Privacy Policy

This Privacy Policy explains how BurTech Solution collects, uses, shares and protects personal information in connection with Zamilo: the website at zamilo.io and the web application at https://app.zamilo.io. It also explains the rights you have over your information and how to use them, wherever you live.

In this policy, "we", "us" and "our" mean BurTech Solution. "Zamilo" means the website and the application together. A "Customer" is a business that uses Zamilo, and its "workspace" is its own separate area of Zamilo. A "User" is a person a Customer allows to sign in to its workspace. "Customer Data" is the information a Customer puts into its workspace, directly or through a service it connects. "Personal information" is information about an identifiable person; some laws call it "personal data".

1. The short version

2. Who we are

Zamilo is operated by BurTech Solution, a business registered in Ontario, Canada. We offer Zamilo to businesses in every country. Zamilo is currently in an invite-only beta and is free of charge during the beta.

Our privacy officer is responsible for how we handle personal information and for this policy. You can reach our privacy officer at [email protected]. Our privacy officer is also:

• the person in charge of the protection of personal information under Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25;
• our Information Officer under South Africa's Protection of Personal Information Act (POPIA);
• our "encarregado" (the person in charge of personal data processing) under Brazil's General Data Protection Law (LGPD);
• the contact for privacy questions, requests and complaints under every other law described in this policy.

3. Two roles: our information and our Customers' information

We handle personal information in two different roles. Your rights work differently in each, so it helps to know which one applies.

Information we hold for ourselves

For the following information, we decide why and how it is used. We are its "controller" (the term used by the GDPR and similar laws) and the organisation accountable for it under Canadian law:

• account information about Users;
• sign-in and security records;
• information about people who visit our website, or who write to us through its forms or by email;
• information about the people at our Customers and prospective customers whom we deal with as business contacts.

Most of this policy is about this information. To use your rights over it, write to us as described in section 14.

Information our Customers put into Zamilo

Customers use Zamilo to keep their own business records. Those records contain personal information about the Customer's own contacts, such as names, email addresses, phone numbers and postal addresses, orders, correspondence, call logs, voicemail and call recordings, text messages, and complaint and incident narratives. A complaint or incident narrative can describe an injury or a health circumstance.

For Customer Data, the Customer is the controller (a "business" under US state privacy laws) and we are its processor (a "service provider" or "processor"). This means:

• the Customer decides what Customer Data to collect, why it is used and how long it is kept;
• we use Customer Data only to provide Zamilo to that Customer, following its instructions and our agreement with it, including our Data Processing Addendum;
• the Customer's own privacy notice, not this policy, explains how the Customer uses your information;
• if you want to see, correct or delete information that a business holds about you in Zamilo, contact that business. If you write to us instead, we will tell you that the request belongs with the business, and we will help the business answer it.

We do not use Customer Data for our own purposes, such as advertising or building profiles, and we never sell it. This policy still describes the services a Customer can connect (section 5), where Customer Data is held (section 9) and how we protect it (section 10).

4. What we collect and why

The table below lists the personal information we hold as controller, where it comes from, why we use it, the legal basis we rely on where a law such as the GDPR asks for one, and how long we keep it.

