Effective 14 July 2026
This Data Processing Addendum (“DPA”) forms part of our Terms of Service and applies where HOOK VENTURES LTD processes personal data on behalf of a customer — for example, a Team or business customer (the “Customer”) whose members use the service. Where we determine the purposes and means of processing, we act as controller and our Privacy Policy applies instead.
In respect of personal data that the Customer makes available through the service (for example, the account details of the Customer’s team members), the Customer is the controller and HOOK VENTURES LTD is the processor. We will process such personal data only on the Customer’s documented instructions — which include the Terms of Service, this DPA and use of the service’s features — and as required by law.
The subject-matter is the provision of the zantau service; the nature and purpose is hosting, authenticating and administering Customer accounts and team membership; the types of personal data are contact and account details (such as name and email) and usage data; the categories of data subject are the Customer’s authorised users; and processing continues for the duration of the Customer’s use of the service.
We ensure that people authorised to process the personal data are under an appropriate duty of confidentiality, and we implement appropriate technical and organisational measures to protect it, taking into account the state of the art and the risks involved. Our providers maintain industry-standard security controls.
The Customer authorises us to engage the sub-processors we use to provide the service — currently Supabase (database, authentication and storage), Vercel (hosting), Stripe (payments), Resend (email) and PostHog (analytics). We impose data-protection obligations on each sub-processor consistent with this DPA and remain responsible for their performance. We will give reasonable notice of any intended change of sub-processor so the Customer can object on reasonable data-protection grounds.
Where personal data is transferred outside the UK or EEA, we rely on an appropriate transfer mechanism, such as the UK International Data Transfer Agreement, the addendum to the EU Standard Contractual Clauses, or an adequacy decision.
Taking into account the nature of the processing, we will provide reasonable assistance to the Customer in responding to data-subject requests and in meeting its security, breach-notification and impact-assessment obligations, and we will notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer’s data. We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits, subject to reasonable confidentiality and security safeguards.
On termination of the service, or on the Customer’s request, we will delete or return the Customer’s personal data (and delete existing copies) except to the extent we are required by law to retain it.
zantau is a trading name of HOOK VENTURES LTD, a company registered in England and Wales (company number 16969873), whose registered office is at 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom. If your organisation requires a signed or negotiated data processing agreement, contact privacy@zantau.com and we will be happy to arrange one.
zantau is a trading name of HOOK VENTURES LTD, a company registered in England and Wales (company number 16969873), whose registered office is at 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom.
Terms of service · Privacy policy · Cookie policy · Acceptable use · Content & takedown · Data processing addendum