Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This notice applies only to data where Zendesk controls the purpose of processing; data processed within Zendesk's products on behalf of business customers (Subscribers) is excluded, and affected individuals are directed to contact those Subscribers directly.
This analysis describes what Zendesk's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision defines the scope of Zendesk's privacy obligations under this notice, excluding data processed on behalf of Subscribers and disclaiming responsibility for Subscriber data practices. Compliance teams engaging Zendesk as a vendor must assess Subscriber obligations separately, including reviewing the Zendesk Data Processing Agreement to understand the allocation of data controller and processor responsibilities.
Under this clause, individuals whose personal data is processed within a Zendesk Subscriber's support or service platform are not covered by this notice and must direct data rights requests to the Subscriber organization. The agreement states Zendesk is not responsible for the privacy or data security practices of its Subscribers.
Cross-platform context
See how other platforms handle Controller vs. Processor Distinction and similar clauses.
Compare across platforms →Monitoring
Zendesk has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"This Notice only applies when Zendesk is the Controller of personal data (example: Zendesk website visitors' personal data and business-to-business contact data). Zendesk is a Processor, not a Controller, of personal data that we process on behalf of our Subscribers when they use Zendesk products and Services. For clarity, this means that this Notice does not apply to where Zendesk processes personal data as a processor in its products and Services. If you have questions related to how a Zendesk Subscriber utilizes your personal data, please contact them directly. We are not responsible for the privacy or data security practices of our Subscribers.Excerpt from Zendesk's Privacy Policy
1. REGULATORY LANDSCAPE: The Controller versus Processor distinction directly implicates GDPR Articles 4, 24, 26, and 28, as well as equivalent provisions under UK GDPR, CCPA, and LGPD. Supervisory authorities including EU data protection authorities and the UK ICO enforce this distinction, and mischaracterization of the Processor role can result in regulatory exposure for both parties. 2. GOVERNANCE EXPOSURE: High. The disclaimer of responsibility for Subscriber data practices creates a gap in data subject rights fulfillment for individuals whose data is processed within Zendesk products. If a Subscriber lacks adequate privacy infrastructure, data subjects may be unable to exercise rights effectively, and regulators may examine whether Zendesk's DPA with Subscribers adequately addresses this. 3. JURISDICTION FLAGS: Heightened exposure in the EU and EEA, where GDPR imposes specific obligations on both controllers and processors and requires documented allocation of responsibilities. UK and Brazilian frameworks impose similar requirements. The adequacy of Subscriber DPAs for GDPR Article 28 compliance is a primary due diligence consideration. 4. CONTRACT AND VENDOR IMPLICATIONS: B2B procurement teams contracting with Zendesk must confirm the applicable DPA covers all data processing activities within the Zendesk products they use, and that Subscriber obligations for data subject rights are operationally implementable. The notice's disclaimer shifts compliance responsibility to Subscribers, which may not be acknowledged in all procurement contracts. 5. COMPLIANCE CONSIDERATIONS: Legal teams should map which data flows are governed by this notice versus the Zendesk Customer Agreement and DPA. For Subscribers, this requires confirming that their own privacy notices and data subject rights procedures account for data processed within Zendesk products. Contract amendments may be warranted to clarify responsibilities where the Controller versus Processor boundary is ambiguous.
This provision defines the scope of Zendesk's privacy obligations under this notice, excluding data processed on behalf of Subscribers and disclaiming responsibility for Subscriber data practices. Compliance teams engaging Zendesk as a vendor must assess Subscriber obligations separately, including reviewing the Zendesk Data Processing Agreement to understand the allocation of data controller and processor responsibilities.
Under this clause, individuals whose personal data is processed within a Zendesk Subscriber's support or service platform are not covered by this notice and must direct data rights requests to the Subscriber organization. The agreement states Zendesk is not responsible for the privacy or data security practices of its Subscribers.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zendesk.