1. Definitions

• “Applicable Privacy Law” means, as applicable to the processing: the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”); the Québec Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, as amended by Law 25 (“Law 25”); and any other Canadian privacy legislation applicable to the processing of PI under this DPA.
• “CASL” means An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, S.C. 2010, c. 23, known as Canada’s anti-spam legislation.
• “Personal Information” (“PI”) means information about an identifiable individual that the Processor processes on the Customer’s behalf under the Agreement. It does not include information about the Customer’s own account holders, users and billing contacts that Zedmail collects to operate the account and bill for the service (“Account Data”). Zedmail handles Account Data on its own behalf under its Privacy Policy.
• “Processing” means any operation performed on PI (collection, use, storage, transmission, disclosure, retention, deletion, etc.).
• “Subprocessor” means a third party engaged by the Processor to process PI.
• “Confidentiality Incident” means any access to, use of or communication of PI that is not authorized by law, any loss of PI, or any other breach of the protection of PI. It includes a “breach of security safeguards” under PIPEDA.
• “Serious Injury / RROSH” means, respectively, a risk of serious injury (Law 25) or a real risk of significant harm (PIPEDA) to an individual.
• “Retention Period” means the period, of between 7 and 365 days, that the Customer selects in its account settings for keeping message content and delivery logs in Zedmail’s live systems. The Customer may select a different period for each kind of mail it sends. Where the Customer has not selected a period, the Retention Period is 45 days, or 90 days for mail sent using an older-style API key. The default that applies is shown against each API key in the Customer’s account settings.
• “Suppression Data” means the minimum record needed to stop further sending to an email address after a hard bounce, a spam complaint or an unsubscribe request: the address or a hash of it, the reason, the date, and the Customer account concerned.

2. Roles and scope

2.1 As between the parties, the Customer is the Controller (it determines the purposes and means of processing) and Zedmail is the Processor, acting only on the Customer’s behalf. In the language of Applicable Privacy Law, the Customer is the organization or person carrying on an enterprise that is responsible for the PI, and Zedmail is its service provider.

2.2 Zedmail processes PI only to provide the transactional email service (accepting the Customer’s messages via API/SMTP, authenticating and delivering them, handling bounces, complaints, unsubscribes, and related logging), as further described in Annex A. Zedmail does not sell PI, does not use it for marketing, and does not build profiles of recipients. Zedmail uses PI for its own operational purposes only as set out in section 4.11.

2.3 This DPA is published as standard terms and applies to every Customer on the same terms. Zedmail will countersign a copy on request. Any change for a particular Customer must be in a written amendment signed by both parties.

3. Processing details

The subject matter, duration, nature and purpose of processing, the types of PI, and the categories of data subjects are set out in Annex A.

4. Zedmail’s obligations

4.1 Documented instructions. Zedmail processes PI only on the Customer’s documented instructions (including as set out in the Agreement and this DPA), unless required by law, in which case Zedmail will inform the Customer unless legally prohibited. The Agreement, this DPA and the Customer’s use and configuration of the service (including its API calls and account settings) are the Customer’s complete instructions. Zedmail will tell the Customer if it believes an instruction contravenes Applicable Privacy Law, and is not required to follow that instruction.

4.2 Confidentiality. Zedmail ensures that personnel authorized to process PI are bound by confidentiality and are limited to those who need access to provide the service.

4.3 Security. Zedmail implements and maintains the technical and organizational measures set out in Annex B, appropriate to the sensitivity of the PI and the risks of processing. Zedmail may update those measures over time, provided the overall level of protection is not reduced.

4.4 Subprocessors. (a) The Customer authorizes the use of the Subprocessors listed in Annex C. (b) Zedmail will impose data-protection obligations on each Subprocessor, in writing, substantially equivalent to those in this DPA, and remains responsible for its Subprocessors’ performance. (c) Zedmail will give the Customer at least 30 days’ prior notice of any intended addition or replacement of a Subprocessor, by email to the account’s contact address or by notice in the dashboard, and the Customer may object on reasonable data-protection grounds within that notice period; if the parties cannot resolve the objection, the Customer may terminate the affected service without penalty, as its sole remedy. (d) Zedmail may replace a Subprocessor on shorter notice where that is needed to protect the security or continuity of the service, and will give notice as soon as practicable.

4.5 Assistance with individual rights. Taking into account the nature of the processing, Zedmail will provide reasonable assistance to enable the Customer to respond to requests from individuals to access, correct, or delete their PI, and to exercise other rights under Applicable Privacy Law (including data-portability and de-indexing requests under Law 25, to the extent applicable to data held by Zedmail). If an individual contacts Zedmail directly about PI, Zedmail will refer the individual to the Customer where the Customer can be identified, and will not respond on the Customer’s behalf unless the Customer asks it to or the law requires it.

