1. Scope, parties and instructions
This Data Processing Agreement (DPA) forms part of the Terms of Service between the operator of zlit.ai in the Republic of Cyprus (zlit.ai) and the business or professional customer accepting those Terms (Customer). It applies when zlit.ai processes personal data on Customer's behalf to provide the Service (Customer Personal Data).
Applicable Data Protection Law means the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and other privacy or data-protection law applicable to the processing. GDPR terminology has its GDPR meaning where GDPR applies.
Customer acts as controller or, when processing for its own client, as processor. zlit.ai acts respectively as processor or sub-processor. An agency acting as processor must have the authority required from its controller to engage zlit.ai and further sub-processors. Customer is responsible for the lawful grounds, notices and authority supporting its instructions; zlit.ai retains its own legal duties.
This DPA becomes binding when incorporated into Customer's affirmative acceptance of the Terms or separately accepted in writing, including electronically. Our own account administration, billing and website processing are described in the Privacy Policy.
zlit.ai will process Customer Personal Data only on documented instructions, including this DPA, the service agreement, enabled rule configurations and further lawful written instructions. Where law requires other processing, zlit.ai will notify Customer before that processing unless the law prohibits notice. If an instruction appears to infringe Applicable Data Protection Law, zlit.ai will promptly inform Customer and may suspend the affected instruction while the issue is resolved.
2. Description of processing
The subject matter is the provision of configurable advertising rules for Meta advertising accounts. Processing is performed to retrieve the information needed for a rule, evaluate its conditions, execute customer-authorised actions and provide related support and security.
The operations include authorised retrieval, recording, storage, organisation, analysis, consultation, transmission, access for necessary troubleshooting, return and deletion. Automated processing occurs as required by Customer's use of the Service; personnel access is limited to authorised support, security and administration.
| Processing area | Types of data | Categories of individuals |
|---|---|---|
| Connected-account access | Account and business identifiers, granted permissions, access tokens and account metadata required for the connection. | Customer and client account administrators and authorised users, where identifiable. |
| Rule evaluation and execution | Campaign, ad-set and ad identifiers and settings, selected performance metrics, rule conditions, action records and timestamps. | People identifiable from permitted account or campaign metadata; aggregated campaign statistics may not themselves be personal data. |
| Customer-directed troubleshooting | The minimum relevant account records, diagnostic information and communications supplied to resolve an issue. | Customer or client personnel and other individuals whose information is lawfully necessary to resolve the issue. |
Only information needed for the selected functionality is within scope. Individual lead collection, customer contact-list uploads, sensitive personal records, independent audience enrichment and backend database ingestion are not included. A material expansion of processing requires appropriate instructions and an updated description.
Special-category data, criminal-offence data, children's personal data and full payment-card data are outside the intended scope. If received accidentally, zlit.ai will restrict further use, notify Customer where appropriate and arrange lawful removal or return.
Processing lasts for the service relationship and the limited period necessary for return, deletion or required retention under section 8.
3. Purpose restrictions and anonymous information
zlit.ai will not sell Customer Personal Data, use it for its own marketing, disclose it to other customers in identifiable form or use it to build independent profiles of Customer's end users.
Genuinely anonymous information may be used for service improvement subject to section 6.3 of the Terms. Processing personal data to create that information requires lawful documented instructions and an applicable legal basis. This DPA does not authorise independent use of identifiable or pseudonymised Customer Personal Data for model training or unrelated product development.
Source-platform restrictions continue to apply. Cross-customer combination, benchmarking or model training using Meta-derived data is permitted only where the applicable platform terms and permissions allow it. zlit.ai will not attempt re-identification or expose confidential customer-level information.
A deletion instruction is not replaced by subsequently anonymising data for zlit.ai's own purposes. Only genuinely anonymous information already lawfully produced falls outside the personal-data deletion obligations.
