Privacy Statement

How We Collect and Use (Process) Your Personal Information

Data we collect as a controller

‍Where ZeroDrift determines the purposes and means of processing — principally in relation to our website visitors, prospects, and business contacts — the personal data we collect is generally limited to:

• Name
• Job title
• Employer name
• Work address
• Work email
• Work phone number

We use this information to provide prospects and customers with services.We do not sell personal information to anyone and only share it with thirdparties who are facilitating the delivery of our services.

From time to time, ZeroDrift receives personal information about individuals from third parties. Typically, information collected from third parties will include further details on your employer or industry. We may also collect your personal data from a third-party website (e.g. LinkedIn).

Data we process on behalf of ourcustomers

Where ZeroDrift provides the ZeroDrift platform to a customer, we processthe content of communications that the customer submits to the platform, together with associated meta data such as sender, recipient, and timestamp. ZeroDrift acts as a processor for this data and processes it only on the customer’s documented instructions.

ZeroDrift does not request, seek, or knowingly collect special categories of personal data as defined in Article 9 of the GDPR, and our customer agreements direct customers not to submit such data to the platform. Because the platform evaluates the content of communications as they are written, we cannot exclude the possibility that a message submitted by a customer incidentally contains such data. Where that occurs, it is subject to the same retention, security, and access controls as all other customer-submitted content and is deleted onthe same schedule.

‍

Purpose and lawful basis for processing

ZeroDrift processes personal data for the following purposes:

• To provide our services, including operating theZeroDrift platform to analyze, rewrite, or block communications — on the basisof contract performance.
• To manage our business operations, including payroll, benefits, accounting, and cap table administration — on the basis of contract performance and legal obligation.
• To communicate with customers about their existing services, and to send marketing about similar services to existing customers —on the basis of our legitimate interest in promoting our business, subject toyour right to object and to opt out at any time.
• To send marketing communications to prospects who arenot existing customers, where consent is required under applicable law — on thebasis of your consent, which you may withdraw at any time.
• To recruit employees — on the basis of contract performance and legitimate interest.
• To operate and improve our website — on the basis oflegitimate interest.

Use of ZeroDrift's Website

As is true of most other websites, ZeroDrift’s website collects certain information automatically and stores it in log files. This information mayinclude internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system, and other usage information about the use of ZeroDrift’s website,including a history of the pages you view.

We use this information to help us design our site to better suit ourusers’ needs, diagnose problems with our server, administer our website,analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.

ZeroDrift has a legitimate interest in understanding how members, customers, and potential customers use its website. This assists ZeroDrift with providing more relevant products and services and with providing appropriate staffing to meet customer needs.

Automated Processing and Human Review

The ZeroDrift platform combines deterministic rules with large language models to evaluate communications in real time.

When the platform identifies language that matches a rule configured by our customer, the message is automatically blocked and a revised version isgenerated. The revised message is presented to a human reviewer, who must accept it before the message is sent. No message is sent without that human step. Both the original determination and the reviewer’s decision are recorded in an audit record available to the customer.

The rules that determine whether a message is flagged are configured and controlled by our customer, not by ZeroDrift.

Where you are an employee or representative of a ZeroDrift customer, that customer is the controller of your communications data. The customer is responsible for informing you that this monitoring takes place, for assessing whether the processing produces legal or similarly significant effects for you, and for responding to your data subject rights requests. ZeroDrift acts as a processor on that customer’s documented instructions.

Personal data passing through the platform is processed using artificialintelligence and large language models as part of the core service. Customerdata is not used to train, tune, or improve any AI models, whether proprietary to ZeroDrift or operated by our third-party providers.

ZeroDrift uses external large language model providers, currently OpenAI and Anthropic, as sub-processors to perform this analysis in real time. These providers process data solely to deliver the service and do not retain it oruse it to train their own models. The current list of all ZeroDrift sub-processors is maintained on our TrustCenter.

Customer-uploaded data processed through the platform is retained for 7 days, after which it is deleted.

If you believe a communication was blocked or revised in error, you may raise it with your organisation’s compliance team, or contact us at support@zerodrift.ai and we will route your request to the relevant customer.

‍

Data Subject Rights

‍The European Union’s General Data Protection Regulation (GDPR) and other countries’ privacy laws provide certain rights for data subjects. These include:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right of data portability
• Right to object
• Rights related to automated decision-making, includingprofiling
• Right to withdraw consent (where applicable)

These rights apply to personal data for which ZeroDrift is thecontroller. Where ZeroDrift processes personal data on behalf of a customer — including the content of communications submitted to the ZeroDrift platform — that customer is the controller of that data. Please direct requests concerning it to the relevant organisation. If you contact us instead, we will forward your request to them without undue delay.

If you wish to confirm that ZeroDrift is processing your personal data, or to have access to the personal data ZeroDrift may have about you, please contact us. You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside ZeroDrift might have received the data; what the source of the information was (if you didn’t provide it directly to ZeroDrift); and how long it will bestored. You have a right to correct (rectify) the record of your personal data maintained by ZeroDrift if it is inaccurate. You may request that ZeroDrifterase that data or cease processing it, subject to certain exceptions. You may also request that ZeroDrift cease using your data for direct marketing purposes.

Reasonable access to your personal data will be provided at no cost. If access cannot be provided within a reasonable time frame, ZeroDrift will provide you with a date when the information will be provided. If access is denied, ZeroDrift will provide an explanation as to why.

In many countries, you have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how ZeroDrift processes your personal data.

For questions or complaints concerning the processing of your personal data, you can email us at support@zerodrift.ai. If you are located in the European Union, you can also have recourse to the European Data Protection Supervisor or your nation’s data protection authority.