4.6 Confidentiality Incidents / breach notification. (a) Zedmail will notify the Customer without delay, and in any event within 72 hours, after becoming aware of a Confidentiality Incident involving the Customer’s PI. Zedmail will also notify the Customer without delay of any violation or attempted violation, by any person, of the confidentiality obligations in this DPA that comes to its attention. Routine unsuccessful events that do not compromise PI, such as blocked sign-in attempts, port scans and refused connections, do not require notice. Notices go to the privacy or security contact set in the Customer’s account or, if none is set, to the account email address. (b) The notification will describe, to the extent known, the nature of the incident, the PI and individuals affected, the likely consequences, and the measures taken or proposed. Zedmail will update the Customer as more becomes known. Giving notice is not an admission of fault or liability.

(c) The Customer is responsible for deciding whether a Confidentiality Incident presents a risk of Serious Injury / RROSH, and for any notice that it must give to the Commission d’accès à l’information du Québec (CAI), the Office of the Privacy Commissioner of Canada (OPC) and affected individuals. Law 25 requires the Customer to notify the CAI and affected individuals promptly where there is a risk of serious injury, and PIPEDA requires the Customer to report to the OPC and notify affected individuals as soon as feasible where there is a real risk of significant harm. Zedmail will give the Customer the information and reasonable assistance it needs to make that assessment and to give those notices on time. Zedmail will not notify a regulator or the Customer’s recipients about the Customer’s PI unless the Customer asks it to or the law requires it.

(d) Zedmail keeps a record of every Confidentiality Incident that affects PI, for at least as long as Applicable Privacy Law requires the Customer to keep its own register and records, and will give the Customer the entries that concern its PI on request. This allows the Customer to maintain the register of confidentiality incidents that Law 25 requires and the breach records that PIPEDA requires.

4.7 Data location and cross-border communication. (a) The Customer’s transactional email PI (recipient addresses, message content, and logs/metadata) is stored in Canada, in data centres operated by OVHcloud in Québec. Zedmail does not store PI outside Canada and does not authorize any Subprocessor to store or access PI outside Canada.

(b) Zedmail is established in Ottawa, Ontario, and administers the service from Ontario. A Customer that is subject to Law 25 is therefore entrusting PI to a service provider outside Québec, even though the PI is hosted in Québec. PIPEDA applies to Zedmail’s handling of that PI in Ontario.

(c) Delivering a message transmits it to the recipient’s email provider, wherever that provider operates. Zedmail makes that transmission on the Customer’s instructions and does not control the recipient’s provider.

(d) Billing is handled by Paddle (United Kingdom) as merchant of record. Paddle receives Account Data only. It never receives recipient addresses, message content or delivery logs. Zedmail is responsible for that communication under its Privacy Policy.

(e) The Customer is responsible for any privacy impact assessment (« évaluation des facteurs relatifs à la vie privée ») that Law 25 requires it to conduct before using the service. Zedmail will give the Customer the information reasonably needed to complete it, including the information in the Annexes. This DPA is the written agreement that Law 25 requires for that communication.

4.8 Retention, return and deletion. (a) During the term. Zedmail keeps message content and delivery logs in its live systems for the Retention Period and then deletes them automatically. The Customer chooses the Retention Period and is responsible for choosing one that is no longer than it needs. A change to the Retention Period applies to messages already held as well as to new messages, from Zedmail’s next nightly deletion run. Mail server and application logs held outside the database, which include recipient addresses, are kept for no more than 7 days and then deleted.

(b) Backups. Backups are nightly encrypted snapshots of the database and server configuration, and are not edited when live data is deleted. Messages waiting in the outbound queue and server logs are not included in backups. PI that has been deleted from the live systems remains in backups until those backups expire, which is no more than 90 days later (see Annex B). Zedmail restores PI from a backup only to recover the service, and deletes it again once the Retention Period has passed.

(c) On termination. When the Agreement ends, Zedmail deletes the Customer’s PI from its live systems within 30 days, unless the law requires Zedmail to keep it longer. Until then, the Customer may export its message logs and its Suppression Data, and Zedmail will provide them on request if the Customer cannot export them itself.

(d) Suppression Data. Zedmail keeps the Customer’s Suppression Data for as long as the Customer’s account is open, whatever Retention Period the Customer has chosen, so that unsubscribe requests, hard bounces and complaints continue to be honoured. Before closing its account, the Customer may export its Suppression Data, together with its account details and message metadata. When the account is closed, Zedmail deletes the Customer’s Suppression Data with the rest of the Customer’s PI under paragraph (c).

