365 IT Guard Data Processing Agreement

Version 2026-11 · Last updated: November 4, 2026

The short version

When a business uses 365 IT Guard to monitor its PCs, the business decides what is collected about the people who use them. We handle that information only on the business's behalf. This agreement sets out the promises we make about it.

• We use your users' personal information only to run 365 IT Guard for you. We never sell it, use it for advertising, or use it for our own purposes.
• We keep it secure and confidential, and we tell you quickly if there's a breach.
• We help you answer your users' privacy requests.
• We tell you before adding a company that handles it for us.
• We delete it when you leave.

This agreement applies automatically to every Business account. Nothing needs to be signed.

1. Who this agreement is between

This Data Processing Agreement (the "DPA") is between Zenlo Innovations & Technology LLC ("Zenlo", "we", "us") and the organization that holds a Business account for 365 IT Guard ("Customer", "you").

It forms part of the 365 IT Guard Terms of Service (the "Terms") and takes effect when you accept the Terms for a Business account. It ends when we no longer hold any Customer Personal Data. If this DPA and the Terms conflict on the handling of Customer Personal Data, this DPA wins.

2. Definitions

Words defined in the Terms mean the same here. In addition:

• "Customer Personal Data" means personal information that we process on your behalf when we provide the Service to your Business account. This includes information about your users and the devices enrolled to your organization, as described in Annex A.
• "Data Protection Laws" means the US federal and state privacy laws that apply to the processing of Customer Personal Data, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), and the consumer privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states.
• "Security Incident" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Subprocessor" means another company that we engage to process Customer Personal Data.
• "Business", "controller", "service provider", "processor", "consumer", "sell" and "share" have the meanings given in the Data Protection Laws.

3. Roles

You are the business or controller of Customer Personal Data. We are your service provider or processor, and we will act as your service provider, not as a third party, for that data.

Customer Personal Data includes your users' and admins' names and email addresses as they appear in your organization, for example in its member list and as device owners.

This DPA doesn't cover information we handle as a business or controller in our own right: the sign-in credentials and security records of each account (password hash, two-step sign-in phone number, and sign-in history), billing records, website analytics, and our records of terms acceptance. Our Privacy Policy covers that information.

4. Your instructions

We process Customer Personal Data only to provide, secure and support the Service for you, as the Terms, this DPA and Annex A describe, and on your other documented instructions. Your use and configuration of the Service, such as enrolling devices, inviting users, and turning features like the AI Assistant on or off, are your instructions.

If we believe an instruction breaks Data Protection Laws, we'll tell you, and we may decline to follow it.

You're responsible for:

• having a lawful basis for collecting Customer Personal Data;
• giving your users any notice the law requires about the monitoring (for employers, this usually means a written notice to employees); and
• getting any consent the law requires.

5. Limits on our use

We will not:

• sell or share Customer Personal Data;
• retain, use or disclose it for any purpose other than the business purposes set out in Annex A, including any commercial purpose or for advertising;
• retain, use or disclose it outside our direct business relationship with you;
• combine it with personal information we receive from anyone else, or collect ourselves, except as Data Protection Laws allow a service provider to; or
• use it to train AI models.

We may use Customer Personal Data to build or improve the Service, and to detect security incidents and prevent fraud, only as Data Protection Laws allow a service provider to. Any aggregated information we use must be de-identified so that it no longer identifies you, a person or a device. We will keep de-identified information in that form, publicly commit not to re-identify it, and not attempt to. If we ever share de-identified information, we will require the recipient by contract to do the same.

We will comply with the obligations that Data Protection Laws place on service providers and processors, and give Customer Personal Data the level of privacy protection those laws require. If we decide we can no longer meet these obligations, we'll tell you. You may then take reasonable and appropriate steps to stop and remedy any unauthorised use of Customer Personal Data, including ending your use of the Service.

We certify that we understand and will comply with the restrictions in this section.

6. Confidentiality

We make sure that everyone we authorise to process Customer Personal Data, including our staff and contractors, is bound by a duty of confidentiality and has access only as far as their role requires.

7. Security

We maintain the technical and organisational security measures described in Annex B, which are designed to protect Customer Personal Data against Security Incidents. We may update them over time, as long as the overall level of protection doesn't decrease.