Information	Source	Why we use it	Legal basis	How long we keep it
Users' account information: name, work email address, role, password (we store only a salted Argon2id hash of it, never the password itself), two-step sign-in secret (stored encrypted) and recovery codes (we store only keyed hashes of them).	The User, and the Customer's admin who invites them.	To create and run the account, let the User sign in, apply the permissions of their role, and send invitations and password-reset links.	Legitimate interests (providing the service a Customer has asked us to provide to its Users). Contract, where the User is personally our Customer.	While the account and the workspace exist. Deleted with the workspace (see section 11).
Sign-in and security records: sign-in times, the IP address used, failed sign-in attempts and lockouts, and the audit log of actions taken in the workspace (who changed what, and when).	Recorded automatically when a User signs in and works in Zamilo.	To keep accounts secure, detect and investigate misuse, and show the Customer who changed its records.	Legitimate interests (security, and keeping a reliable record of changes for the Customer).	Kept with the workspace while it is active, and deleted with it.
Website form messages (contact, support, invitation and demo requests, and affiliate applications): name, email address, company, topic and message; for invitation requests also country, team size, the apps you are interested in and the tools you use today; the IP address and browser user agent the form was sent from; and, if you came to the form from a link that names a campaign or a partner, that name.	You, and your browser.	To answer you, consider your invitation request, and stop spam and abuse of the forms.	Legitimate interests (answering people who write to us and protecting our forms). Steps you ask us to take before a contract, for invitation requests.	Up to 24 months.
Server logs: IP address, browser type and version, the pages and files requested, and the date and time.	Your browser. Cloudflare and our web server see this when you visit the website or the app.	To deliver the website and the app, keep them secure, and find and fix faults.	Legitimate interests (running a secure and reliable service).	Kept in a fixed amount of space and overwritten as new entries arrive.
Emails we send: invitations, password-reset links and notifications, with the recipient's name and email address and the message.	Created by Zamilo from account information and activity in the workspace.	To let people join a workspace, reset their password and stay informed about their work.	Legitimate interests (operating the service). Contract, where the User is personally our Customer.	The record an email belongs to (for example, an invitation) is kept with the workspace. Our email provider keeps delivery records for a limited period under its own terms.
Support conversations: what you write to our support team by email or through the support form, your name, email address and company workspace, and our replies.	You.	To help you, fix problems and keep a record of what we agreed.	Legitimate interests (supporting our Customers and their Users). Contract, where you are personally our Customer.	Up to 24 months after the conversation ends.
Privacy requests: what you asked, how we confirmed your identity and how we answered.	You.	To answer your request and to be able to show that we did.	Legal obligation.	24 months, or longer if a law requires it.

The legal bases, in plain words

Contract

We need the information to perform a contract with you, or to take steps you ask for before entering one.

Legitimate interests

We have a genuine business reason to use the information, such as providing and securing Zamilo or answering people who write to us, and that reason is not outweighed by your interests and rights. You can object to this use at any time (see section 12).

Legal obligation

A law requires us to use or keep the information.

Consent

You have agreed to a specific use. We do not currently rely on consent for any of the uses above. If we ever ask for your consent, we will say what it is for, and you can withdraw it at any time without affecting anything we did before.

What we do not collect

• Our website uses no analytics, no advertising, no tracking pixels and no third-party scripts. Its only cookies are described in our Cookie Policy.
• We do not use an error-tracking or analytics service in the app.
• We do not buy personal information or obtain it from data brokers.
• We do not use any technology to identify, locate or profile you.

You do not have to give us personal information. Without a name and an email address, though, we cannot answer a message or give you an account.

5. Information from connected services

A Customer can connect Zamilo to other services it uses. Each connection is made only by the Customer (by one of its Users with permission to do so). These services are not our subprocessors: information moves between Zamilo and each service only because the Customer connected it, and under the Customer's own agreement with that service.

What Zamilo receives from a connected service becomes Customer Data. We use it only to provide Zamilo's features to that Customer. The credentials for each connection (tokens, keys and app passwords) are stored encrypted, with a key derived for that Customer's company alone. A Customer can disconnect any service at any time, as explained on our Deleting your data page.

Microsoft 365

A User connects a Microsoft 365 mailbox by signing in to Microsoft with OAuth 2.0, through Zamilo's multi-tenant application registered with Microsoft Entra ID. The User grants delegated permissions, meaning Zamilo acts as that signed-in person and can reach only what they can reach. Zamilo asks for these permissions:

• offline_access: keep the connection working without asking the User to sign in each time;
• User.Read: read the signed-in person's basic profile, to know whose account is connected;
• Mail.ReadWrite and Mail.ReadWrite.Shared: read mail, and mark it read or move it, in the person's own mailbox and in shared mailboxes they can open;
• Mail.Send and Mail.Send.Shared: send mail from those mailboxes.

