Data

Zoho Projects and the GDPR: AI training, data location and DPA

Premium: Trains on your data in part. EU hosting not documented · DPA on request.

Vendor: Zoho Corporation Private LimitedWorkspace and projectsChecked on How we check

Verdict

Is Zoho Projects GDPR compliant?

Premium

Business

Trains on your data in part

EU hosting not documented · DPA on request

Price: See details

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Zoho Projects train on your data?

Trains on your data by default?

Checked

Trains on your data in part.

Yes, in limited form: the privacy policy lets Zoho use anonymised service data to improve its algorithms and your company data to build models tailored to your company.

Vendor's wording: “(i) Wir nutzen anonymisierte Service-Datensätze, um die Genauigkeit der Algorithmen zu verbessern; und (ii) wir verwenden Ihre Unternehmensdaten dazu, maßgeschneiderte Modelle für Ihr Unternehmen zu entwickeln.”

Source: zoho.comPrivacy policy (German), Automatisierung und künstliche IntelligenzChecked on

Location

Where does Zoho Projects store your data?

Where data is stored by default

Checked

Assigned from the country or region detected when you sign up (by IP address); Zoho can move the account to another data centre. The data centre location is not named on these pages.

Vendor's wording: “Der Standort der Cloud-Anlage, die für Sie als Server dient, hängt von der Zuordnung zwischen Ihrer Region bzw. Ihrem Land”

Source: zoho.comTerms of Service (German), Hosting-StandortChecked on

Contract

Does Zoho Projects sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA on request.

Yes, on request: the organisation administrator emails legal@zohocorp.com to get Zoho's Data Processing Addendum, naming the data centre the account is in.

Vendor's wording: “If you are the organization administrator and would like to sign a DPA with us, please drop an email to legal@zohocorp.com”

Source: zoho.comGDPR page, DPA paragraphChecked on

Processors

Who else handles Zoho Projects data?

EU–US Data Privacy Framework

Checked

Not listed.

No listing found for search term 'Zoho'

Source: dataprivacyframework.govSearch 'Zoho' returned 'Query returned no results'Checked on

Retention

How long does Zoho Projects keep your data?

How long data is kept

Checked

Kept while the account is active. After cancellation, data is deleted from the live database at the next purge (run every 6 months) and from backups 3 months later. The customer can ask for export or deletion at any time.

Vendor's wording: “Sobald Sie Ihr Zoho-Benutzerkonto kündigen, werden Ihre Daten bei der nächsten Bereinigung, die alle 6 Monate durchgeführt wird, aus der aktiven Datenbank gelöscht.”

Source: zoho.comPrivacy policy (German), Aufbewahrung von InformationenChecked on

Security

Which certifications and admin controls does Zoho Projects have?

Security certifications

Checked

Company-wide page lists 9 headline certifications: ISO/IEC 27001, 27701, 27017, 27018, ISO 9001, ISO/IEC 20000-1, ISO 22301, SOC 1 Type 2 and SOC 2 Type 2, plus regional schemes (ENS, HDS, Cyber Essentials Plus and others).

Vendor's wording: “Zoho is SOC 2 Type 2 compliant.”

Source: zoho.comCompliance at Zoho, CertificationsChecked on

Admin controls for AI

Vendor says

Partly: Zoho's Projects AI page says all AI functions are turned off by default and you choose when to use them. A named admin setting to switch AI on or off for the organisation is not described.

Vendor's wording: “All AI functions are turned off by default.”

Source: zoho.comZoho Projects AI page, FAQ: How does Zoho ensure the security of my data?Checked on

The vendor doesn't say: switch-off, EU hosting, sub-processors, price.

Alternatives

Zoho Projects alternatives that don't train on your data

Other workspace and projects tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Google Chat

    Google Workspace Business Standard · €13.60 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Miro

    Business · €20 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • monday.com

    Pro · €19 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Teamwork.com

    Basics · $9.99 / user / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • Wrike

    Business · $25 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices