AI Addendum to the DPA
AI Addendum to the Data Processing Addendum
EXTERNAL --- CLEARED FOR CLIENT DISTRIBUTION
Contractual Terms Governing Artificial Intelligence Features Within the ZINFI Unified Partner Management (UPM) Platform
Prepared by ZINFI Technologies, Inc.
Created September 18, 2026
Executive Summary
This AI Addendum supplements and forms part of the ZINFI Data Processing Addendum ("DPA") between ZINFI Technologies, Inc. and the Customer identified in the applicable Subscription Order Form. It states the binding contractual commitments governing AI Features within the ZINFI Unified Partner Management (UPM) platform. Where the ZINFI AI and Partner Data Usage Policy states a practice, this Addendum makes the corresponding commitment enforceable as a term of the Agreement.
- No Customer Data is used to train, fine-tune, or otherwise improve any AI Model, ZINFI's own or any third party's, under any circumstance --- this prohibition is not waivable by consent.
- Every third-party AI Model Provider operates under a contractual zero-retention, no-training commitment covering Customer Data submitted for processing.
- AI-generated content is labeled as such by default and cannot be configured to suppress that labeling.
- A human reviewer approves every AI output with external impact --- partner communications, performance evaluations, and incentive recommendations --- before delivery.
- Customers may disable AI Features at the deployment level or the individual-partner level at any time, with no effect on non-AI functionality.
- A material change to an approved AI Model --- a change of provider, a new data category, or a change in autonomy level --- requires Customer-facing notice before it takes effect.
1. Incorporation and Precedence
1.1 Relationship to the DPA
This Addendum is incorporated into and forms part of the DPA between ZINFI and the Customer, which is itself incorporated into the ZINFI Terms and Conditions. Capitalized terms not defined in this Addendum have the meaning given to them in the DPA. Where this Addendum conflicts with the DPA on a matter specifically addressed here, this Addendum controls; on every other matter, the DPA controls.
1.2 Definitions
- AI Feature --- any capability within the UPM platform that uses an AI Model to generate content, produce a recommendation, or perform automated scoring.
- AI Model --- any machine learning model, large language model, or automated scoring or recommendation system used within the platform, whether developed by ZINFI or provided by a third party.
- AI Model Provider --- a third-party sub-processor that provides an AI Model or AI-processing service to ZINFI.
- Customer Data --- Personal Data and Partner Data, as those terms are defined in the DPA, processed within the Customer's Deployment.
- Deployment --- the logically isolated instance of the platform provisioned for the Customer.
- Training --- using data to train, fine-tune, update, evaluate for the purpose of updating, or otherwise improve the parameters or behavior of an AI Model.
2. The Training Prohibition
2.1 No Training on Customer Data
ZINFI shall not, and shall not permit any AI Model Provider to, use Customer Data for Training of any AI Model, whether ZINFI's own or a third party's, and whether the AI Model is used within the Customer's Deployment or any other deployment.
2.2 No Cross-Customer Aggregation
ZINFI shall not aggregate, combine, or compare Customer Data with data from any other customer's deployment for benchmarking, feature development, platform analytics, or any other purpose, without the Customer's prior written consent obtained specifically for that purpose. This Section 2.2 governs aggregation and analytics use; it does not permit Training under any circumstance, including with consent, which is addressed exclusively by Section 2.3.
2.3 Non-Waivable
The prohibition in Section 2.1 applies regardless of whether Customer Data is anonymized, pseudonymized, aggregated, or in its original form, and cannot be waived by Customer consent, by a future amendment executed under ordinary contract-amendment authority, or by any other mechanism. A change to this prohibition requires an express, separately negotiated written amendment to this Addendum identified as such.
2.4 Third-Party AI Model Providers
Where ZINFI integrates a third-party AI Model Provider into the platform, ZINFI shall require that provider, by contract, to (a) operate under a zero-retention commitment for Customer Data submitted through ZINFI's API connections, meaning the provider does not retain that data beyond the duration necessary to return the processing result, and (b) not use that data for Training of any kind. ZINFI shall list its current AI Model Providers in the ZINFI List of Sub-Processors, consistent with the DPA's sub-processor disclosure obligations.
3. Data Isolation for AI Processing
3.1 Deployment Scoping
AI Feature processing is scoped exclusively to the Customer's own Deployment. No Customer Data is referenced, surfaced, or weighted in an AI output delivered to any other customer, and no other customer's data is referenced, surfaced, or weighted in an AI output delivered to the Customer.
3.2 Technical Enforcement
This isolation is enforced through logically isolated data partitioning per customer, customer-scoped authentication on every API endpoint processing AI requests, and architectural prevention of cross-customer queries at the platform's data access layer, consistent with the technical and organizational measures described in the DPA.
4. Model Governance
4.1 Model Approval
No AI Model is deployed to production within the platform without completing ZINFI's internal model review process, evaluating accuracy, bias risk, data handling, and contractual safeguards applicable to the model. ZINFI maintains a model governance registry recording each approved AI Model, its authorized use cases, and the data categories it is permitted to process.
4.2 Material Model Changes
The following constitute a material change requiring re-approval before deployment and notice to the Customer under Section 6:
- A change in the underlying AI Model or AI Model Provider for an existing AI Feature.