With these permissions, Zamilo reads mail in the Inbox, Sent Items and Archive folders, and in any other folders the Customer chooses to add. It marks messages as read and moves them to Archive to mirror what Users do in Zamilo. It sends only the messages a User writes and sends. The refresh token that keeps the connection working is stored encrypted. The connection can be ended in Zamilo by removing the mailbox, or in Microsoft through My Apps or, for an organisation's administrator, through Enterprise applications in the Microsoft Entra admin center.

Separately, and only if it chooses to, a Customer can enter an application that it registers itself in its own Microsoft Entra tenant, so that Users can attach files from OneDrive or SharePoint folders the Customer selects. That registration uses the application permissions Files.Read.All and Sites.Read.All, granted by the Customer's own administrator. Zamilo lists the selected folders and copies a file into the workspace only when a User attaches it to a record.

IMAP and SMTP mailboxes, including Gmail

A User can connect any mailbox that offers IMAP and SMTP, such as Gmail, Yahoo, iCloud or Fastmail, by entering the mailbox address and an app password (a password the mail provider creates for one app). The app password is stored encrypted with the Customer's own key. Zamilo uses it only to read that mailbox's mail, mark messages read, move them and send the messages a User writes.

QuickBooks Online

A User connects the Customer's QuickBooks Online company by signing in to Intuit with OAuth 2.0. Zamilo asks for the com.intuit.quickbooks.accounting scope. Zamilo reads customers, items, vendors, invoices, estimates, purchase orders and bills. It creates an invoice or a purchase order in QuickBooks only when a User presses Send. The tokens are stored encrypted. Disconnecting in Zamilo deletes them and asks Intuit to revoke them.

Shopify

A Customer connects a Shopify store by installing the Zamilo app from its Shopify admin and linking the store to its workspace. The Zamilo app is awaiting approval for the Shopify App Store. It asks for these scopes: read_orders, write_customers, read_returns, write_products, write_inventory, read_locations and write_merchant_managed_fulfillment_orders, and, once Shopify approves it, read_all_orders (orders older than 60 days). With them, Zamilo reads the store's orders, customers, products and locations; adds the Customer's leads to the store as customers, and pushes prices and stock levels to the store, only if the Customer switches those pushes on; and marks orders fulfilled with their tracking numbers.

Zamilo honours Shopify's mandatory privacy webhooks:

• when a store's customer asks for their information (customers/data_request), Zamilo creates a task for the Customer to gather it and send it to them;
• when a store's customer asks to be erased (customers/redact), Zamilo removes that person's details from the store's orders, leads and customer record in the workspace, except for a record the Customer must keep, and tells the Customer which records were kept and why;
• when the app is uninstalled (app/uninstalled), Zamilo deletes the store's access tokens at once, and when Shopify then sends shop/redact, Zamilo deletes the store's connection.

RingCentral

With credentials the Customer creates in its own RingCentral account, Zamilo reads that account's call log, call recordings, voicemail and text messages, and keeps them on the matching customer's history. When a User asks, it also starts a call or sends a text from the Customer's RingCentral number.

Shipping carriers

With API keys the Customer enters for Freightcom, ShipStation or EasyPost, Zamilo sends the shipment details those services need to quote rates and buy labels: the ship-from and ship-to addresses, the recipient's name and contact details, and the parcels' sizes and weights. It reads back rates, labels and tracking updates, and can void a label a User no longer needs.

WooCommerce

A Customer connects a WooCommerce store by approving Zamilo on the store's own page or by entering a REST API key with read and write access. Zamilo reads the store's orders, including the buyer's name, contact details and shipping address, and receives the store's order webhooks. When a User fulfils an order, Zamilo completes it on the store with a note of its tracking number. It pushes prices and stock levels to the store's products with matching SKUs only if the Customer switches those pushes on. Disconnecting removes Zamilo's webhooks from the store and deletes the key.

