Zendesk asserts that it acts as a data controller for data collected through its own websites and marketing activities, and as a data processor for Service Data submitted by business customers through the platform. Business customers are stated to be responsible for establishing a legal basis for processing Service Data.
This analysis describes what Zendesk's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the allocation of data protection obligations between Zendesk and its business customers, determining which party bears controller responsibilities under GDPR, UK GDPR, and equivalent frameworks, and directing data subject rights requests accordingly.
Interpretive note: The scope of Zendesk's independent discretion over Service Data in practice may affect whether the processor characterization holds under regulatory scrutiny in specific jurisdictions.
Under this clause, individuals whose personal data is contained in Service Data processed through the Zendesk platform are directed to contact the relevant Zendesk business customer, not Zendesk, to exercise data subject rights including access, deletion, and portability. The agreement states that Zendesk processes Service Data only on behalf of and according to the instructions of its business customers.
How other platforms handle this
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
"Zendesk acts as a data controller when it determines the means and purposes of processing personal data, and as a data processor when it processes personal data on behalf of our customers. When Zendesk customers use our Services, they may submit personal data to Zendesk (referred to as 'Service Data'). In these cases, Zendesk processes such Service Data only on behalf of the customer and in accordance with their instructions. Customers are responsible for ensuring that there is a legal basis for Zendesk to process such Service Data.Excerpt from Zendesk's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 4(7) and 4(8) defining controller and processor, and Article 28 governing processor obligations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the allocation of data protection obligations between Zendesk and its business customers, determining which party bears controller responsibilities under GDPR, UK GDPR, and equivalent frameworks, and directing data subject rights requests accordingly.
Under this clause, individuals whose personal data is contained in Service Data processed through the Zendesk platform are directed to contact the relevant Zendesk business customer, not Zendesk, to exercise data subject rights including access, deletion, and portability. The agreement states that Zendesk processes Service Data only on behalf of and according to the instructions of its business customers.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zendesk.