Zenithrzenithr
Sign inRequest a demo
Legal

Data Processing Addendum (summary)

Last updated: 27 June 2026

⚠️ This template content is published for transparency. The contractually binding version is the one signed with Procapita Management Consulting Group. For executable agreements, contact legal@pro-capita.com.
The authoritative version of this document is the English text. Translations are provided for convenience.

Roles

For customer workspace data: the customer is the controller and Procapita is the processor. Sub-processors are engaged under written agreements with equivalent obligations.

Scope of processing

  • Subject matter: performance management and related people processes.
  • Duration: the term of the subscription plus the agreed export/deletion window.
  • Nature & purpose: hosting, processing and securing customer data so the Service can be delivered.
  • Data subjects: the customer's employees, contractors and other workforce members.
  • Data categories: identifiers, employment data, performance data, feedback responses, attachments uploaded by the customer.

Sub-processors

Current sub-processor list available on request at privacy@pro-capita.com. Customers will be notified before a new sub-processor is engaged and may object on reasonable grounds.

Security measures

Technical and organisational measures include: encryption in transit (TLS) and at rest (AES-256); role-based access control; row-level isolation; immutable audit logging; continuous monitoring; documented incident response; staff training; certified management systems (see Compliance).

International transfers

Where data is transferred across borders, we use Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent local transfer mechanisms.

Data subject assistance

We will assist the customer in responding to data subject requests using appropriate technical and organisational measures.

Breach notification

We will notify the customer without undue delay after becoming aware of a personal data breach affecting customer data, and in any event within the timelines required by applicable law.

Audits

The customer may audit our compliance with the DPA, with reasonable notice and at the customer's cost, in a manner that does not disrupt the Service or other customers.

Return & deletion

On termination, we will make customer data available for export and then delete it within the timelines stated in the executed DPA.

How to sign

The full executable DPA is available on request at legal@pro-capita.com.