LeadershipNot yet confirmed elsewhere1 publisher2 min readPublished
ZyMix cut Tencent from its privacy policy after the Guardian approached the company
ZyMix, a UK student super app, has a contract with a German-based Tencent subsidiary, the Guardian reported. The company says the contract covers auxiliary services and does not include storing user data.
The Board Room · Leadership desk
Launch policy: Tencent (Frankfurt) stored messages. ZyMix spokesperson: Tencent Cloud Europe BV gives auxiliary services, not data storage. New policy: Tencent removed. Tencent Holdings: on DoD 1260H list. DoD: cannot contract with listed entities. Ghaffur: ZyMix could not name suppliers.
- exposure ZyMix launch privacy policy Said Tencent (Frankfurt) stored user-generated content and messages, claim 3
- capability ZyMix spokesperson Deal is with Tencent Cloud Europe BV, used for auxiliary services, not to store user data, claim 15
- decision Rewritten privacy policy Mention of Tencent removed after the Guardian approached the company, claim 4
- exposure Tencent Holdings Added in January 2026 to the DoD's section 1260H list of Chinese military companies, claim 11
- constraint US Department of Defense Barred from contracts with listed entities; wider sanctions are not automatic, claim 2
- decision Tarique Ghaffur Said ZyMix could not give supplier identities, citing commercial confidentiality, claim 6
| Who | How | Kind | Claim |
|---|---|---|---|
| ZyMix launch privacy policy | Said Tencent (Frankfurt) stored user-generated content and messages | exposure | 3 |
| ZyMix spokesperson | Deal is with Tencent Cloud Europe BV, used for auxiliary services, not to store user data | capability | 15 |
| Rewritten privacy policy | Mention of Tencent removed after the Guardian approached the company | decision | 4 |
| Tencent Holdings | Added in January 2026 to the DoD's section 1260H list of Chinese military companies | exposure | 11 |
| US Department of Defense | Barred from contracts with listed entities; wider sanctions are not automatic | constraint | 2 |
| Tarique Ghaffur | Said ZyMix could not give supplier identities, citing commercial confidentiality | decision | 6 |
What happened
- Tencent Holdings was added to the US Defense Department's section 1260H list of Chinese military companies in January 2026.
- After the Guardian approached the company, the policy was rewritten and the mention of Tencent was removed.
- Asked for its supplier identities, ZyMix declined through a security consultant, citing commercial confidentiality, contractual obligations and legal privileges.
Why it matters
- contradiction The launch policy put Tencent in message storage and a ZyMix spokesperson now puts it in auxiliary services and testing, so a reviewer holds two descriptions of one supplier.
- constraint The listing bars only the Defense Department from contracting with Tencent, and wider sanctions are not automatic, so for a vendor reviewer it is a flag on the supplier's parent company.
- decision A reviewer has to choose between accepting ZyMix's account and holding the declined supplier request as an open item while the policy text is still being revised.
ZyMix has given two accounts of its Tencent relationship. The privacy policy it published at launch, a document the Guardian notes is legally required, said Tencent (Frankfurt) stored user-generated content and messages [3]. A ZyMix spokesperson now says: "Our agreement is with Tencent Cloud Europe BV, which we use for auxiliary services, rather than as the provider that stores ZyMix user data." [15] The same spokesperson said Tencent, Twilio and the other providers concerned are used "solely for performance testing" [14].
The rewritten policy says users' personal data is stored and processed primarily in the UK and the EU [5]. It adds that auxiliary infrastructure providers, hosted in the EU, "receive only encrypted user messages and limited technical data" [5]. On that wording, encrypted user messages still reach those providers. The Guardian describes a German-based Tencent subsidiary [10]. ZyMix names Tencent Cloud Europe BV [15]. The report does not say whether these are the same entity.
The listing's legal reach is narrow. The Defense Department citation calls Tencent indirectly affiliated with China's People's Liberation Army [12]. The department itself is barred from contracting with listed entities, and wider sanctions are not automatic [2]. Tencent says its inclusion "is clearly a mistake" and that "this listing has no impact on our business" [13]. The case for risk at ZyMix therefore depends on what data reaches Tencent infrastructure.
