Corporate Transaction Data Sharing

What it is

If Zendesk is acquired, merges with another company, or undergoes a significant corporate transaction, your personal data may be transferred to the new owner as part of that deal.

Why it matters (compliance & governance perspective)

A corporate transaction could result in your personal data being transferred to a new entity with potentially different privacy practices, and this clause permits that transfer even during the negotiation phase before any transaction is complete.

Consumer impact (what this means for users)

Your personal data could be shared with potential acquirers or merged entities during or after a corporate transaction involving Zendesk, potentially before such a deal is finalized, which means a new company may access your data under different privacy standards.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 6 (lawful basis for processing) and Article 13/14 (transparency), as data subjects must be informed of new controllers following a corporate transaction. Under CCPA, personal information transferred in a merger or acquisition may require notification if the new entity's use of data materially differs from the original disclosure. The FTC has historically scrutinized data transfers in acquisitions where new uses deviate from original privacy representations. (2) GOVERNANCE EXPOSURE: Low. This type of clause is standard across enterprise software providers and reflects accepted commercial practice. However, the reference to sharing during 'negotiations' (before a transaction closes) warrants due diligence, as data shared with potential acquirers prior to closing may not be protected by the same contractual framework as operational data sharing. (3) JURISDICTION FLAGS: EU and UK users are protected by GDPR requirements that any new controller following a merger must provide a fresh privacy notice and establish a lawful basis for continued processing. California residents have rights to be informed of material changes in data use following an acquisition under CCPA/CPRA. (4) CONTRACT AND VENDOR IMPLICATIONS: Business customers' DPAs should address what happens to service data in a corporate transaction, including whether the successor entity assumes the DPA obligations and whether customers have termination rights if the acquirer's privacy practices are materially different. Procurement teams should assess change-of-control provisions in their master subscription agreements with Zendesk. (5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that DPAs with Zendesk include change-of-control provisions and successor obligations. Organizations should monitor corporate developments affecting Zendesk (noting its acquisition by Permira and subsequent ownership changes) and evaluate whether any new ownership structures affect their data processing risk profile.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Controller vs. Processor Distinction for Service Data medium
• International Data Transfers (SCCs and Data Privacy Framework) medium
• Third-Party Sharing with Advertising and Analytics Partners medium
• California Resident Rights (CCPA/CPRA) medium
• EU/UK Data Subject Rights (GDPR and UK GDPR) medium
• Data Retention Policy low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.