GDPR / LGPD Compliance

Important: This page does not serve as legal advice. Please determine together with your legal advisor how GDPR and LGPD apply to your business.

​

🔢 Table of Contents

1. Overview
2. What is GDPR?
3. What is LGPD?
4. Is ZappWay Compliant?
5. Data Processing & Responsibilities
6. Your Data Rights
7. Subprocessors
8. Data Processing Agreement

​

1. Overview

​

Key Compliance Points

• Full transparency about data collection and processing
• User control over all collected data
• Data minimization - we only collect what’s necessary
• Security measures to protect your information
• Right to deletion and data portability
• International data transfer safeguards

​

2. What is GDPR?

​

General Data Protection Regulation (GDPR)

• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimization
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability

​

Does GDPR Affect You?

• Your business is based in the European Union (EU)
• You process personal data of individuals in the EU
• You offer goods or services to people in the EU
• You monitor the behavior of people in the EU

• Names and email addresses
• IP addresses and location data
• Identification numbers
• Online identifiers (cookies, device IDs)
• Any information relating to an identified or identifiable person

​

3. What is LGPD?

​

Lei Geral de Proteção de Dados (LGPD)

• Purpose and necessity
• Free access to data
• Data quality and transparency
• Security and prevention
• Non-discrimination
• Accountability and responsibility

​

Does LGPD Affect You?

• Your business operates in Brazil
• You process personal data of individuals in Brazil
• You collect data within Brazilian territory
• You offer goods or services to people in Brazil

• Personal information (nome, CPF, RG, endereço)
• Sensitive data (origem racial, dados de saúde, biometria)
• Data about children and adolescents
• Any information that can identify a person

​

GDPR vs LGPD: Key Similarities

• Consent-based processing: Users must consent to data collection
• Right to access: Users can request their data
• Right to deletion: Users can request data removal
• Data portability: Users can transfer their data
• Breach notification: Companies must report data breaches
• Privacy by design: Data protection built into systems
• Significant penalties: Heavy fines for non-compliance

​

Key Differences

​

4. Is ZappWay Compliant?

​

Yes, ZappWay Complies with Both GDPR and LGPD

​

The Measures We Took

• What data we collect
• How we use your data
• Data retention periods
• International data transfers
• Your data protection rights
• How to exercise your rights

• View all data: Access your complete data at any time
• Export data: Download all your information
• Delete data: Permanently remove data from our systems
• Modify data: Update or correct your information
• Control sharing: Decide who has access to your data

• Encryption: Data encrypted in transit (TLS) and at rest (AES-256)
• Access controls: Role-based permissions and authentication
• Regular audits: Security assessments and penetration testing
• Monitoring: 24/7 security monitoring and threat detection
• Backups: Regular encrypted backups with 90-day retention
• Incident response: Documented breach notification procedures

• No unnecessary personal information
• Limited data retention periods
• Regular data cleanup and archival
• Purpose-specific data collection

• Default privacy-friendly settings
• Clear consent mechanisms
• Granular privacy controls
• Anonymous data processing where possible

• Right to access (Art. 15 GDPR / Art. 18 LGPD)
• Right to rectification (Art. 16 GDPR / Art. 18 LGPD)
• Right to erasure (Art. 17 GDPR / Art. 18 LGPD)
• Right to data portability (Art. 20 GDPR / Art. 18 LGPD)
• Right to object (Art. 21 GDPR / Art. 18 LGPD)
• Right to withdraw consent (Art. 7 GDPR / Art. 8 LGPD)

​

5. Data Processing & Responsibilities

​

Understanding Data Roles

​

ZappWay’s Role

​

When You Use ZappWay Services

• Form responses you collect
• Documents uploaded to datastores
• Customer data processed by AI Employees
• Any personal information collected through your AI Employees

• Storing form responses on your behalf
• Processing queries through AI Employees
• Indexing documents in datastores
• Executing automations you configure

