Third-Party Product Data Sharing

What it is

When a customer enables Third-Party Products through the Zendesk platform, the agreement authorizes Zendesk to share Customer Account information and Service Data with those third-party providers, and the customer waives claims against Zendesk related to those products.

Why it matters (compliance & governance perspective)

This provision authorizes Service Data sharing with third-party providers as a consequence of enabling integrations, without requiring a separate disclosure or consent step at the time of each integration. The scope of data shared is defined broadly as Customer Account information and Service Data, which encompasses all data submitted by customers, agents, and end users.

Consumer impact (what this means for users)

Under this clause, enabling any Third-Party Product integration on the Zendesk platform authorizes Zendesk to share Service Data, including all data submitted by agents and end users, with the relevant third-party provider. The agreement states that customers waive claims against Zendesk arising from Third-Party Products.

Institutional analysis (regulatory & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR requirements for lawful basis and adequate safeguards when transferring personal data to third parties, as well as CCPA disclosure requirements for sharing personal information with third parties. Where third-party providers are located outside the EU/EEA, data transfer mechanisms such as Standard Contractual Clauses may be required. Enforcement authorities include EU/EEA national data protection authorities, the California Privacy Protection Agency, and the FTC. (2) GOVERNANCE EXPOSURE: High. The authorization to share Service Data with third-party providers upon integration enablement may operate as a blanket data sharing permission rather than a granular, integration-specific disclosure. Organizations processing personal data of EU/EEA data subjects must assess whether this mechanism satisfies GDPR requirements for disclosure of sub-processors or third-party recipients. (3) JURISDICTION FLAGS: EU/EEA customers face heightened exposure under GDPR Articles governing data sharing with third parties and requirements to disclose recipients of personal data to data subjects. California customers should assess whether this sharing triggers CCPA disclosure or opt-out obligations. Customers in regulated industries such as financial services or healthcare should evaluate whether Service Data shared with third-party providers includes regulated information. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should maintain an inventory of all enabled Third-Party Products and confirm that each provider has appropriate data processing agreements in place. The waiver of claims against Zendesk for Third-Party Product issues shifts liability for third-party data handling to the customer, which may affect vendor risk assessments and cyber insurance coverage determinations. (5) COMPLIANCE CONSIDERATIONS: Organizations should audit their Zendesk integrations to identify all enabled Third-Party Products and assess the data sharing implications for each. Privacy notices provided to end users and agents should disclose that their data may be shared with third-party integration providers. Where Third-Party Product providers are outside the EU/EEA, data transfer impact assessments may be required under GDPR.

Applicable agencies

Provision details

Other risks in this policy

• Aggregate liability capped at 12 months of fees paid high
• All implied warranties expressly disclaimed high
• Automatic renewal with Zendesk able to apply current rates high
• Charges non-cancelable and non-refundable high
• Consequential damages excluded for both parties high
• Customer indemnifies Zendesk for service data claims high