8. Security Incidents

If we become aware of a Security Incident affecting Customer Personal Data, we will:

• notify you promptly after we discover it, and in any case within 72 hours, by email to your organization's admins;
• give you the information we reasonably can about what happened, the data and people affected, and what we are doing about it, and update you as we learn more; and
• take reasonable steps to contain the incident, reduce its effects and stop it happening again.

You decide whether and how to notify affected people and regulators, unless the law requires us to do so ourselves. Our notice of an incident is not an admission of fault.

9. Subprocessors

You authorise us to use the Subprocessors listed in Annex C.

Before we add or replace a Subprocessor, we'll update Annex C and email your organization's admins at least 30 days before the new Subprocessor starts processing Customer Personal Data. If you have a reasonable objection related to data protection, tell us at legal@365itguard.com within that period. We'll work with you in good faith to resolve it. If we can't, you may cancel your subscription before the change takes effect, and we'll refund any fees you paid in advance for the time after the cancellation.

We bind each Subprocessor by a written contract with data protection obligations at least as protective as those in this DPA, as far as they apply to its service. We remain responsible to you for their performance of those obligations.

10. Helping you with requests and assessments

Your users' requests. If one of your users asks us to access, correct, delete or export their personal information, or to exercise another right under Data Protection Laws, we'll pass the request to you and won't respond ourselves except to tell them to contact you. The Service lets admins view and remove devices and users. Where you need more help to respond, we'll give it as far as is reasonable.

Assessments. We'll give you the information you reasonably need to carry out data protection assessments that Data Protection Laws require of you.

Regulators. If a regulator or law enforcement asks us for Customer Personal Data, we'll tell you first unless the law forbids it, and we'll disclose only what the law requires.

11. Showing that we comply

On your written request, no more than once a year, we'll give you the information you reasonably need to show that we comply with this DPA, such as written answers to a security questionnaire.

If that information isn't enough, or a regulator or Data Protection Laws require it, you may have an independent auditor, who is bound by confidentiality, assess our compliance. Give us at least 30 days' notice and agree the scope with us first. Assessments take place during business hours, must not disrupt the Service or other customers, and are at your cost. Alternatively, we may arrange an independent assessor at our cost and give you a copy of its report.

12. Deleting Customer Personal Data

While you use the Service, you can remove devices and users in the admin portal. If you want a copy of Customer Personal Data, email privacy@365itguard.com and we'll provide it in a machine-readable format.

When you archive your organization, you can restore it for 30 days. After that we erase Customer Personal Data, normally within a few days and in any case within 35 days of archiving, and it rolls off our automated backups within a further 7 days. Ask for any copy you need before then. We may keep data that the law requires us to keep, and we'll keep it confidential and use it only for that purpose.

13. Location

We and our Subprocessors store and process Customer Personal Data in the United States, except that Cloudflare carries traffic through its data center nearest the user, as Annex C says.

14. Liability

Each party's liability under this DPA is subject to the limits in the Terms.

15. Changes

We may update this DPA to reflect changes in Data Protection Laws or the Service. We won't make a change that materially reduces the protection of Customer Personal Data unless the law requires it. Significant changes follow the notice process in the Terms.

Annex A. Details of processing

Annex B. Security measures

• Encryption in transit. All traffic between the app, the sign-in page, the admin portal and our servers uses TLS.
• Encryption at rest. Our database is encrypted at rest and not reachable from the internet. Secrets are kept in a managed vault.
• Device credentials. Each device has its own credential, encrypted on the PC with Windows data protection and stored on our side only as a hash.
• Sign-in. Passwords are handled by Google Firebase and never reach our servers. Every account must set up two-step sign-in.
• Access control. Staff access to production systems and Customer Personal Data is limited to the people who need it. Administrative changes and requests to our servers are logged. Inside your organization, roles decide who sees which devices.
• Data minimisation. The app checks connection addresses, websites, file names and hardware serial numbers on the PC and never uploads them. Before an AI Assistant question leaves the PC, usernames, device names and other identifiers it can detect are replaced with placeholders.
• Software integrity. Every app release is code-signed. The app's background service listens only on the PC itself.
• Retention. Data is pruned automatically on the schedule in Annex A. Automated database backups roll over every 7 days.
• Testing. Changes go through code review and automated tests before release.
• Incident response. We monitor our systems for errors and abuse, and we follow the notification process in section 8.

Annex C. Subprocessors

Stripe and Google Analytics also handle information about your account, but as our own providers for billing and website measurement, not as Subprocessors of Customer Personal Data. The Privacy Policy covers them.