4. Confidentiality and security
zlit.ai will ensure that personnel authorised to process Customer Personal Data are bound by confidentiality and receive access only as necessary for their responsibilities.
zlit.ai will implement and maintain technical and organisational measures appropriate to the risks, including the commitments in Annex 1. These measures address confidentiality, integrity, availability and the effectiveness of safeguards. zlit.ai may update individual measures without materially reducing the overall level of protection or falling below Applicable Data Protection Law.
5. Sub-processors
Customer gives general written authorisation for zlit.ai to engage sub-processors in accordance with this section.
Before a sub-processor processes Customer Personal Data, zlit.ai will make its identity, function, relevant processing locations and applicable transfer safeguards available to Customer. zlit.ai will maintain current sub-processor information and provide it through support@zlit.ai, including as part of onboarding and on request. This information may be supplied electronically and forms part of the processing arrangements.
zlit.ai will assess the suitability of each sub-processor and enter into a written agreement imposing data-protection obligations substantively equivalent to those relevant to its processing under this DPA. zlit.ai remains responsible for its sub-processors' performance as required by Applicable Data Protection Law.
zlit.ai will give Customer at least 30 days' written notice before adding or replacing a sub-processor that will receive Customer Personal Data. Customer may object during that period on reasonable data-protection grounds. The parties will seek a practical resolution. If none is available, Customer may terminate the affected Service before processing by the new sub-processor begins and receive the unused prepaid portion. Mandatory remedies remain unaffected.
Meta's provision of its advertising platform directly to Customer does not itself make Meta a zlit.ai sub-processor. Providers used solely for zlit.ai's own controller activities are governed by the relevant arrangements and Privacy Policy rather than this sub-processor authorisation.
6. International transfers
zlit.ai will not make a transfer restricted by Applicable Data Protection Law without the required instructions and a valid transfer mechanism. Depending on the flow, this may include an applicable adequacy decision or correctly completed standard contractual clauses, together with transfer assessments and supplementary safeguards where required. UK and other applicable transfer requirements will be addressed for the relevant flow.
The location of zlit.ai in Cyprus does not by itself determine the location of hosting, backups, sub-processors or authorised remote access. Processing-location information is provided under section 5.
zlit.ai will make information about relevant safeguards and copies of applicable transfer arrangements available on request, subject to legitimate redactions that preserve an understanding of the safeguards. Binding transfer clauses prevail over conflicting provisions of this DPA. If a mechanism ceases to be valid, zlit.ai will establish a lawful alternative or suspend the affected transfers.
7. Personal data breaches and assistance
zlit.ai will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include available information about the nature and scope, affected categories and approximate numbers where known, likely consequences, measures taken or planned, and a contact point. Information may be provided in stages without delaying the initial notice.
zlit.ai will investigate and take appropriate containment and remedial measures, and assist Customer with relevant notifications. It will not notify individuals or authorities on Customer's behalf unless instructed or required by law.
Taking account of the nature of processing and information available, zlit.ai will assist Customer with data-subject requests, security obligations, impact assessments and prior consultations. A request concerning Customer Personal Data received directly by zlit.ai will be routed promptly to Customer; zlit.ai will not respond substantively unless authorised or required by law.
Assistance is available through support@zlit.ai. Any agreed charges for exceptional assistance must not prevent compliance with mandatory duties. Assistance necessitated by zlit.ai's own breach is not charged.
8. Return, deletion and retention
On termination of the relevant Service or receipt of a valid instruction, zlit.ai will, at Customer's choice, return Customer Personal Data in a reasonably usable form and delete remaining copies, or delete it without return. Return is arranged before deletion of the data to be returned. zlit.ai will confirm completion on request.
Deletion from active systems will occur without undue delay and within 30 days of termination or receipt of the valid deletion instruction, whichever occurs first. Residual backup copies will be protected, excluded from ordinary use and removed within 90 days of that same event. The backup period is not added to the active-system deletion period. Earlier deadlines under applicable law, platform requirements or binding instructions take priority.
If backups are restored, prior deletion instructions will be reapplied. Data awaiting deletion remains protected by this DPA and is not used for new purposes. Return and deletion do not require a new paid subscription and remain subject to proportionate identity and authority verification.