Magento (Adobe Commerce)

With credentials the Customer enters, Zamilo matches the store's products to the Customer's catalogue by SKU and pushes prices to it. Only product and price information is exchanged.

AI providers

A Customer can connect its own AI provider account. What is sent and how it is used is explained in section 7.

Imports

A Customer can bring its existing records into Zamilo from spreadsheets, a Zoho CRM export, FileMaker or another Zamilo workspace. Imported records are Customer Data like any other.

6. Google user data

Today, Gmail and Google Workspace mailboxes connect to Zamilo through IMAP and SMTP with an app password, as described in section 5. Zamilo does not currently use Google APIs to read Gmail. Signing in with Google to connect a Gmail mailbox is planned. The commitments in this section apply to any information Zamilo receives from Google APIs, whenever Zamilo uses them.

Zamilo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain words, information Zamilo receives from Google APIs:

• is used only to provide the Zamilo features the User asked for;
• is not used for advertising;
• is not sold;
• is not used to train AI models;
• is read by a person only with the User's consent, for security purposes (such as investigating abuse), or as the law requires.

7. AI features

Zamilo's AI features are optional. A Customer turns them on by entering an API key for its own account with an AI provider, such as Anthropic (Claude). Without a key, the AI features are off and everything in Zamilo still works by hand.

When a User asks for help, for example to draft a reply, summarise a long email thread, suggest tags, or propose the fields of a complaint from the email that reported it, Zamilo sends the text the User is asking about (such as the email thread or the record) to the Customer's AI provider. The provider processes it under the Customer's own agreement with that provider.

• We do not train AI models on Customer Data.
• A person reviews every AI result before it is saved or sent. The AI never sends a message or saves a record by itself.
• When the AI proposes the fields of a complaint, it may use only what the source email or record says. It is never asked to judge severity, root cause, whether a recall is needed or whether an incident must be reported; those stay human decisions.
• A Customer's admin can switch the AI features off at any time.

Zamilo does not make decisions about anyone based solely on automated processing.

8. How we share information

We share personal information only in these situations:

• Our subprocessors. Three companies help us run Zamilo: Hostinger International Ltd. runs the server and its database; Cloudflare, Inc. provides the network, security, encrypted connection to the server and storage for files and backups; and Resend, Inc. sends our emails. They may use the information only to provide their services to us. Our Subprocessors page lists them, what they do and where.
• Connected services, at the Customer's direction. When a Customer connects a service, Zamilo exchanges information with it as described in section 5.
• Your company. If you are a User, your company's admins can see your account details and the audit log of what you did in the workspace.
• Legal requirements. We disclose information when a law, court order or other legal process requires it, or when it is needed to protect the safety, rights or property of people or of Zamilo. We disclose only what is required. If the request concerns Customer Data, we tell the Customer first unless the law forbids it.
• Business transfers. If our business, or part of it, is merged, sold or reorganised, personal information may pass to the new owner, who must continue to protect it as this policy describes. We will notify Customers' admins by email before their information is transferred and becomes subject to a different privacy policy.
• With consent. In any other situation, only with the consent of the person concerned, or of the Customer for Customer Data.

9. International transfers

We are based in Canada. The server that runs Zamilo and its PostgreSQL database is provided by Hostinger and located in our hosting region, which is listed on our Subprocessors page. Cloudflare's global network carries traffic to and from Zamilo, and its R2 object storage holds uploaded files, email attachments and backups. Our email provider is in the United States. Your information may therefore be processed in Canada, in our hosting region, in the United States and in other countries where Cloudflare operates.

Wherever information is processed, the courts, law enforcement and national security authorities of that country may be able to obtain it under their laws.

