Zonda

Privacy Policy

Zonda works with legal information and professional work product, among the most sensitive material an organization handles. This Policy explains what we do with it, in concrete terms.

Last updated: September 15, 2026

1. Purpose and scope

This Privacy Policy explains how Zonda handles personal data connected with access to and use of its legal artificial intelligence platform, its websites, and the associated services (together, the “Services”).

Zonda is intended for professionals, legal teams, organizations, and institutions. This Policy applies without prejudice to the mandatory data protection rules that apply depending on the country where the data subject is located or from which the Services are provided.

2. Who is responsible for processing

In this Policy, “Zonda”, “we”, and “our” mean the provider of the Services.

When an organization contracts Zonda so that its members can use the Services, that organization decides what information is added, who may access it, and for what purposes it is used. In those cases Zonda processes the content and the personal data within it on the organization's behalf and in accordance with its instructions, the applicable agreements, and the law in force.

If you use Zonda individually, Zonda may act as controller of the data needed to administer your account and provide the Services.

3. Personal data we process

Depending on how you use the Services, we may process the following categories of personal data:

• Identification and account data, such as name, work email address, organization, role, credentials, and access permissions.
• Content provided by the user or their organization, including queries, conversations, documents, files, instructions, comments, and work product generated or edited through Zonda.
• Support and communications data, such as queries, requests, incident records, and communications with our team.
• Technical and security data, such as IP address, device and browser type, date and time of access, activity logs, authentication events, errors, and signals needed to prevent abuse or incidents.
• Contractual, administrative, or billing data needed to manage the client relationship, where applicable.

Content added to Zonda may include third parties' personal data. The user or organization adding it is responsible for having a sufficient legal basis and for meeting its own obligations in respect of that data.

4. Purposes of processing

We process personal data only for specified purposes connected with operating the Services, among them:

• Creating and administering accounts, authenticating users, and managing permissions.
• Providing the requested features, processing instructions, and enabling the creation, review, retention of, and collaboration on work product.
• Providing support, handling requests, and resolving incidents.
• Protecting the security, integrity, availability, and legitimate use of the Services.
• Administering the contractual, commercial, and billing relationship with clients and organizations.
• Assessing and improving how the product works, using aggregated or de-identified information where possible.
• Meeting legal obligations and responding to valid requests from competent authorities.

Zonda does not sell personal data and does not use user content for targeted advertising.

5. Ownership, artificial intelligence, and confidentiality of content

Zonda retains all right, title, and interest in the Platform: its code, its interfaces, the work of structuring the legal corpora, and the configuration, instructions, and orchestration that make the assistant work. Use of the Services transfers none of those rights.

The Client retains full ownership of the content it provides and of the results the assistant generates for it, and may use them for its professional purposes without restriction on our part.

We do not train models on your content. The models Zonda runs on are our own and pre-trained, and they execute in private environments under our control: they are not adjusted, retrained, or fine-tuned on clients' documents, queries, or files. You grant us only the technical license needed to process that content and provide you the service; that license does not extend to model training or to any other use.

Processing is transitory and isolated, and takes place within Zonda's own private infrastructure. The query and the necessary context are processed in that environment to produce the answer, and are not retained for any purpose other than providing you the service.

Each organization operates in a separate environment. The data and files provided are accessible only to whoever uploaded them and to the people their organization has authorized: they are not mixed with other organizations', not shared with other clients or users, and not published.

Zonda staff access to content is not routine. It may occur on a limited basis where necessary to handle a support request, investigate a security incident, maintain the operation of the service, or comply with a legal obligation. Such access is subject to internal controls and confidentiality duties.

6. Legal bases for processing

Depending on applicable law and the nature of the relationship, processing may rest on the performance of a contract or pre-contractual steps, compliance with legal obligations, the legitimate interest in operating and protecting the Services, the data subject's consent where required, or the other legal bases recognized by the applicable rules.

Where Zonda acts on an organization's behalf, it is for that organization to determine and document the legal basis applicable to the processing of the content it adds to the Services.

7. Infrastructure and disclosure to third parties

Zonda runs on its own private infrastructure. Client content is processed and stored within that environment: it is not handed to third parties for their own use, not sold, and not shared with other clients or users.

The infrastructure providers underpinning that environment act as processors and are bound by contractual confidentiality and security obligations; they do not access the content for their own purposes. If we bring in any other provider strictly necessary to operate the service, it will be subject to the same obligations and to processing limited to our instructions.

We may also disclose information where necessary to comply with a legal obligation, respond to a valid request from a competent authority, protect rights, or investigate unlawful conduct, always within the limits the law permits.

8. International transfers

Providing the Services may require certain providers to process data from other countries. Where there is an international transfer of personal data, Zonda will adopt the measures and safeguards required by applicable law, taking into account the nature of the information and the destination country.

9. Retention and deletion

We keep personal data for as long as necessary to provide the Services, maintain the relationship with the user or their organization, follow the client's valid instructions, and meet legal, contractual, security, or rights-defense obligations.

When data is no longer necessary, it will be deleted, anonymized, or blocked, as appropriate. Final deletion from backups may complete according to controlled technical cycles, during which those copies are not used for ordinary purposes.

10. Information security

Zonda adopts reasonable and proportionate technical and organizational measures to protect personal data and content against loss, alteration, unauthorized access, disclosure, or destruction. These measures include access controls, separation between organizations, protection of communications, permission management, logging of relevant events, and internal security procedures.

No system can guarantee absolute security. We therefore review and adjust our measures in light of the risks, technological developments, and the characteristics of the Services.

11. Incident handling

If Zonda becomes aware of a security incident compromising personal data, it will take steps to contain it, investigate it, and mitigate its effects. It will also make the notifications to clients, data subjects, or authorities required under applicable law and the agreements in force.

12. Data subject rights

Depending on applicable law, you may request access to your personal data, its rectification, updating, deletion, or blocking; object to certain processing; request portability; withdraw a consent previously given, where applicable; and exercise any other right recognized by the rules in force.

If you use Zonda through an organization and your request concerns content controlled by it, you should raise it with that organization first. Zonda will cooperate with its clients to handle the requests that apply.

You may also write to us at contacto@newzonda.com. We may request reasonable information to verify your identity and prevent unauthorized access or changes.

13. Cookies and similar technologies

The Services use cookies or equivalent technologies necessary to authenticate users, maintain sessions, protect security, and enable essential features. The public site measures usage in aggregate to understand which sections are useful.

This page and the Support and Terms of Use pages load no measurement at all: a privacy policy should not itself be a tracking surface. If non-essential technologies are introduced, Zonda will provide the information and the consent or configuration options that applicable law requires.

14. Minors

The Services are intended for professionals and organizations and are not offered to minors. Zonda does not knowingly seek to collect minors' personal data for the creation of individual accounts.

15. Changes to this Policy

We may update this Policy to reflect legal, operational, or technological changes. The version in force will state its update date. Where a change is substantial, we will communicate it by reasonable means before it takes effect, where that is required.

16. Contact

For questions or requests about privacy and personal data protection, you may write to contacto@newzonda.com. For questions about the service generally, the Support page points to the most direct route.