ZyMix, promoted on campuses as the UK's first 'super app for gen Z', combines chat, payments and community features. At launch last week, its privacy policy stated that Tencent (Frankfurt), a German-based subsidiary of Chinese conglomerate Tencent Holdings, stored user-generated content and messages.
Tencent Holdings was added in January 2026 to the US Department of Defense's section 1260H list of Chinese military companies, which prohibits the DoD from entering into contracts with listed entities. The Pentagon's citation says the gaming and social media giant is indirectly affiliated with the Chinese People's Liberation Army.
After The Guardian approached ZyMix, the privacy policy was rewritten. The updated version removes mention of Tencent, stating that user data is stored and processed primarily in the UK and the EU, with some service providers in the United States. It adds that 'auxiliary infrastructure providers, hosted in the EU, receive only encrypted user messages and limited technical data'.
A ZyMix spokesperson said the company is updating its privacy notice as it develops its services, clarifying that Tencent, Twilio and other providers 'are used solely for performance testing'. The spokesperson said the agreement is with Tencent Cloud Europe BV for auxiliary services, not for storing user data, and that ZyMix takes its UK data protection obligations seriously.
A Tencent spokesperson said: 'Tencent's inclusion on this list is clearly a mistake. We are not a military company or supplier. Unlike sanctions or export controls, this listing has no impact on our business. We will nonetheless work with the Department of Defense to address any misunderstanding.'
The development comes after MI5 recently warned British universities to cut ties with the China General Technology Research Institute, alleging it was channelling funding from Beijing's intelligence apparatus to UK-linked academics.