Data Processing Agreement

Last update: 09/10/2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Zilla Technologies Ltd. ("Processor", "we", "us") and you, the nutrition or health professional ("Controller", "you"), and governs the processing of personal data that you submit to or collect through the Foodzilla platform ("Service") on behalf of your clients or patients.

By using the Service, you agree to this DPA. This DPA is designed to meet the requirements of Article 28 of the General Data Protection Regulation ("GDPR") and other applicable data protection laws.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller through the Service.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, transmission, erasure, or destruction.
• "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• "Data Subject" means the individual to whom the Personal Data relates, typically a client or patient of the Controller.

2. Roles and Responsibilities

You, as the Controller, determine the purposes and means of processing Personal Data through the Service. We, as the Processor, process Personal Data only on your behalf and in accordance with your documented instructions, which are defined by your use of the Service and this DPA.

You are responsible for ensuring that you have a lawful basis for processing Personal Data and that you have obtained all necessary consents from your clients or patients before entering their data into the Service.

Where the Controller processes health data, the Controller is responsible for having a valid condition under GDPR Article 9 (for example, explicit consent or the provision of health care).

3. Scope of Processing

3.1 Subject Matter and Purpose

The Processor processes Personal Data to provide the Service to the Controller, including client management, meal planning, nutritional analysis, recipe management, health tracking, messaging, and related platform features.

3.2 Categories of Data Subjects

• Clients and patients of the Controller
• The Controller (nutrition or health professional) and their staff

3.3 Types of Personal Data

• Identity data: name, email address, date of birth, gender, profile photo
• Health data: nutrition information, dietary preferences, allergies, intolerances, exercise data, weight, body measurements, health metrics, progress photos, and practitioner notes
• Communication data: messages exchanged between Controller and their clients through the platform
• Usage data: food diary entries, meal plan data, recipe interactions
• Payment data: subscription and billing information (processed by Stripe; card details are not stored by Foodzilla)
• Forms data: intake forms, questionnaires and consent forms
• Booking data: appointment dates, times and booking history
• Client payment data: invoices and payments between the Controller and their clients (processed by Stripe)
• Video consultation data: live video and audio streams of consultations (not recorded or stored), call metadata, call transcripts, and AI-generated call summaries

3.4 Duration of Processing

Personal Data is processed for the duration of the Controller's use of the Service. The Controller can delete Personal Data at any time, either in the Service (self-service) or by request to the Processor. Deletion is actioned promptly across live systems, and residual backup copies are removed within the three month backup cycle described in Section 5.

If the Controller gives no instruction, Personal Data is kept in an inactive state for up to 7 years after the last account activity, to support the Controller's legal duty to keep health records. While an account is inactive, Personal Data is not processed for any purpose other than storage, unless required by law or to resolve disputes.

After 7 years, the Processor deletes the Personal Data automatically. The Processor sends a notice to the Controller at least 30 days before deletion.

Where retention is required by law, those records are retained for the period the law requires. Transaction and billing records, for example, may be retained for up to 7 years to meet tax and accounting obligations.

3.5 Video Consultations and AI Summaries

• Foodzilla Meet video calls are processed by Cloudflare in real time.
• Foodzilla does not record or store video or audio of calls.
• When the Controller uses the summary feature, Cloudflare creates a text transcript of the call. AI summaries are then created from the transcript with open-source models on Cloudflare Workers AI. Neither happens unless the Controller uses this feature.
• Neither Foodzilla nor Cloudflare uses call content to train AI models.
• Transcripts and summaries are stored in MongoDB Atlas (Singapore) and follow the retention rules in Section 3.4.
• The Controller is responsible for telling clients that a call is transcribed and summarised by AI, and for getting consent where the law requires it.

