Data processing agreement
This is the current data processing agreement between the business customer as controller and ZimSystem ApS as processor under GDPR Article 28. The customer expressly accepts the agreement during onboarding, before ZimSystem processes personal data on the customer’s behalf. The accepted version, the customer’s documented instructions and any agreed processing schedules form part of the customer agreement and govern that processing.
Updated · 20 September 2026
1. Parties and priority
The controller is the business identified in the customer agreement and onboarding information. The processor is ZimSystem ApS, company no. 41432462, Skejbytoften 33, 8200 Aarhus N, Denmark. Each party must keep its relevant contact information up to date. Data protection obligations take precedence over conflicting commercial terms. ZimSystem’s processing for its own purposes as controller is governed separately by the privacy policy.
2. Subject matter, purpose and duration
Processing supports the customer’s agreed use of POS, webshop, telephone orders, customer management, delivery, communications, accounting integration and administration. It includes collection, recording, organisation, storage, retrieval, disclosure on instructions and deletion where required for those purposes. Where enabled by the customer, e-conomic integration transfers the information necessary for the agreed accounting and reconciliation functions. Processing lasts for the customer agreement and thereafter only as necessary to return or delete data on the customer’s instructions or comply with a legal storage obligation. Ending the subscription does not itself trigger automatic deletion; the manual termination procedure below applies.
3. Data subjects and data types
Data subjects comprise the customer’s buyers, business contacts, employees and authorised users to the extent their information is entered into the service. Data includes identity and contact details, addresses, account information, orders, delivery details, payment references, communication history and technical logs. The selected functions and the customer’s documented instructions determine the actual processing within this scope. Special-category data or criminal-offence data must not be entered without a separate written agreement and assessment of the required safeguards.
4. Documented instructions
ZimSystem may process information only on the customer’s documented instructions, including transfers to third countries, unless otherwise required by EU or national law. In that case, the customer is informed before processing unless the law prohibits this. Instructions and approved functionality must be documented. ZimSystem must promptly inform the customer if, in its opinion, an instruction infringes data protection law.
5. Confidentiality and security
ZimSystem must ensure that authorised persons are bound by confidentiality and that access is limited to what their tasks require. ZimSystem must implement and maintain technical and organisational measures appropriate to the risks under GDPR Article 32, including access management, incident handling and evaluation of effectiveness, and provide relevant documentation to the customer. Platform data is currently hosted on ZimSystem’s own servers in Denmark and replicated to a physically separate server. Replication can also copy errors and deletions and is not a separate historical backup. These terms do not promise a particular certification, encryption standard, recovery time or historical-backup service unless separately documented and agreed.
6. Subprocessors
ZimSystem may use authorised suppliers only for documented service purposes and under the role and safeguards applicable to that supplier. Current service categories may include hosting and email delivery, e-conomic for enabled accounting functions, S5, MobilePay or Frisbii for selected payment functions, InMobile for SMS, and OpenAI for the optional Admin AI assistant. The AI assistant is technically restricted to a code-owned, tenant-scoped, read-only allowlist that excludes customer and user identity data, and model output storage is disabled in the integration. Personal data must not be entered in AI chat. Use of subprocessors requires the customer’s specific or general written authorisation under GDPR Article 28; under general authorisation the customer must be informed of intended additions or replacements and may object before the change. Relevant data-protection duties must be imposed on each subprocessor. Supplier identity, role, processing location, transfer basis and current notification procedure must be maintained in the applicable supplier information and agreement; a supplier acting as an independent controller is not automatically a subprocessor.
7. Processing locations and transfers
Current platform hosting is in Denmark. Possible future Azure hosting with MySQL is neither an already completed change nor general permission to process in all countries. New processing locations, remote access and any transfers outside the EEA must be assessed and documented before the change, with the customer’s relevant instructions, a lawful transfer mechanism and necessary supplementary measures.
8. Assistance and personal data breaches
Taking account of the processing and available information, ZimSystem must assist the customer with data-subject rights and obligations under Articles 32–36, including impact assessments and any prior consultation. ZimSystem must notify the customer without undue delay after becoming aware of a personal data breach and progressively provide available information about the incident, affected data, likely consequences and measures. The customer decides on notifications to authorities and data subjects under applicable rules. Contact and escalation channels must be specified in the agreement.
9. Documentation and audits
ZimSystem must make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits and inspections by the customer or an authorised auditor. Practical arrangements are agreed with regard to security, confidentiality and other customers’ data without undermining the customer’s statutory audit rights.
10. Termination, return and deletion
On termination, the customer chooses return or deletion of the personal data and communicates its instructions to info@zimsystem.dk. ZimSystem must carry out the instructions without undue delay and delete remaining copies unless law requires continued storage. The parties must document the practical export or deletion steps and any necessary completion period. During that period, processing is restricted to return, deletion and applicable legal storage obligations. There is currently no automatic deletion routine; requests and termination instructions are handled manually, including copies on replicated servers. Any legally required retention must be limited to the relevant data and purposes. Accounting obligations do not justify indefinite retention of all customer data.
11. Acceptance, instructions and precedence
The customer expressly accepts this agreement during onboarding. The customer information, agreed service and documented processing instructions identify the parties and the processing covered by the agreement. ZimSystem must provide the information needed for subprocessor authorisation and make relevant security documentation available; additional or changed processing must follow documented instructions and applicable law. The accepted agreement remains applicable until validly amended or until the processing obligations end. Danish law applies, the Danish text takes precedence if the versions differ, and this agreement prevails over conflicting commercial terms concerning processing on the customer’s behalf. Contact info@zimsystem.dk for instructions, documentation or changes.