Where Union or Member State law requires retention for processing governed by Article 28 GDPR, zlit.ai will retain only the required subset, notify Customer where lawful and restrict further processing to the permitted requirement. Other mandatory retention duties apply only to the extent consistent with Applicable Data Protection Law.
Personal data will not be retained merely for future product improvement. Genuinely anonymous information already lawfully produced under section 3 may be retained separately. Deletion by zlit.ai does not itself delete Meta accounts, campaigns or information held independently by Meta.
9. Information and audits
zlit.ai will provide information reasonably necessary to demonstrate compliance with this DPA and permit and contribute to audits, including inspections, as required by Applicable Data Protection Law. Relevant documentation and available reports may be used first where sufficient.
Routine audits require reasonable notice, appropriate confidentiality and arrangements that protect other customers' information and avoid unnecessary disruption. These arrangements do not restrict legally required audits or investigations of credible non-compliance. Any agreed charges must not obstruct mandatory audit rights.
10. Applicable US state privacy requirements
Where processing is subject to a US state privacy law under which zlit.ai acts as a service provider, contractor or processor, zlit.ai will comply with the requirements of that role. It will not sell or share Customer Personal Data for cross-context behavioural advertising; retain, use or disclose it outside the specified business purposes or direct relationship except as permitted by law; or combine it with other personal information except as legally permitted.
zlit.ai certifies that it understands and will comply with these restrictions. Customer may take reasonable steps to verify compliance and to stop or remediate unauthorised use. zlit.ai will notify Customer if it determines it can no longer meet these obligations.
11. Duration, changes and liability
This DPA continues for as long as zlit.ai processes Customer Personal Data, including return, deletion and any required residual retention. Suspension of a subscription does not suspend data-protection duties.
Material changes require notice under the Terms and a lawful amendment process. Changes do not retroactively authorise an undisclosed purpose, recipient or unlawful transfer. Where processing cannot be performed lawfully, the affected processing will be suspended. Customer may terminate the affected Service if the issue is not resolved, without prejudice to mandatory remedies.
The liability provisions in section 10 of the Terms apply to the Terms and DPA cumulatively, to the extent permitted by law. They do not reduce regulatory powers, non-waivable responsibilities, data subjects' statutory remedies or rights under binding transfer clauses.
Privacy requests and instructions: support@zlit.ai.
Security incidents: support@zlit.ai.
Contract notices: support@zlit.ai.
Annex 1 — Technical and organisational measures
The following are zlit.ai's security commitments for processing Customer Personal Data under this DPA. Their application is proportionate to the nature of the processing and the associated risks.
| Area | Commitment |
|---|---|
| Encryption | Protect Customer Personal Data in transit and at rest with appropriate encryption, including connection credentials and backup copies; restrict access to encryption keys. |
| Personnel and access | Limit access to authorised people with a service-related need, apply confidentiality obligations and appropriate authentication, and remove access when no longer required. |
| Customer separation | Apply access and authorisation controls designed to prevent one customer from accessing another customer's data, rules or credentials. |
| Connection credentials | Protect Meta tokens against unauthorised use and disclosure, restrict their scope and access, and prevent their inclusion in ordinary application logs or support messages. |
| Monitoring and maintenance | Maintain relevant security records, restrict access to logs, address identified vulnerabilities and control changes affecting production processing. |
| Resilience and recovery | Maintain safeguards for availability and recovery, protect backup copies and periodically assess restoration arrangements at intervals appropriate to risk. |
| Incident response | Maintain procedures for detecting, escalating, investigating and containing incidents, and for notifying Customer under section 7. |
| Data lifecycle | Limit collection to the authorised purpose, implement return and deletion instructions, and apply the active-system and backup deadlines in section 8. |
| Supplier oversight | Assess sub-processors, impose appropriate written obligations and maintain information needed for disclosure and transfer safeguards. |
| Effectiveness | Periodically assess whether safeguards remain appropriate and address material deficiencies. No specific certification is incorporated unless separately agreed in writing. |
zlit.ai — Republic of Cyprus.