Data Processing Agreement

Last updated: October 5, 2026 · Forms part of the Terms of Service

Between Zaaz Technology and Software Ltd (“ZaazCRM”, the processor) and the company subscribing to ZaazCRM (you, the controller). It applies whenever you put personal information about your customers, prospects, employees, suppliers or anyone else into ZaazCRM.

You are the controller. You decide whose information goes into ZaazCRM, what is recorded, how long it is kept and who in your company may see it. You are responsible for having the authority to put it there, for giving the people concerned your own privacy notice, and for obtaining any consent the law requires.

We are the processor. We process that information only to provide the service and only on your instructions, which are: the Terms of Service, the settings you choose in the product, and anything you ask us in writing.

We will not use your customers’ data for our own purposes, disclose it except as this agreement allows, or use it to train, fine-tune or evaluate machine-learning models. If we think an instruction of yours would breach applicable data-protection law, we will tell you rather than simply carry it out.

People. Your customers and prospects, your contacts at other businesses, your suppliers and your own staff.

Information. Identity and contact details; commercial information such as quotes, orders, invoices and payments; correspondence; documents you upload; notes and case records; and, if your company switches on field-operations modules, location data for vehicles or staff.

We do not need sensitive personal data to provide the service. If you record it, you do so as the controller and must obtain any express consent the law requires.

Duration. For as long as your workspace is open, then as section 8 sets out.

• have a lawful basis and any necessary consent for the information you enter, and make your privacy notice available to the people concerned;
• keep your users’ access rights current, and remove people who leave;
• use the field- and role-level controls the platform provides where a matter needs them;
• handle ARCO and other data-protection requests from your own customers, with our help under section 7.

This describes the platform as it is today, not as we intend it to be.

• Separation. Each company gets its own database, its own file storage, its own cache namespace and job queue, and its own hostname. An unrecognised host is rejected.
• Access control. Role-based permissions per module (view, create, edit, delete) and per field (write, read-only, invisible). Invisible fields are removed on the server before a record is sent to the browser.
• Authentication. Passwords are stored as salted hashes. Sessions expire and can be revoked by a company administrator. Multi-factor authentication is not yet available; it is a committed roadmap item.
• In transit. TLS on every endpoint.
• At rest. Dedicated servers in Canada, in an OVHcloud facility in Beauharnois, Quebec, on redundant storage with operating-system access controls. Credentials we hold for you (mailbox passwords, Microsoft and Google tokens, storage and telephony keys) are encrypted inside the database. Customer records are not encrypted at the application layer, and full-disk encryption is not applied to production hosts. We will update this section when that changes.
• Audit trail. Changes to records are logged with the user, the time and the IP address, and document activity is kept in its own append-only log.
• Backups. Nightly per-company database dumps on a rolling retention window. A restore is per company and does not require or affect another company’s data.
• People. Access to production is limited to named personnel who need it, under confidentiality obligations, with individual credentials, and is revoked on role change or departure.

You give general authorisation for the sub-processors below. We remain responsible for what they do with your data, and we impose obligations on them no less protective than these.

• OVHcloud: dedicated server hosting in Canada (Beauharnois, Quebec). Receives all application data.
• SMTP2GO: delivery of email the service sends on its own behalf, such as notifications and password resets. Receives those messages’ content and recipient addresses.
• Stripe: subscription billing and card payments. Receives billing details only, never your customers’ data. Card numbers go directly to Stripe and never reach us.
• Google Firebase Cloud Messaging: delivery of notifications to the Android apps. Receives the sender’s name and a short preview of the message or event.

Services we operate ourselves on the same Canadian infrastructure (text recognition on uploaded documents, realtime updates, video calling and in-browser document editing) are not third-party sub-processors, but they do process your data and are covered by section 4. ZaazCRM does not send your customers’ data to external artificial-intelligence providers.

Optional integrations you switch on (a connected mailbox, a messaging channel, a calendar, a document or GPS service) send data to that provider because you chose to connect it; that provider’s terms apply. Email your staff send from ZaazCRM goes out through your own connected mailbox, not through SMTP2GO.

Changes. We will give you at least 30 days’ notice before adding or replacing a sub-processor that handles your customers’ data. If you reasonably object on data-protection grounds within that period, we will propose an alternative or you may terminate the affected service without penalty for the unused portion of your term.

If we confirm a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to your customers’ data, we will:

• notify your company’s designated contact without undue delay, and in any case within 72 hours of confirmation;
• tell you what we know: what happened, which categories and roughly how many records, the likely consequences, and what we are doing about it;
• keep you updated as we learn more, rather than wait for a complete picture before the first notification;
• help you meet your own obligations, including informing the people concerned where the breach significantly affects their rights.

You decide whether to notify affected individuals or an authority: it is your data. We will not contact your customers on your behalf without your instruction.

ARCO and other requests. If we receive a request from one of your customers, we will not answer it ourselves. We will pass it to you promptly and help you respond, including by producing the data we hold.

Records and audits. On reasonable written notice, not more than once a year unless an authority or an incident requires it, we will give you the information you reasonably need to confirm we are meeting this agreement. Where that would disclose another company’s data or compromise platform security, we will provide it in a form that does not.

On termination or expiry of your subscription:

• for 30 days you may request an export of your data in a machine-readable format, and we will provide it at no charge;
• after that, and no later than 90 days after closure, we delete your database, your file storage and any archive copy made while closing your workspace. We do not keep a long-term archive of your data;
• backups age out on their normal rolling schedule, and we do not restore a deleted workspace from them except at your written request within the export window;
• we may keep the minimum account and billing records that tax and corporate law require, which do not include your customers’ data.

On written request we will confirm deletion in writing. Export before you close: your own legal retention duties, such as tax record-keeping, survive this agreement, and we do not hold your files for you afterwards.

Your customers’ data is stored and processed in Canada. When you subscribe from Mexico or elsewhere, you transfer it to us as your processor in Canada; under the LFPDPPP, transfers to a processor do not require the consent of the people concerned. We will not move where it is stored or processed outside Canada without telling you first, identifying the destination and the safeguard relied on, and giving you the right to object.

Two things in section 5 are outside that statement, and we would rather say so: service email relayed through SMTP2GO and Android notifications delivered by Google Firebase Cloud Messaging are handled on those providers’ infrastructure, and optional integrations you enable may operate outside Canada.

This agreement is subject to the limitation of liability in the Terms of Service. Where this agreement and the Terms conflict on the handling of your customers’ personal information, this agreement prevails.

The laws of the Province of British Columbia and the federal laws of Canada applicable there, with the courts of British Columbia having exclusive jurisdiction, without prejudice to the obligations and rights that the LFPDPPP and other mandatory laws of your country establish.

Questions about this agreement, or notices under it:

Zaaz Technology and Software Ltd
Email: privacy@zaaztech.com
Address: 105-111 West Broadway, Vancouver, BC V5Y 1P4, Canada

See also our Privacy Policy and Terms of Service.