- A new category of Customer Data granted to an existing AI Model.
- A change in the autonomy level of an AI Feature --- for example, a feature moving from producing a recommendation for human review to taking an automated action.
4.3 Access Controls
Access to AI Features is governed by role-based access control within the Customer's Deployment. AI Features that surface Customer Data, generate recommendations, or produce content are accessible only to users holding the appropriate role permissions. AI capabilities processing behavioral analytics or predictive scoring are restricted to designated internal roles and are not accessible to partner users by default.
5. Output Labeling and Human Review
5.1 Mandatory Labeling
Content, a recommendation, or an analysis generated by an AI Feature is labeled as AI-generated at the point of presentation, across every surface on which it appears, including partner portal content, internal dashboards, email drafts, and analytics outputs. The Customer's administrator may configure the placement and styling of this label. The labeling requirement itself cannot be disabled by configuration, by the Customer, or by ZINFI.
5.2 Human-in-the-Loop
No AI Feature output with external impact --- including a partner communication, a performance evaluation, or an incentive recommendation --- is delivered or acted upon without a human reviewer designated by the Customer approving that specific output. No such output is delivered automatically without a configured approval workflow.
5.3 Automated Decision-Making
ZINFI does not make, and no AI Feature is configured to make, a decision producing legal or similarly significant effects concerning an individual without human review, consistent with the human-in-the-loop requirement in Section 5.2 and applicable automated-decision-making provisions of GDPR Article 22 and comparable law.
6. Incident, Drift, and Model Change Notification
Where ZINFI confirms that an AI Model is producing materially inaccurate, biased, or non-compliant output, or is otherwise malfunctioning in a manner affecting the Customer, ZINFI shall: suspend or restrict the affected AI Feature within the Customer's Deployment pending review; notify the Customer within five (5) business days of confirming the issue; and provide a remediation summary once resolved.
Where ZINFI intends to make a material model change under Section 4.2, ZINFI shall notify the Customer before the change takes effect for the Customer's Deployment. Where advance notice is not practicable because the change addresses an active security or compliance issue, ZINFI shall notify the Customer as soon as reasonably practicable after the change.
An incident under this Section 6 involving unauthorized access to or disclosure of Customer Data is additionally subject to the breach notification commitments in the ZINFI Incident Response and Breach Notification document and the DPA.
7. Customer Controls
7.1 Feature-Level Opt-Out
The Customer may disable an individual AI Feature for its Deployment at any time through its administrator console, without effect on non-AI functionality. The Customer may additionally exclude an individual partner from AI-powered scoring, predictive analytics, or AI-generated communication workflows at the Customer administrator's discretion. Opt-out configurations take effect immediately and persist across sessions.
7.2 Effect on Deletion Requests
Upon a verified deletion request under the DPA, the affected Personal Data is excluded from all subsequent AI processing, in addition to the removal and backup-purge commitments stated in the DPA.
8. Regulatory Alignment
The commitments in this Addendum are designed to support the Customer's compliance with applicable law governing automated processing and artificial intelligence, including GDPR Article 22 and the transparency obligations of the EU Artificial Intelligence Act applicable to ZINFI as a provider or deployer, as the case may be, and the California Consumer Privacy Act. This Addendum does not itself constitute legal advice or a compliance certification, and the Customer remains responsible for its own regulatory obligations as a controller of Customer Data.
9. General
9.1 Term
This Addendum remains in effect for as long as the DPA remains in effect and terminates automatically upon termination of the DPA.
9.2 Changes to This Addendum
ZINFI reviews this Addendum at least annually. Where a change would narrow a commitment in Sections 2, 5, 6, or 7, ZINFI will provide at least sixty (60) days' written notice and the change will not take effect for an existing Customer until the start of that Customer's next renewal term. Every version carries a version number and an effective date; prior versions are retained and available on request.
Document version: This is Version 1.0 of the ZINFI AI Addendum to the Data Processing Addendum, effective September 18, 2026. It gives contractual effect to commitments described in the ZINFI AI and Partner Data Usage Policy. Owner: ZINFI Technologies Information Security and Privacy Office, with Legal. Next scheduled review: September 2027.
Closing Summary
This Addendum makes six commitments enforceable as contract terms rather than policy statements: an absolute, non-waivable prohibition on training any AI Model with Customer Data; contractual zero-retention terms with every third-party AI Model Provider; deployment-scoped data isolation for all AI processing; mandatory output labeling that cannot be disabled; human review before any externally-impactful AI output is delivered; and Customer-level control to disable AI Features at any time.
- Confirm this Addendum is referenced in your executed DPA or request that it be added via amendment.
- Review the model governance provisions in Section 4 with your security team ahead of enabling new AI Features.
- Identify which AI Features in your Deployment require a configured human-review workflow under Section 5.2.
- Confirm your designated notice contacts are current, since Section 6 notifications are delivered to the addresses on your Subscription Order Form.
- Contact ZINFI through the Trust Center with questions about AI Model Providers, opt-out configuration, or this Addendum's scope.
legal@zinfitech.com | zinfi.com/trust-compliance-center