​

For Your ZappWay Account

• Your account registration information
• Billing and payment details
• Usage analytics and logs
• Support communications

​

Your Responsibilities as Data Controller

• Consent: User explicitly agrees to data collection
• Contract: Processing necessary to fulfill a contract
• Legal obligation: Required by law
• Legitimate interests: Necessary for your business interests
• Vital interests: Necessary to protect someone’s life
• Public task: Necessary for public interest tasks

• What data you collect
• Why you collect it
• How long you store it
• Who you share it with
• Their rights under GDPR/LGPD

By submitting this form, you consent to [Company Name] collecting and 
processing your personal information for [specific purpose]. Your data 
will be stored securely and you can request access, correction, or 
deletion at any time by contacting [email].

For more information, see our Privacy Policy: [link]

• Access their data
• Correct inaccurate data
• Delete their data
• Export their data
• Object to processing
• Withdraw consent

1. Log in to your ZappWay dashboard
2. Navigate to the relevant datastore or form
3. Search for the individual’s data
4. Export, modify, or delete as requested
5. Respond to the individual within legal timeframes:
   • GDPR: 1 month (extendable to 3 months)
   • LGPD: 15 days (extendable with justification)

• Define retention periods for different data types
• Regularly review and delete old data
• Document your retention policy
• Honor deletion requests

• Assess the breach: Determine scope and impact
• Notify ZappWay: Contact [email protected] immediately
• Notify authorities:
  • GDPR: Within 72 hours to supervisory authority
  • LGPD: In reasonable timeframe to ANPD
• Notify affected individuals: If high risk to their rights
• Document the breach: Keep records of the incident

​

What Happens with Form Data?

• You (the AI Employee creator) are the data controller for form responses
• ZappWay is the data processor storing information on your behalf
• You have full control over the data you collect
• You determine retention periods while your account is active
• You can export or delete form responses at any time

• Deletions you make are permanent and immediate in production
• Deleted data is removed from backups within 90 days
• We cannot recover data once you delete it

​

6. Your Data Rights

​

Under GDPR and LGPD, You Have the Right To:

​

1. Right to Access (Transparency)

• Email [email protected] with subject “Data Access Request”
• Include your account email and any specific data categories
• We will respond within 30 days (GDPR) or 15 days (LGPD)

• Copy of your personal data
• Categories of data processed
• Purposes of processing
• Recipients of your data
• Retention periods

​

2. Right to Rectification (Correction)

• Update your account information directly in dashboard settings
• Email [email protected] for data you cannot modify yourself
• We will update your information within 30 days

​

3. Right to Erasure (Right to be Forgotten)

• Go to Account Settings → Delete Account
• Or email [email protected] with subject “Data Deletion Request”
• We will delete your data within 30 days
• Data removed from backups within 90 days

• Legal obligations
• Legitimate interests (e.g., fraud prevention)
• Public interest or scientific research
• Defense of legal claims

​

4. Right to Data Portability

• Go to Account Settings → Export Data
• Or email [email protected] with subject “Data Portability Request”
• We will provide data in JSON or CSV format
• You can transfer data to another service

​

5. Right to Object

• Email [email protected] with subject “Objection to Processing”
• Specify which processing activities you object to
• We will assess and respond within 30 days

​

6. Right to Restrict Processing

• You contest the accuracy of data
• Processing is unlawful but you don’t want deletion
• We no longer need the data but you need it for legal claims
• You’ve objected to processing pending verification

​

7. Right to Withdraw Consent

• Update consent preferences in Account Settings
• Unsubscribe from marketing emails
• Email [email protected] to withdraw specific consents

​

8. Right to Lodge a Complaint

• Contact your national Data Protection Authority (DPA)
• List of DPAs: https://edpb.europa.eu/about-edpb/board/members_en

• Contact ANPD (Autoridade Nacional de Proteção de Dados)
• Website: https://www.gov.br/anpd/
• Email: [email protected]

​

7. Subprocessors

​

How Do We Use Your Personal Data?