ZyMix's new policy invites anyone who wants to know its suppliers to ask [9]. Tarique Ghaffur, a former Metropolitan police assistant commissioner who described himself as a security consultant for ZyMix, answered the Guardian's request by declining, citing commercial confidentiality, contractual obligations and legal privileges [6]. Fraser Sampson, the former UK biometrics and surveillance camera commissioner, said he was "sceptical when 'commercial confidentiality' arguments are used to duck basic policy questions and amending policy on the fly is never reassuring" [7]. Sam Dunning, director of the UK-China Transparency NGO, said: "There are serious questions about whether ZyMix have taken due care before launching this product." [8]
The company's reply is that it is "a newly launched startup" and is "updating our privacy notice as we develop our services" [14]. That is a trade-off. A startup gets room to correct its disclosures as the product develops. A reviewer gets a text that changed after a journalist asked [4]. A clearance given this quarter would rest on a document the company has said it will keep changing [14].
What to watch
- Whether ZyMix's next privacy notice names the Tencent entity it contracts with, or publishes a supplier list.
- Whether the Defense Department revisits Tencent's 1260H listing after Tencent called it a mistake.
- Whether further revisions to the ZyMix notice change how Tencent, Twilio and the other providers are described.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap
- Insufficient
- Incentives60
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ZyMix is a messaging and payment super app marketed at British students, pushed on university campuses as the UK's first super app designed for gen Z, combining chat, payments and community features.
- [2]
The DoD is prohibited from entering into, renewing or extending contracts for goods, services or technology with any entity on the list, although wider sanctions are not automatic.
- [3]
ZyMix's privacy policy at launch, a legally required document, said that Tencent (Frankfurt) stored user-generated content and messages.
- [4]
After the Guardian approached the company, the privacy policy was rewritten and mention of Tencent was removed.
- [5]
The rewritten policy states that users' personal data is stored and processed primarily in the United Kingdom and the EU, and that "auxiliary infrastructure providers, hosted in the EU, receive only encrypted user messages and limited technical data, such as technical statistics, licence validation when the app starts".
- [6]
Tarique Ghaffur, a former assistant commissioner at the Metropolitan police who described himself as a security consultant for ZyMix, responded to the Guardian's request for supplier identities that, for reasons of commercial confidentiality, contractual obligations and legal privileges, ZyMix was not able to provide the information.
- [7]
Fraser Sampson, a professor of security and national governance and formerly the UK's biometrics and surveillance camera commissioner, said he was "sceptical when 'commercial confidentiality' arguments are used to duck basic policy questions and amending policy on the fly is never reassuring".
- [8]
Sam Dunning, the director of the UK-China Transparency NGO, said: "There are serious questions about whether ZyMix have taken due care before launching this product."
- [9]
The new privacy policy invites those who wish to know the identity of ZyMix's suppliers to request the information from the company.
- [10]
ZyMix has a contract with a German-based subsidiary of Tencent Holdings, a Chinese conglomerate in Shenzhen.
- [11]
Tencent Holdings was added in January 2026 to the US Department of Defense's list of Chinese military companies, formally known as the section 1260H list.
- [12]
The citation on the DoD list says Tencent, a gaming and social media conglomerate, is indirectly affiliated to the Chinese People's Liberation Army.
ReportedContestedSource: The Guardian, describing the DoD citation2 sources— create a free account to open themView cited source - [13]
A Tencent spokesperson said: "Tencent's inclusion on this list is clearly a mistake. We are not a military company or supplier. Unlike sanctions or export controls, this listing has no impact on our business. We will nonetheless work with the Department of Defense to address any misunderstanding."
ReportedContestedSource: Tencent spokesperson, quoted by the Guardian2 sources— create a free account to open themView cited source - [14]
A ZyMix spokesperson said: "As a newly launched startup, we are updating our privacy notice as we develop our services, including clarifying that Tencent, Twilio and the other providers concerned are used solely for performance testing."
ReportedContestedSource: ZyMix spokesperson, quoted by the Guardian2 sources— create a free account to open themView cited source - [15]
The ZyMix spokesperson added: "Our agreement is with Tencent Cloud Europe BV, which we use for auxiliary services, rather than as the provider that stores ZyMix user data. We take our obligations under UK data protection law seriously."
ReportedContestedSource: ZyMix spokesperson, quoted by the Guardian2 sources— create a free account to open themView cited source
Sources
1 independent publisher whose own reporting we read for this story.
- theguardian.com‘Super app’ aimed at UK students uses servers owned by Chinese firm on US blacklist
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- US-China Tech TensionsFollow
- Data privacyFollow
- Super appsFollow