Zendesk collects sensitive personal data such as proof of vaccination and race and ethnicity on an optional basis where permitted by law, and may disclose this data to Zendesk Group affiliates, service providers, and entities involved in corporate transactions.
This analysis describes what Zendesk's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses the collection and disclosure of special category data under GDPR terminology, including health-related data and racial or ethnic origin, which are subject to heightened protection requirements under GDPR Article 9 and equivalent national laws. The document states collection is optional and consent-based where required, but the disclosure scope includes corporate transaction parties.
Interpretive note: The adequacy of the consent mechanism for sensitive personal data under GDPR Article 9 depends on implementation details not fully described in the notice, including how consent is obtained, recorded, and withdrawn in practice.
Under this clause, individuals who optionally provide sensitive personal data such as vaccination status or race and ethnicity consent to its disclosure to Zendesk Group entities, service providers, and corporate transaction parties. The agreement states this data is not used to infer characteristics under California's sensitive personal information framework.
Cross-platform context
See how other platforms handle Sensitive Personal Data Collection and similar clauses.
Compare across platforms →"Sensitive Personal Data, such as proof of vaccination or race and ethnicity (optional) (where permissible under applicable law). Affiliates and subsidiaries within the Zendesk Group, which includes parent and ultimate holding companies, affiliates, subsidiaries, business units, and other companies that we acquire in the future after they are made part of the Zendesk Group; Service providers, such as platform vendors; Entities involved in a corporate transaction, including if we sell, acquire, or merge all or some of our assets; To which you have consented to the disclosure. We do not collect or process 'sensitive personal information,' as defined by California law, to infer characteristics about you. Zendesk only uses sensitive personal information consistent with the exceptions to the right to limit sensitive personal information.Excerpt from Zendesk's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision discloses the collection and disclosure of special category data under GDPR terminology, including health-related data and racial or ethnic origin, which are subject to heightened protection requirements under GDPR Article 9 and equivalent national laws. The document states collection is optional and consent-based where required, but the disclosure scope includes corporate transaction parties.
Under this clause, individuals who optionally provide sensitive personal data such as vaccination status or race and ethnicity consent to its disclosure to Zendesk Group entities, service providers, and corporate transaction parties. The agreement states this data is not used to infer characteristics under California's sensitive personal information framework.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zendesk.