We protect information that crosses borders as follows:

• Canada. We remain accountable for personal information we entrust to our subprocessors. Our agreements with them require them to protect it to a level comparable to what Canadian law requires and to use it only to provide their services to us.
• Quebec. Before personal information about people in Quebec is communicated outside Quebec, a privacy impact assessment is carried out, as Quebec law requires. We do this for the information we control. For Customer Data, the Customer carries out the assessment, and we give it the information it needs.
• European Economic Area. The European Commission recognises Canada as providing adequate protection for organisations subject to Canada's federal private-sector privacy law (PIPEDA). Where personal information from the European Economic Area is transferred to a country without such a decision, we rely on the European Commission's Standard Contractual Clauses.
• United Kingdom. The United Kingdom also recognises Canada as adequate. Otherwise, we rely on the UK International Data Transfer Addendum to the Standard Contractual Clauses.
• Switzerland. Switzerland also recognises Canada as adequate. Otherwise, we rely on the Standard Contractual Clauses with the adaptations Swiss law requires.
• Other countries. We rely on the same contractual safeguards, and on any additional step a local law requires.

You can ask us for more information about these safeguards, or for a copy of the relevant clauses, by writing to [email protected]. We may remove commercial terms from a copy.

10. Security

We protect personal information with technical and organisational measures suited to its sensitivity. They include:

• HTTPS for every connection, with HTTP Strict Transport Security (HSTS);
• each Customer's data kept apart by PostgreSQL row-level security, plus checks in the application on every query;
• credentials for connected services, two-step sign-in secrets and app passwords encrypted with a key derived for each company from a server secret held outside the database;
• passwords stored only as salted Argon2id hashes;
• two-step sign-in with authenticator codes and recovery codes, which a Customer can require for all of its Users;
• accounts locked for 15 minutes after 5 failed sign-in attempts, and limits on how often one network address can try to sign in, reset a password or open a public link;
• roles and permissions for each User;
• an audit log of changes to records;
• access logs that never record keys or tokens carried in web addresses;
• an operator console that requires two-step sign-in and shows companies, not their records;
• a server reached only through Cloudflare's encrypted tunnel, with no inbound ports open;
• nightly backups of the whole database, stored in Cloudflare R2 for about 15 days, and nightly snapshots of each company kept for 14 days, with restore procedures that are documented and tested.

Our Security page has more detail. To report a security problem, write to [email protected] as described in our disclosure policy.

No system is perfectly secure, and we cannot promise that information will never be accessed, disclosed or lost without authorisation. If a breach affects personal information, we will notify the people affected and the authorities as the law requires. If it affects Customer Data, we will tell the Customer without undue delay, and within 72 hours of becoming aware of it.

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as a law requires.

• Customer Data is kept while the workspace is active. A Customer's admin can export all of it at any time. When a workspace is closed, whether by the Customer or at the end of the beta without moving to a paid plan, we keep its data for 30 days so it can be exported, and then delete it. Backups that contain it age out within a further 15 days.
• Users' account information and audit records stay with the workspace and are deleted with it.
• Website form messages are kept for up to 24 months.
• Support conversations are kept for up to 24 months after the conversation ends.
• Server logs are kept in a fixed amount of space and overwritten as new entries arrive.
• Records of privacy requests are kept for 24 months, or longer if a law requires it.

Within a workspace, how long the Customer keeps its own records is the Customer's decision. If a business holds information about you in Zamilo, ask that business how long it keeps it.

12. Your rights

Depending on where you live, privacy laws give you rights over your personal information. Whatever the law where you live, we offer everyone these core rights over the information we hold as controller:

• Access: to know whether we hold personal information about you, and to receive a copy of it with an explanation of how we use it, where it came from and who we share it with;
• Correction: to have inaccurate or incomplete information corrected;
• Deletion: to have your information deleted when we no longer need it or have no legal reason to keep it;
• Portability: to receive the information you gave us in a structured, commonly used, machine-readable format, and to have it sent to another organisation where that is technically possible;
• Objection and restriction: to object to our use of your information based on legitimate interests, or to ask us to limit how we use it while a question about it is resolved;
• Withdrawing consent: where we rely on your consent, to withdraw it at any time;
• Equal treatment: we will not treat you differently because you used any of these rights;
• Complaint: to complain to us, and to the privacy authority where you live.

Some rights have limits. For example, we may keep information a law requires us to keep, or refuse a request that would reveal personal information about someone else. If we cannot do all that you ask, we will tell you why.

For Customer Data, these rights are exercised through the Customer that holds the information (see section 3).

13. Rights where you live

This section adds the specific rights and complaint routes of the main privacy laws. To make any request, follow section 14.

Canada

Federal law (PIPEDA). Under the Personal Information Protection and Electronic Documents Act, you can ask to access the personal information we hold about you, challenge its accuracy and completeness and have it corrected, and withdraw your consent, subject to legal and contractual limits. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Quebec (Law 25). Under Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, you also have the right:

• to be informed, when we collect your information, of why and how we collect it, your rights, and the possibility that it may be communicated outside Quebec (this policy is that information);
• to access and correct your information, and to withdraw your consent;
• to data portability: to receive computerised personal information you gave us in a structured, commonly used technological format, and to have it sent to a person or organisation you name;
• to ask us to stop disseminating your personal information, or to de-index any hyperlink attached to your name that gives access to it, where the law allows (de-indexation);
• to be informed of decisions based exclusively on automated processing. We do not make such decisions. If we ever do, we will tell you at the time, and you may ask for the personal information used, the reasons and main factors that led to the decision, have that information corrected, and submit your observations to a person who can review the decision.

Our person in charge of the protection of personal information is our privacy officer, at [email protected]. You can complain to the Commission d'accès à l'information du Québec.

Alberta and British Columbia. Each province's Personal Information Protection Act (PIPA) gives you the right to access and correct your personal information and to withdraw consent. You can ask us for information about how we use service providers outside Canada and the questions our privacy officer can answer about them. You can complain to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Information and Privacy Commissioner for British Columbia.

United States

California (CCPA, as amended by the CPRA). This is our notice at collection for California residents. In the last 12 months, we have collected the following categories of personal information:

Category	Examples	Sources	Purposes	Disclosed for a business purpose to
Identifiers	Name, email address, IP address, account name.	You; your company; your browser.	Providing and securing Zamilo; answering messages; sending account emails.	Our subprocessors (hosting, network and email); your company, if you are a User.
Personal information described in Cal. Civ. Code § 1798.80(e)	Name, email address, employer.	You; your company.	As above.	As above.
Professional or employment-related information	Company, role, team size, the tools you use today.	You; your company.	Running accounts and permissions; considering invitation requests.	Our subprocessors; your company, if you are a User.
Internet or other electronic network activity	Sign-in records, audit log entries, server logs, browser user agent, pages requested.	Your browser and your use of Zamilo.	Security; preventing abuse; finding and fixing faults; showing your company who changed its records.	Our subprocessors; your company, if you are a User.
Sensitive personal information	Account sign-in credentials (your email address with your password, two-step sign-in secret and recovery codes, which we store only hashed or encrypted).	You.	Signing you in and keeping your account secure, and nothing else.	Our hosting and network subprocessors, which store or carry it for us.

How long we keep each category is set out in section 4 and section 11.

We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. We use sensitive personal information only to sign you in and keep your account secure, never to infer characteristics about you.

As a California resident, you have the right:

• to know what personal information we have collected about you, including the categories, the sources, the purposes and the categories of recipients, and to receive the specific pieces of information;
• to delete personal information we collected from you;
• to correct inaccurate personal information;
• to opt out of the sale or sharing of your personal information (we do neither, so there is nothing to opt out of, but you may still ask);
• to limit the use and disclosure of your sensitive personal information (we already use it only for the purposes the law permits without such a request);
• not to be discriminated against for using any of these rights.

You can use an authorised agent. The agent must give us your signed written permission, or a power of attorney, and we may ask you to confirm your identity with us directly. To verify a request, we match the details you give us with the information we hold, as described in section 14. We confirm receipt of a request within 10 business days.

Other US states. Comprehensive privacy laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island give their residents rights over their personal information. Some of these laws do not cover information about people acting in a business or employment role, and some apply only to larger organisations. Whether or not a particular law applies to us, we offer residents of all these states the right:

• to confirm whether we process their personal information and to access it;
• to correct inaccuracies;
• to delete their personal information;
• to obtain a portable copy of it;
• to opt out of targeted advertising, the sale of personal information and profiling that produces legal or similarly significant effects. We do none of these things;
• to appeal our decision on a request. To appeal, reply to our answer and ask us to reconsider. We will answer the appeal within the time your state's law sets. If we deny it, you may contact your state's Attorney General.

Nevada residents: we do not sell covered information as Nevada law defines it.

Global Privacy Control and Do Not Track. We honour Global Privacy Control (GPC) signals as a request to opt out of the sale and sharing of personal information and of targeted advertising, and we respect Do Not Track signals. Because we do none of these things, both signals simply confirm what already happens. Our Cookie Policy has more.

European Economic Area

Under the General Data Protection Regulation (GDPR), BurTech Solution is the controller of the information described in section 4, and the legal bases we rely on are listed there. You have the right:

• of access to your personal data and to information about how we use it;
• to rectification of inaccurate or incomplete data;
• to erasure;
• to restriction of processing;
• to data portability;
• to object to processing based on our legitimate interests, at any time;
• to withdraw consent at any time, where we rely on it;
• not to be subject to a decision based solely on automated processing that significantly affects you (we make no such decisions);
• to lodge a complaint with a supervisory authority, in particular in the member state where you live, work or where you think the law was broken. The European Data Protection Board lists them.

We answer within one month. If a request is complex, the GDPR allows up to two further months; if we need them, we will tell you why within the first month.

United Kingdom

Under the UK GDPR and the Data Protection Act 2018, you have the same rights as described for the European Economic Area. You can complain to us first, and you can complain to the Information Commissioner's Office (ICO).

Switzerland

Under the revised Federal Act on Data Protection (FADP), you have the right to access your personal data, including information about the purpose of processing, how long it is kept, who receives it and the countries it goes to; to have inaccurate data corrected; to have data deleted or its processing stopped; to object to processing; to data portability; and to have a decision based solely on automated processing reviewed by a person (we make no such decisions). You can contact the Federal Data Protection and Information Commissioner (FDPIC).

Brazil

Under the General Data Protection Law (Lei Geral de Proteção de Dados, LGPD), you have the right to confirmation that we process your data; access to it; correction of incomplete, inaccurate or out-of-date data; anonymisation, blocking or deletion of data that is unnecessary, excessive or processed unlawfully; portability; deletion of data processed with your consent; information about the public and private entities we share it with; information about the possibility of refusing consent and its consequences; withdrawal of consent; and review of decisions made solely by automated processing (we make no such decisions). Our encarregado is our privacy officer, at [email protected]. We give a complete answer within 15 days. You can petition the Autoridade Nacional de Proteção de Dados (ANPD).

Australia

Under the Privacy Act 1988 and the Australian Privacy Principles, you have the right to access the personal information we hold about you and to ask us to correct it. Where it is practical, you may deal with us without giving your name or by using a pseudonym, although we need a name and an email address to answer you or give you an account. Personal information may be disclosed to recipients in Canada, in our hosting region, in the United States and in other countries where Cloudflare operates, as explained in section 9. Please complain to us first; we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).