• Use data to provide and improve our services
• Share data with subprocessors (see table below)
• Process data according to your instructions

• Sell personal data to third parties
• Use data for unrelated marketing purposes
• Serve advertisements based on your data
• Share data beyond what’s necessary for operations

​

Our Subprocessors

​

International Data Transfers

• Standard Contractual Clauses (SCCs): EU-approved contracts
• Adequacy decisions: Countries deemed adequate by EU Commission
• Supplementary measures: Additional technical safeguards

• International transfer agreements: Compliant with ANPD requirements
• Standard contractual clauses: Based on LGPD requirements
• Adequate level of protection: Verification of destination country laws

• We use Standard Contractual Clauses
• Data is encrypted in transit and at rest
• Access is limited to necessary operations only
• We regularly review their security practices

​

Subprocessor Changes

• Notify you of changes via email
• Provide 30 days notice before onboarding new subprocessors
• Allow you to object to new subprocessors
• Offer alternatives if you object

​

8. Data Processing Agreement

​

What is a DPA?

• Responsibilities for data protection
• Security measures
• Data breach procedures
• Subprocessor arrangements
• Audit rights

​

ZappWay’s DPA

• Email: [email protected]
• Subject: “Data Processing Agreement Request”
• Include: Your company name and account email

• Processing instructions and scope
• Data subject rights procedures
• Security measures and obligations
• Subprocessor list and terms
• Breach notification procedures
• Audit and compliance terms
• International data transfer provisions
• Termination and data return procedures

Important: ❗ We cannot modify or sign custom DPAs. Instead, we’ve put significant effort into creating a standardized DPA that aligns with GDPR and LGPD regulations and protects all parties involved. Our standard DPA meets the requirements of both GDPR Article 28 and LGPD Article 41.

• Consistency: Same protections for all customers
• Compliance: Reviewed by legal experts for GDPR/LGPD compliance
• Efficiency: Fast turnaround without lengthy negotiations
• Updates: Easy to update for regulatory changes
• Scalability: Allows us to serve customers effectively

​

Alternative Options

• Enterprise plans: May have more flexibility (contact [email protected])
• Self-hosting: Consider our self-hosted option for full control
• Hybrid approach: Use ZappWay for non-sensitive data only

​

📞 Support & Resources

​

Questions About Compliance?

• Email: [email protected]
• Subject: “GDPR/LGPD Question”
• Response time: 2-3 business days

• Email: [email protected]
• Live chat: Available in dashboard
• Documentation: Help Center

​

Additional Resources

• European Data Protection Board
• GDPR Official Text
• EU Commission GDPR

• ANPD Website
• LGPD Official Text
• LGPD English Guide

• Privacy Policy
• Cookie Policy
• Terms of Service
• Security Practices

​

Report a Data Breach

1. Email: [email protected] with subject “SECURITY BREACH”
2. Include: Description, affected data, estimated impact
3. We will respond within 24 hours

1. Acknowledge and investigate (within 24 hours)
2. Contain and remediate the breach
3. Assess risk to data subjects
4. Notify authorities if required (within 72 hours for GDPR)
5. Notify affected users if high risk
6. Provide detailed incident report

​

✅ Quick Compliance Checklist

​

For AI Employee Creators (Data Controllers)

• Add privacy notice to forms collecting personal data
• Define data retention periods
• Document legal basis for data processing
• Have process for handling data subject requests
• Review and update privacy policies regularly
• Train team on GDPR/LGPD requirements
• Implement data breach response plan
• Request ZappWay’s DPA if needed
• Keep records of processing activities
• Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing

​

For ZappWay Users (Data Subjects)

• Review ZappWay’s privacy policy
• Understand what data is collected
• Know your rights (access, deletion, portability, etc.)
• Update privacy preferences in account settings
• Know how to export your data
• Know how to delete your account
• Contact [email protected] for data requests
• Report concerns to supervisory authorities if needed