Data Processing Addendum
Effective 16 August 2026 · Last updated 12 November 2026
Processor terms for customer traffic and configuration data.
1. Roles
You are the controller (or a processor for your own customers). Spatial Regal Digital Ltd is the processor for Service Data that transits or is stored to provide Zipper.
2. Instructions
We process Service Data only to provide, secure, and support the Service, and as documented in the Privacy Policy. We will not use Service Data for advertising.
3. Security
We implement encryption in transit (TLS 1.2+), encryption at rest for control-plane databases, least-privilege access, and workspace isolation via row-level security. Portcullis secrets are stored hashed. See /legal/security.
4. Subprocessors
Current subprocessors are listed at /legal/subprocessors. We will post updates there at least 14 days before a new subprocessor processes Service Data.
5. Assistance and deletion
We will assist with data-subject requests that you cannot fulfill from the dashboard. On termination we delete or return Service Data within 30 days unless law requires longer retention.
6. Personal data breaches
We notify you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting your Service Data, with the detail you need to meet your own notification duties. That supports Article 33(2) of the GDPR where it applies to you, and the breach-notification guidance of Ghana's Data Protection Commission under Act 843.