(e) Service-wide suppression record. Zedmail also keeps, on its own behalf, a service-wide record of addresses that hard bounced or produced a spam complaint, and of unsubscribe requests that it processed. Addresses on that record are hashed. An entry stays on the record while any Zedmail account still suppresses the address, and is deleted 3 years after the last account stops suppressing it. Zedmail uses that record only to protect the service from abuse, to maintain deliverability, and to show that a request was honoured. Zedmail does not use it to contact anyone.

(f) Permanent do-not-mail list. Where an individual has demanded that they receive no further mail through the service, or the law requires it, Zedmail may add the individual’s address, in hashed form, to a permanent do-not-mail list, with a short note of the reason. Zedmail keeps each entry for as long as it is needed to honour that demand, uses it only to block sending to that address, and limits the note to what is needed to explain the entry.

4.9 Records and audit. Zedmail will make available information reasonably necessary to demonstrate compliance with this DPA and will allow the Customer’s person in charge of the protection of personal information to verify that compliance. Verification is carried out by Zedmail answering reasonable written security questionnaires and providing a summary of its controls, on reasonable notice and subject to confidentiality. The Customer may do this once in any 12-month period, and again after a Confidentiality Incident that affects its PI or where a regulator requires it. Any further audit requires Zedmail’s agreement on scope, timing and cost. As of the date of this DPA, Zedmail does not hold SOC 2 or ISO 27001 certification.

4.10 Government and legal requests. Zedmail is a Canadian corporation and is subject to Canadian law, including orders of Canadian courts and authorities. If a court or public authority, in Canada or elsewhere, requires Zedmail to disclose PI, Zedmail will: (a) disclose only what it is legally compelled to disclose; (b) notify the Customer before disclosing, unless the law prohibits notice; and (c) refer the authority to the Customer where it can. Zedmail will not disclose PI in response to a request from an authority outside Canada unless it is legally compelled to do so.

4.11 Operational uses. As part of providing the service, Zedmail may use delivery metadata and Suppression Data, and may examine message content where automated abuse detection or the investigation of a specific abuse report requires it, in order to: (a) keep the service secure and prevent spam, fraud and abuse; (b) protect the deliverability and reputation of its sending infrastructure; (c) meter usage and bill for the service; (d) comply with the law; and (e) produce aggregate statistics that do not identify any individual. Zedmail does not use PI for any other purpose.

5. Customer’s obligations

5.1 The Customer warrants that it has a valid legal basis (including valid consent under CASL / Applicable Privacy Law) to process the PI it submits and to have Zedmail process it, that its instructions are lawful, and that it will not submit PI beyond what Annex A contemplates.

5.2 Sensitive information. The service is designed for transactional email. The Customer will not use it to send information that is sensitive by its nature without Zedmail’s prior written agreement. This includes health information, government-issued identifiers, full payment card or bank account numbers, passwords in clear text, and biometric information. Ordinary transactional content is permitted, including order confirmations and receipts that show what was purchased and the amount paid.

5.3 The Customer is responsible for the security of its account, its API keys and its sending domain, and for the content of its messages. Because message content is kept for the Retention Period, the Customer will make sign-in links and password-reset links expire within a short time.

5.4 Open and click tracking is off unless the Customer turns it on. If the Customer turns it on, the Customer is responsible for informing its recipients and for meeting any consent or activation requirement under Applicable Privacy Law.

5.5 The Customer will keep a current contact for privacy and security notices in its account.

6. Liability, term, governing law

6.1 This DPA is effective for the term of the Agreement and survives to the extent Zedmail retains PI.

6.2 Each party’s liability under this DPA is subject to the exclusions and limits in the Agreement, to the extent the law allows those limits to apply. As between the parties, the Customer is responsible for any claim, penalty or loss that results from the content of its messages, its recipient lists, or instructions that contravene Applicable Privacy Law or CASL.

6.3 This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario, and the courts of Ontario have exclusive jurisdiction, as set out in the Agreement. This does not limit any mandatory provision of Law 25 that applies to the PI of Québec residents.

6.4 Changes. Zedmail may update this DPA by giving the Customer at least 30 days’ notice by email or by notice in the dashboard. A Customer that does not accept a change may close its account before the change takes effect. Continued use of the service after that date is acceptance of the updated DPA.

6.5 Privacy contact. Zedmail’s person in charge of the protection of personal information is Darren Atwater, Privacy Officer, who can be reached at privacy@zedmail.com.

7. Acceptance

This DPA is accepted as described at the beginning of this document and does not need to be signed. A Customer that needs a signed copy for its records may request one from Zedmail at privacy@zedmail.com.

