Zendesk

Privacy Notice Overview

Effective date: 28 January 2026

Important scope limitation: This Notice applies only when Zendesk acts as a Controller—deciding why and how data is processed. When Zendesk processes data submitted by a Zendesk customer (“Subscriber”) through its products, Zendesk generally acts as a Processor. In that situation, the Subscriber’s privacy practices and instructions govern, and questions should be directed to the Subscriber.

1. Data Collection and Use

Zendesk may collect:

• Identifiers: Name, email, postal address, phone number, IP address, advertising and device identifiers.
• Commercial and transaction data: Purchase history, preferences, banking and payment information.
• Online activity and device data: Browsing/search history, interactions with Zendesk websites, products, emails, and other digital properties.
• Location data: Approximate location from IP address, mobile device settings, or information provided by you.
• Audio and visual information: Office CCTV, sales or advocacy call recordings, support chats, and messaging logs.
• Inferences: Predictions about your interests or marketing preferences.
• Sensitive data: Potentially vaccination information, race, ethnicity, or health information, where legally permitted and usually voluntarily provided.

Data may come from you, public sources, or third parties, and Zendesk may combine information from these sources.

Uses include:

• Providing, maintaining, improving, and securing Services;
• Processing transactions, payments, support requests, and communications;
• Internal reporting, accounting, audits, research, development, and business operations;
• Fraud prevention, legal compliance, safety, and defending legal claims;
• Marketing Zendesk’s or business partners’ products, including targeted or contextual advertising;
• Events, contests, surveys, referrals, testimonials, and diversity initiatives;
• Corporate transactions such as mergers, acquisitions, reorganisations, or bankruptcy.

Zendesk relies on contractual necessity, legitimate interests, legal obligations, public interest, and consent, depending on the activity.

2. User Rights

Rights vary by location and may be subject to legal exceptions.

Generally, users may request to:

• Access, correct, update, or delete personal data.

California residents may additionally have rights to:

• Know categories and specific pieces of data collected;
• Delete or correct data;
• Opt out of the “sale” or “sharing” of data for targeted advertising;
• Avoid discrimination for exercising privacy rights.

The California opt-out process may require both submitting Zendesk’s webform and disabling advertising cookies on each browser and device. Requests may require identity verification. Zendesk states that opt-out requests are generally processed within 15 business days, while access and deletion requests may take 45–90 days.

EEA, UK, and Swiss users may also have rights to:

• Data portability;
• Object to or restrict processing;
• Withdraw consent;
• Lodge a complaint with a supervisory authority;
• Avoid certain automated decision-making.

3. Third-Party Sharing

Zendesk may disclose data to:

• Zendesk affiliates and subsidiaries;
• Service providers supporting hosting, security, databases, storage, platforms, and data transmission;
• Payment processors and other transaction providers;
• Joint marketing or sales partners and channel partners;
• Advertising and analytics providers using cookies and tracking technologies;
• Professional advisers;
• Event sponsors or other parties you direct it to;
• Authorities responding to lawful government or law-enforcement requests;
• Parties involved in a corporate transaction.

Zendesk may also use or share de-identified, anonymised, or aggregated data for any legally permitted purpose.

International transfers may occur, including to countries without equivalent privacy protections. Zendesk relies on mechanisms such as Standard Contractual Clauses, Binding Corporate Rules, adequacy decisions, and Data Privacy Framework certifications.

4. AI/ML Training

The Notice does not expressly state that personal data is used to train artificial-intelligence or machine-learning models.

However, it permits:

• Research and development of new products and services;
• Improvement of Services and Digital Properties;
• Use of recordings for “quality assurance or training purposes.”

“Training” appears to refer to personnel or service quality, but the Notice does not clearly exclude AI training. Users seeking certainty should obtain clarification from Zendesk, particularly regarding support chats, call recordings, surveys, and customer-provided content.

5. Key User Obligations and Restrictions

• Do not provide another person’s data through Zendesk’s referral service unless you have their consent.
• Marketing opt-outs are available, but operational, security, or transactional communications may still be sent.
• Cookie controls must be managed through Zendesk’s Cookie Notice; Zendesk currently does not honour ordinary browser Do Not Track signals.
• Users under 16 are not the intended audience.
• External websites linked through Zendesk are governed by their own privacy notices.
• Non-English translations are for convenience; the English version controls.

6. Liability and Disputes

The Notice contains limited liability language and does not provide a broad damages cap or detailed dispute-resolution clause.

Zendesk states it is not responsible for Subscribers’ privacy or security practices when acting as their Processor. Complaints may be submitted to Zendesk’s Privacy Team/DPO. Certain unresolved Data Privacy Framework complaints may be referred to TRUSTe at no cost, and binding arbitration may be available in limited circumstances. Other contractual disputes may be governed by Zendesk’s separate customer agreements.

7. Changes

Zendesk may update the Notice periodically. Users should check the Notice regularly. Where legally required, Zendesk will notify users by posting an update on its website or through another appropriate method. If users disagree with changes, the stated remedy is to stop interacting with Zendesk.