ZoomInfo

GDPR overview

GDPR compliance is claimed explicitly and backed by concrete evidence. The privacy policy devotes a section to European rights: access, rectification, restriction, portability, erasure and objection. A Data Protection Officer is reachable at privacy@zoominfo.com, and VeraSafe Ireland Ltd. (Cork) acts as the Article 27 representative, contactable by form or on +420 228 881 031. Transfers rely on Standard Contractual Clauses and on certification under the EU-US Data Privacy Framework, its UK extension and the Swiss-US DPF, covering ZoomInfo Technologies LLC and Datanyze LLC. A Data Processing Addendum is published, with clauses governed by Irish law. Unresolved DPF complaints go to JAMS arbitration, with the FTC as supervisory authority and TrustArc/TRUSTe as a prior recourse. Profiled individuals can opt out through the Trust Center, and Global Privacy Control signals are honored automatically.

Who owns the data?

ZoomInfo keeps ownership of everything it supplies. The terms of use state that the Proprietary Materials — the platform, its code, its texts and its content — remain the property of ZoomInfo and its licensors, apart from the limited license granted to you. Content you submit stays yours, but you grant ZoomInfo a worldwide, irrevocable, non-exclusive, royalty-free and sublicensable license to use, reproduce, adapt, publish, translate, display and distribute that User Generated Content in order to operate, promote and improve the platform. Under the privacy policy, ZoomInfo acts as data controller for the B2B profiles, site visitors and its Contributory Network, and as data processor for data entrusted by customers, framed by a published Data Processing Addendum.

Reuse rights

Access does not create a right to reuse. The terms of use forbid copying, republishing, redistributing, decompiling or commercially exploiting the Proprietary Materials without written consent, and the right of access carries no right to download or store them on another medium. Licensed use runs on credits: one credit is consumed each time a contact or company profile is exported to a CSV file, pushed into a CRM or retrieved through an API call. The AI Acceptable Use Policy adds a hard limit — Licensed Materials, including any derivatives, extracts, summaries or transformations, must never be supplied to an External AI System for training, fine-tuning, model development or knowledge base enhancement. The single exception is an AI system developed, owned and operated exclusively by the customer, hosted on its own infrastructure, accessible only to its own staff and never resold to third parties. Any breach must be notified within 24 hours, and these restrictions survive the end of the contract in perpetuity.

Data retention & training

Hosting summary

ZoomInfo hosts and processes data primarily in the United States. Its privacy policy states that personal information may be transferred to, stored and processed in the United States or any other country where ZoomInfo, its affiliates or its subcontractors maintain facilities. The published subprocessor list names Amazon Web Services and Google LLC (both US) as cloud hosts, Wasabi Technologies (US) for storage, and Snowflake and Databricks (US) as data warehouses. A few subprocessors sit elsewhere — Pusher in the United Kingdom, Transloadit in Germany, Adjiva/DeltaX in Singapore — alongside group subsidiaries in Canada, Israel, India, the United Kingdom and Ireland. Transfers out of Europe are covered by Standard Contractual Clauses governed by Irish law, with Irish courts competent, and by certification under the EU-US Data Privacy Framework, its UK extension and the Swiss-US DPF. The terms of use themselves are governed by the law of the State of Washington. Data is encrypted with AES-256 at rest and TLS 1.2 minimum in transit, with MFA and SSO available. No EU data residency option appears on the pages collected.