Data Processing Agreement

Last update: 06/08/2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Zilla Technologies Ltd. ("Processor", "we", "us") and you, the nutrition or health professional ("Controller", "you"), and governs the processing of personal data that you submit to or collect through the Foodzilla platform ("Service") on behalf of your clients or patients.

By using the Service, you agree to this DPA. This DPA is designed to meet the requirements of Article 28 of the General Data Protection Regulation ("GDPR") and other applicable data protection laws.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller through the Service.
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, transmission, erasure, or destruction.
• "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• "Data Subject" means the individual to whom the Personal Data relates, typically a client or patient of the Controller.

2. Roles and Responsibilities

You, as the Controller, determine the purposes and means of processing Personal Data through the Service. We, as the Processor, process Personal Data only on your behalf and in accordance with your documented instructions, which are defined by your use of the Service and this DPA.

You are responsible for ensuring that you have a lawful basis for processing Personal Data and that you have obtained all necessary consents from your clients or patients before entering their data into the Service.

3. Scope of Processing

3.1 Subject Matter and Purpose

The Processor processes Personal Data to provide the Service to the Controller, including client management, meal planning, nutritional analysis, recipe management, health tracking, messaging, and related platform features.

3.2 Categories of Data Subjects

• Clients and patients of the Controller
• The Controller (nutrition or health professional) and their staff

3.3 Types of Personal Data

• Identity data: name, email address, date of birth, gender, profile photo
• Health data: nutrition information, dietary preferences, allergies, intolerances, exercise data, weight, body measurements, health metrics, progress photos, and practitioner notes
• Communication data: messages exchanged between Controller and their clients through the platform
• Usage data: food diary entries, meal plan data, recipe interactions
• Payment data: subscription and billing information (processed by Stripe; card details are not stored by Foodzilla)

3.4 Duration of Processing

Personal Data is processed for the duration of the Controller's use of the Service. Following cancellation or deactivation of your account, Foodzilla retains your data so that you may reactivate your account and resume service without loss of information. We do not automatically delete data upon cancellation. You may request permanent deletion of your data at any time by contacting us, and we will action this promptly across our live systems, with residual backup copies removed within our three month backup cycle.

While an account is inactive, Personal Data is not processed for any purpose other than storage, unless required by law or to resolve disputes. Where retention is required by law, those records are retained for the period the law requires — transaction and billing records, for example, may be retained for up to 7 years to meet tax and accounting obligations.

4. Processor Obligations

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law. In such cases, the Processor will inform the Controller of the legal requirement before processing, unless prohibited by law.
• Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Section 5.
• Assist the Controller in fulfilling its obligation to respond to Data Subject requests to exercise their rights under applicable data protection laws.
• Assist the Controller in ensuring compliance with breach notification obligations, taking into account the nature of processing and the information available to the Processor.
• At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of the Service, and delete existing copies unless applicable law requires storage of the Personal Data.
• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA.

5. Security Measures

The Processor implements and maintains the following technical and organisational security measures:

• Encryption in transit: All data transmitted between users and the Service is encrypted using TLS/SSL. Real-time connections use encrypted WebSocket (WSS) protocols.
• Encryption at rest: Personal Data stored in databases is encrypted at rest using industry-standard encryption.
• Access controls: Access to Personal Data is restricted to authorised personnel on a need-to-know basis. Administrative access requires multi-factor authentication.
• Infrastructure security: The Service is hosted on secure infrastructure with DDoS protection, web application firewalls, and automated threat detection provided by Cloudflare and our hosting providers.
• Data backups: Foodzilla maintains encrypted backups for disaster recovery purposes. Backups are retained for up to three months, after which they are permanently and automatically deleted. When you request deletion of your data, it is removed from our live systems promptly, and any copies persisting in backups are erased within this three month window.
• Payment security: All payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor. Card details are never stored on Foodzilla servers.
• Regular review: Security measures are reviewed and updated regularly to address emerging threats and vulnerabilities.

6. Sub-processors

The Controller provides general authorisation for the Processor to engage Sub-processors. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors, giving the Controller the opportunity to object to such changes.

Primary hosting location: Personal Data processed under this DPA is stored in a MongoDB Atlas database cluster located in the Asia Pacific (Singapore) region. Singapore is therefore the primary location of processing, and Personal Data is encrypted in transit and at rest there and in all backups.

The following Sub-processors are currently engaged:

The Processor ensures that Sub-processors are bound by data protection obligations no less protective than those set out in this DPA. The Processor remains fully liable for the acts and omissions of its Sub-processors.

7. International Data Transfers

Personal Data is primarily stored and processed in Singapore, as set out in Section 6. Personal Data may also be transferred to and processed in other countries outside the Controller's country of residence, including New Zealand, the United States, the European Union, and Australia, where our Sub-processors are located.

7.1 Transfers from the United Kingdom and the European Economic Area

Singapore is not covered by UK adequacy regulations or an EU adequacy decision. Where Personal Data is transferred out of the United Kingdom or the European Economic Area, including to the primary hosting location in Singapore, the Processor ensures that appropriate safeguards are in place:

• UK transfers: the Standard Contractual Clauses (SCCs) approved by the European Commission, together with the International Data Transfer Addendum (the "UK Addendum") issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018. Where a Sub-processor offers it in place of the SCCs, the Processor instead enters into the UK International Data Transfer Agreement (IDTA). On request, the Processor will enter into the UK Addendum or the IDTA directly with the Controller in respect of the Service.
• EEA transfers: the Standard Contractual Clauses approved by the European Commission.
• Sub-processor terms: data processing agreements with Sub-processors that include equivalent data protection obligations.
• Adequacy: reliance on UK adequacy regulations or an EU adequacy decision where the destination country has been recognised as providing an adequate level of data protection, including for transfers to New Zealand.
• Transfer risk assessments: where required, the Processor assesses the laws and practices of the destination country before relying on a transfer mechanism, and applies supplementary technical measures such as encryption in transit and at rest.

7.2 Australian Privacy Principle 8 — Cross-Border Disclosure

Where Personal Data about Australian individuals is disclosed to an overseas recipient, including the primary hosting provider in Singapore, the Processor takes reasonable steps — as required by Australian Privacy Principle 8 and section 16C of the Privacy Act 1988 (Cth) — to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information. Those steps include:

• Contractual obligations: binding data protection terms with every overseas Sub-processor requiring standards of protection at least equivalent to those required under the Australian Privacy Principles, limiting use of Personal Data to the services engaged, and prohibiting any secondary use or disclosure.
• Encryption: Personal Data is encrypted in transit using TLS/SSL (and WSS for real-time connections) and encrypted at rest in the hosted database and in all backups.
• Access controls: access to Personal Data is restricted to authorised personnel on a need-to-know basis, administrative access requires multi-factor authentication, and access is logged and reviewed.
• Provider assurance: the Processor favours Sub-processors holding recognised independent security certifications (such as ISO 27001 or SOC 2) and reviews their security and privacy practices regularly.
• Breach cooperation: Sub-processor agreements require prompt notification of any security incident affecting Personal Data, so that the Controller and the Processor can meet their obligations under the Notifiable Data Breaches scheme.

8. Data Breach Notification

In the event of a personal data breach affecting Personal Data processed under this DPA, the Processor shall:

• Notify the Controller without undue delay, and in any event within 72 hours of becoming aware of the breach.
• Provide the Controller with sufficient information to enable the Controller to fulfil its own breach notification obligations under applicable data protection laws, including the nature of the breach, the categories and approximate number of Data Subjects affected, the likely consequences, and the measures taken or proposed to address the breach.
• Cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

9. Data Subject Rights

The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under applicable data protection laws, including the right to:

• Access their Personal Data
• Rectify inaccurate Personal Data
• Erase their Personal Data ("right to be forgotten")
• Restrict processing of their Personal Data
• Data portability
• Object to processing

Where a Data Subject contacts the Processor directly with a request, the Processor shall promptly redirect the request to the Controller, unless the Processor is legally required to respond directly.

10. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

Audits shall be conducted with reasonable prior written notice (at least 30 days), during normal business hours, and in a manner that does not unreasonably disrupt the Processor's operations. The Controller shall bear the costs of any audit unless the audit reveals a material breach of this DPA by the Processor.

11. Term and Termination

This DPA shall remain in effect for the duration of the Controller's use of the Service. Upon termination of the Service, the Processor shall, at the Controller's choice:

• Return all Personal Data to the Controller in a structured, commonly used, and machine-readable format; or
• Delete all Personal Data and existing copies, unless applicable law requires continued storage.

If no instruction is received, Personal Data will be retained in an inactive state following account cancellation or termination, so that the Controller may reactivate the account and resume service without loss of information. Data is not automatically deleted on cancellation and is not used for any purpose while inactive. The Controller may request permanent deletion at any time by contacting the Processor; deletion is actioned promptly across live systems, and residual backup copies are erased within the three month backup cycle described in Section 5.

12. Limitation of Liability

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

13. Governing Law

This DPA is governed by the laws of New Zealand, consistent with the governing law provisions of the Terms of Service. For Controllers located in the European Economic Area or the United Kingdom, this DPA shall also be interpreted in accordance with GDPR requirements.

14. Contact

For any questions or requests relating to this DPA, please contact us at support@foodzilla.io.

Zilla Technologies Ltd.
New Zealand
NZBN 942 904 691 0004