Annex A — Details of processing

Subject matter	Provision of the Zedmail transactional email relay/API service.
Duration	The term of the Agreement, plus the deletion period in section 4.8.
Nature & purpose	Receiving Customer messages via API/SMTP; authenticating (SPF/DKIM/DMARC) and delivering them; processing bounces, spam complaints, and unsubscribes; delivery logging and deliverability/abuse monitoring; open and click tracking where the Customer has turned it on.
Types of PI	Recipient email addresses; sender/From details; message content, attachments and headers the Customer chooses to send; delivery metadata (timestamps, status, bounce/complaint events, IP of submission); open and click events where tracking is on; Suppression Data.
Categories of data subjects	The individuals to whom the Customer sends mail, and any individuals identified in the content the Customer submits.
Sensitive PI	Not contemplated. See section 5.2.
Retention	Message content and delivery logs retained for the Retention Period (see section 1), then deleted from live systems. Mail server and application logs: 7 days. Backups: up to 90 days after that (Annex B). Suppression records retained for as long as the account is open, then as set out in sections 4.8(d) to (f). Attachment content is not kept. Attached files are deleted as soon as the message has been sent. Only the file name, type and size are kept with the message record, and they are deleted with it.
Location	Stored in Québec, Canada. Administered from Ontario, Canada. See section 4.7.

Annex B — Technical and organizational security measures

• Hosting: virtual servers with OVHcloud in Québec, Canada, dedicated to Zedmail, under contract with OVH Hébergement Inc., OVH’s Canadian operating company. OVH’s parent company is based in France.
• Encryption in transit: TLS enforced on all SMTP submission (implicit TLS / STARTTLS) and web/API traffic.
• Encryption at rest: the database, which holds delivery records, recipient addresses, message content and attachment file names, is kept on encrypted storage (AES-256). DKIM signing keys held in the database are encrypted a second time by the application (AES-256). Account passwords are hashed (bcrypt). Backups are encrypted before they leave the server and are stored in Canada.
• Limits of encryption at rest: while a message is on its way to the recipient, its content is held on the server unencrypted. This is normally a second or less. If the receiving mail service asks us to try again later, the message is held until it is delivered or abandoned, which can take up to three days. Records of delivery activity in mail server and application logs, which include recipient addresses, are held unencrypted in the same way and are deleted after 7 days. Access to both is limited to Zedmail administrators. Encryption at rest applies to the database, not to everything stored on the server.
• Backups: automated nightly backups of the database and server configuration are encrypted and stored in Canadian object storage (OVHcloud, Beauharnois, Québec), with automated nightly verification; retained for 90 days then deleted by a bucket lifecycle rule. The outbound queue and server logs are not backed up.
• Access control: administrative access restricted to authorized personnel; API access via per-account keys with configurable scopes.
• Network/abuse controls: per-account rate and volume limits; automated abuse detection with auto-suspension; firewall-level rate-limiting on mail-submission ports; bounce/complaint monitoring.
• Authentication: per-customer DKIM signing; SPF and DMARC supported for the Customer’s sending domain.

Annex C — Subprocessors and other service providers

Subprocessor	Role	Location / ownership	PI processed
OVHcloud (OVH Hébergement Inc.)	Primary hosting & storage of the service and data	Québec, Canada (parent: France)	All PI processed under this DPA, including encrypted backups
Paddle.com Market Ltd	Billing / merchant of record	United Kingdom	None under this DPA. Paddle receives Account Data only (account and billing details), for which Zedmail is responsible under its Privacy Policy. Paddle is listed for transparency.
Bunny.net	Authoritative DNS for zedmail.com	Slovenia (EU)	None. Publishes Zedmail’s own public DNS records. Does not receive, store or transit Customer message content, recipient addresses or account data.
Hostinger	Authoritative DNS for zedmail.io (the infrastructure domain carrying _spf.zedmail.io and the bounce/unsubscribe/report MX records)	Lithuania (EU)	None. As above.

The only Subprocessor that stores or has access to PI is OVH Hébergement Inc., OVH’s Canadian operating company, and that PI is stored in Québec. Zedmail is a Canadian corporation with no office, staff or infrastructure in the United States. Section 4.10 sets out how Zedmail handles any legal demand for PI, whether Canadian or foreign.

The two DNS providers are listed for completeness rather than because they process personal information. Authoritative DNS publishes records that are public by definition and carries no message content; they are disclosed because they sit in the service-delivery path.

Customers’ own DNS providers are outside this list: a Customer chooses where their sending domain’s DNS is hosted, and Zedmail is not their processor for it.

Ozonagram Ltd, operating as Zedmail  ·  Suite M162, 110 Didsbury Road, Ottawa, Ontario K2T 0C2, Canada  ·  corporation no. 1198855-7  ·  privacy@zedmail.com