4. Processor Obligations

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law. In such cases, the Processor will inform the Controller of the legal requirement before processing, unless prohibited by law.
• Inform the Controller immediately if, in the Processor's opinion, an instruction infringes applicable data protection law.
• Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Section 5.
• Assist the Controller in fulfilling its obligation to respond to Data Subject requests to exercise their rights under applicable data protection laws.
• Assist the Controller in ensuring compliance with breach notification obligations, taking into account the nature of processing and the information available to the Processor.
• Assist the Controller with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and the information available to the Processor.
• At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of the Service, and delete existing copies unless applicable law requires storage of the Personal Data.
• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA.

5. Security Measures

The Processor implements and maintains the following technical and organisational security measures:

• Encryption in transit: All data transmitted between users and the Service is encrypted using TLS/SSL. Real-time connections use encrypted WebSocket (WSS) protocols.
• Encryption at rest: Personal Data stored in databases is encrypted at rest using industry-standard encryption.
• Access controls: Access to Personal Data is restricted to authorised personnel on a need-to-know basis. Administrative access requires multi-factor authentication.
• Infrastructure security: The Service is hosted on secure infrastructure with DDoS protection, web application firewalls, and automated threat detection provided by Cloudflare and our hosting providers.
• Data backups: Foodzilla maintains encrypted backups for disaster recovery purposes. Backups are retained for up to three months, after which they are permanently and automatically deleted. When you request deletion of your data, it is removed from our live systems promptly, and any copies persisting in backups are erased within this three month window.
• Payment security: All payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor. Card details are never stored on Foodzilla servers.
• Regular review: Security measures are reviewed and updated regularly to address emerging threats and vulnerabilities.

6. Sub-processors

The Controller provides general authorisation for the Processor to engage Sub-processors.

The Processor gives at least 30 days' notice of any new or replacement Sub-processor by email to the Controller's account email and on its sub-processor page (the table in this Section 6, at foodzilla.com/dpa). The Controller can object within this period on reasonable data protection grounds.

Primary hosting location: Personal Data processed under this DPA is stored in a MongoDB Atlas database cluster located in the Asia Pacific (Singapore) region. Singapore is therefore the primary location of processing, and Personal Data is encrypted in transit and at rest there and in all backups.

The following Sub-processors are currently engaged:

The Processor ensures that Sub-processors are bound by data protection obligations no less protective than those set out in this DPA. The Processor remains fully liable for the acts and omissions of its Sub-processors.

7. Third-Party Integrations

Some integrations are turned on by the Controller, for example Autopilot (a connection to the Controller's own Claude or ChatGPT account), Cliniko and Zapier.

When the Controller turns on an integration, the Controller instructs the Processor to send the related Personal Data to that service.

These services are chosen by the Controller and are not Sub-processors of the Processor. The Controller is responsible for its own agreement with each service.

8. International Data Transfers

Personal Data is primarily stored and processed in Singapore, as set out in Section 6. Personal Data may also be transferred to and processed in other countries outside the Controller's country of residence, including New Zealand, the United States and the European Union, where our Sub-processors are located.

8.1 Transfers from the United Kingdom and the European Economic Area

Singapore is not covered by UK adequacy regulations or an EU adequacy decision. Where Personal Data is transferred out of the United Kingdom or the European Economic Area, including to the primary hosting location in Singapore, the Processor ensures that appropriate safeguards are in place:

• UK transfers: the Standard Contractual Clauses (SCCs) approved by the European Commission, together with the International Data Transfer Addendum (the "UK Addendum") issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018. Where a Sub-processor offers it in place of the SCCs, the Processor instead enters into the UK International Data Transfer Agreement (IDTA). On request, the Processor will enter into the UK Addendum or the IDTA directly with the Controller in respect of the Service.
• EEA transfers: the Standard Contractual Clauses approved by the European Commission.
• Sub-processor terms: data processing agreements with Sub-processors that include equivalent data protection obligations.
• Adequacy: reliance on UK adequacy regulations or an EU adequacy decision where the destination country has been recognised as providing an adequate level of data protection, including for transfers to New Zealand.
• EU fallback: if the EU adequacy decision for New Zealand stops applying, the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2) apply automatically between the Controller and the Processor. On request, the Processor will sign the EU SCCs directly with the Controller.
• Transfer risk assessments: where required, the Processor assesses the laws and practices of the destination country before relying on a transfer mechanism, and applies supplementary technical measures such as encryption in transit and at rest.