New Zealand

Under the Privacy Act 2020, you have the right to access the personal information we hold about you and to ask us to correct it. We will answer an access or correction request within 20 working days, as the Act requires. If you are not satisfied, you can complain to the Privacy Commissioner.

India

Under the Digital Personal Data Protection Act 2023, as its provisions come into force, you have the right:

• to information: a summary of the personal data we process about you and how we process it, and the identities of the others with whom we have shared it;
• to correction, completion, updating and erasure of your personal data;
• to grievance redress: our privacy officer, at [email protected], will respond to your grievance;
• to nominate another person to exercise your rights if you die or become unable to do so.

After using our grievance process, you may complain to the Data Protection Board of India.

Japan

Under the Act on the Protection of Personal Information (APPI), you can ask us to disclose the retained personal data we hold about you, including records of any provision of it to third parties; to correct, add to or delete it; to stop using it or erase it; and to stop providing it to third parties, as the Act allows. You can also ask for information about the foreign countries where your data is processed and the protections there. You can contact the Personal Information Protection Commission.

Singapore

Under the Personal Data Protection Act 2012 (PDPA), you have the right to access your personal data and information about how it has been used or disclosed in the past year, to ask us to correct it, and to withdraw your consent. Our privacy officer acts as our data protection officer. You can complain to the Personal Data Protection Commission (PDPC).

South Korea

Under the Personal Information Protection Act (PIPA), you have the right to access your personal information, to have it corrected or deleted, to have its processing suspended, to withdraw your consent, and to refuse, or ask for an explanation of, a decision made by fully automated means (we make no such decisions). You can contact the Personal Information Protection Commission (PIPC) or apply to its Personal Information Dispute Mediation Committee.

South Africa

Under the Protection of Personal Information Act (POPIA), you have the right to be told when your personal information is collected; to access it; to ask for it to be corrected or deleted; to object to its processing; not to be subject to a decision based solely on automated processing (we make no such decisions); and not to receive direct marketing by electronic communication without your consent. Our Information Officer is our privacy officer, at [email protected]. You can complain to the Information Regulator.

Mexico

Under Mexico's federal law on the protection of personal data held by private parties, you have the "ARCO" rights: Access to your personal data, Rectification of inaccurate data, Cancellation (deletion) of your data, and Opposition to its processing for specific purposes. You can also withdraw your consent and ask us to limit how we use or disclose your data. We will tell you our decision within 20 business days and carry it out within 15 business days after that. If you are not satisfied, you can contact the federal authority responsible for personal data protection.

Everywhere else

Wherever you live, we extend the core rights in section 12 to you. We answer within the time your local law sets, or within 30 days if it sets none.

14. How to make a request

1. Write to us. Email [email protected], or use the contact form and choose the privacy topic. Tell us what you would like us to do and which email address or account the request concerns.
2. We confirm who you are. To protect your information, we check that the request comes from you, usually by asking you to confirm it from the email address we hold. If you are a User, write from your account's email address. We may ask for more details if we need them, but we use those details only to verify the request.
3. We answer. We answer within 30 days, or sooner if your local law requires it. Where a law allows more time for a complex request, we will tell you within the first 30 days if we need it, and why.

Requests are free. At least one request every 12 months is always free. Where a law allows us to charge a reasonable fee for, or to decline, requests that are clearly unfounded, excessive or repeated, we will explain why before we do so.

Someone else, such as an authorised agent, may make a request for you with your written permission (see the section for your state or country). We may ask you to confirm the request directly.

If your request is about Customer Data, which a business holds about you in Zamilo, we will tell you that the request belongs with that business, and we will help the business answer it.

15. Children

Zamilo is for business use only. It is not intended for anyone under 16, and we do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it.

16. Changes to this policy

When we change this policy, we update the version number and the effective date shown at the top of this page. If we make a material change, we will notify the admins of every Customer workspace by email before the change takes effect.

17. Contact us

For any question about this policy or about your personal information, write to our privacy officer at [email protected] or use the contact form.