts the application and database and stores encrypted off-site backups. Location: EU. No transfer outside the EU.
Sub-processorCloudflare, Inc.
What it does and whereNetwork proxy and security layer; processes traffic and connection information. Location: global network.
Sub-processorResend
What it does and whereDelivers receipts, renewal and payment emails; receives recipient addresses and message content. Location: United States.
Sub-processorQuickNode
What it does and whereBlockchain nodes and address monitoring; receives watched addresses and transaction data. Location: distributed, may be outside the EU.

QuickNode is listed because it keeps the addresses we watch for you on its side and reports payments to them. The public blockchains, and the other blockchain, market-data, energy-rental (TronSave) and block-explorer services listed in /privacy, are not listed here: they only answer individual lookups or orders with addresses, transaction identifiers and amounts, and never receive customer names, email addresses or other account records. Our internal operational alerts, sent through Telegram, concern our own operation of the service and are covered by /privacy.

We will tell you at least 30 days before a new sub-processor starts processing customer personal data, by email to your account's owner and by updating this page. You may object on reasonable data protection grounds within that period. We will then try to address the objection; if we cannot, you may end the affected part of the service without a termination charge.

7.International transfers

We are established in Hong Kong, and our sub-processors operate in the locations listed above. Where data protection law restricts the transfer of customer personal data from you to us, the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference, with you as data exporter and us as data importer.

  • Clause 7 (docking) applies; in Clause 9 option 2 (general written authorisation) applies with the notice period in section 6; the optional wording in Clause 11 does not apply.
  • Clauses 17 and 18: the law and courts of Ireland, unless the parties agree another EU member state.
  • Annex I is section 2 of this DPA, Annex II is section 5 and Annex III is the list in section 6. The competent supervisory authority is the one that applies to you under Clause 13.
  • For transfers subject to the UK GDPR, the UK International Data Transfer Addendum applies to those clauses. For transfers subject to Swiss law, references to the GDPR mean the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner is the competent authority.

Onward transfers to sub-processors outside the EU use the European Commission's Standard Contractual Clauses, or an adequacy decision where one applies, together with any supplementary measures needed. Write to [email protected] for a copy of a relevant safeguard; commercial terms may be redacted.

8.Personal data breaches

We will notify you without undue delay and in any case within 72 hours after becoming aware of a personal data breach affecting customer personal data. We will send the notice to your account's owner by email.

As far as the information is available, the notice will describe the nature of the breach, the categories and approximate numbers of people and records concerned, the likely consequences, the measures taken or proposed, and a contact for more information. Where we do not have all of this at once, we will send it in phases without further undue delay.

We will take reasonable steps to contain and investigate the breach and to reduce its effects. You decide whether to notify a supervisory authority or the people affected; we will help you do so. Notifying you of a breach is not an admission of fault.

9.Helping you meet your obligations

The dashboard and API let you find and export the customer data you control. To correct or delete customer records, write to [email protected]; we will act on your request unless we must keep the record under section 10. If a person asks us directly to exercise a privacy right over customer personal data, we will pass the request to you promptly and will not respond to it ourselves except to tell them we have done so, unless the law requires otherwise.

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with requests you cannot handle with those tools, with data protection impact assessments and with prior consultations with a supervisory authority.

10.Deletion and return at the end

Export your customer data through the dashboard or API before you delete your account; deleting it removes everyone's access, including API keys. Within 30 days after the service ends, you may still ask [email protected] for a copy of the customer data we hold for you, or for its deletion.

Payment, invoice and account records, including the customer details attached to them, are kept as independent controller for our own legal obligations, such as accounting and anti-money-laundering record-keeping, under the retention schedule in /privacy. Other customer personal data we hold only as your processor is deleted on your request. Encrypted backups keep copies for at least their storage lock periods described in /privacy; while they exist, the data in them stays protected under this DPA and is not used for any other purpose.

We cannot delete or change public blockchain records, or copies you or others have sent to systems outside zerofive, such as your webhook endpoints.

11.Information and audits

We will make available the information reasonably necessary to show that we meet this DPA, including written answers to security questionnaires and any relevant certifications or audit reports of our sub-processors.

If that information is not enough, or a supervisory authority requires it, you may audit our compliance yourself or through an independent auditor bound by confidentiality. Give us at least 30 days written notice. Audits take place during business hours, no more than once a year unless there has been a personal data breach or a regulator requires it, and must not compromise the security of the service or other merchants' data. Each side bears its own costs.

12.Liability, term and changes

Each side's liability under this DPA is subject to the limits in your agreement with us, except where data protection law or the Standard Contractual Clauses do not allow a limit.

This DPA lasts for as long as we process customer personal data for you. We may update it to reflect changes in law, our sub-processors or the service. We will give notice of material changes in the same way as for changes to the Terms of Service, and an update will not reduce the protection of customer personal data.

Contact [email protected] about this DPA or to send a notice under it, or write to ZeroFive, Hong Kong (full address to follow).