8.2 Australian Privacy Principle 8: Cross-Border Disclosure

Where Personal Data about Australian individuals is disclosed to an overseas recipient, including the primary hosting provider in Singapore, the Processor takes reasonable steps (as required by Australian Privacy Principle 8 and section 16C of the Privacy Act 1988 (Cth)) to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information. Those steps include:

• Contractual obligations: binding data protection terms with every overseas Sub-processor requiring standards of protection at least equivalent to those required under the Australian Privacy Principles, limiting use of Personal Data to the services engaged, and prohibiting any secondary use or disclosure.
• Encryption: Personal Data is encrypted in transit using TLS/SSL (and WSS for real-time connections) and encrypted at rest in the hosted database and in all backups.
• Access controls: access to Personal Data is restricted to authorised personnel on a need-to-know basis, administrative access requires multi-factor authentication, and access is logged and reviewed.
• Provider assurance: the Processor favours Sub-processors holding recognised independent security certifications (such as ISO 27001 or SOC 2) and reviews their security and privacy practices regularly.
• Breach cooperation: Sub-processor agreements require prompt notification of any security incident affecting Personal Data, so that the Controller and the Processor can meet their obligations under the Notifiable Data Breaches scheme.

9. Data Breach Notification

In the event of a personal data breach affecting Personal Data processed under this DPA, the Processor shall:

• Notify the Controller without undue delay, and in any event within 48 hours of becoming aware of the breach.
• Provide the Controller with sufficient information to enable the Controller to fulfil its own breach notification obligations under applicable data protection laws, including the nature of the breach, the categories and approximate number of Data Subjects affected, the likely consequences, and the measures taken or proposed to address the breach.
• Cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

10. Data Subject Rights

The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under applicable data protection laws, including the right to:

• Access their Personal Data
• Rectify inaccurate Personal Data
• Erase their Personal Data ("right to be forgotten")
• Restrict processing of their Personal Data
• Data portability
• Object to processing

Where a Data Subject contacts the Processor directly with a request, the Processor shall promptly redirect the request to the Controller, unless the Processor is legally required to respond directly.

11. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

Audits shall be conducted with reasonable prior written notice (at least 30 days), during normal business hours, and in a manner that does not unreasonably disrupt the Processor's operations. The Controller shall bear the costs of any audit unless the audit reveals a material breach of this DPA by the Processor.

12. Term and Termination

This DPA shall remain in effect for the duration of the Controller's use of the Service. Upon termination of the Service, the Processor shall, at the Controller's choice:

• Return all Personal Data to the Controller in a structured, commonly used, and machine-readable format; or
• Delete all Personal Data and existing copies, unless applicable law requires continued storage.

If no instruction is received, Personal Data is kept in an inactive state for up to 7 years after the last account activity, as set out in Section 3.4. After 7 years, the Processor deletes it automatically, and sends a notice to the Controller at least 30 days before deletion. The Controller can delete Personal Data at any time, either in the Service (self-service) or by request to the Processor. Deletion is actioned promptly across live systems, and residual backup copies are erased within the three month backup cycle described in Section 5.

13. Limitation of Liability

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

14. Governing Law

This DPA is governed by the laws of New Zealand, consistent with the governing law provisions of the Terms of Service. For Controllers located in the European Economic Area or the United Kingdom, this DPA shall also be interpreted in accordance with GDPR requirements.

15. Contact

For any questions or requests relating to this DPA, please contact us at support@foodzilla.io.

Zilla Technologies Ltd.
New Zealand
NZBN 942 904 691 0004

EU and UK Representatives (GDPR Article 27)

EU representative: Euverify Limited (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland. gdpr@euverify.com

UK representative: Euverify Ltd (UK), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. gdpr@euverify.com