Review Our Terms

1. Acceptance of Terms

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Customer", "you") and ZSoftly Technologies Inc. ("ZSoftly", "we", "us") governing your access to and use of ZSoftly Cloud Platform ("ZCP") and all related services (collectively, the "Services").

By creating an account, accessing the Services, or clicking "I agree," you confirm that you have read, understood, and agree to be bound by these Terms and our Privacy Policy below. If you are accepting on behalf of a company or other legal entity, you represent that you have authority to bind that entity.

If you do not agree to these Terms, do not use the Services.

2. Definitions

Account

A registered ZCP account that enables access to the Services.

Customer Data

Any data, content, or workloads you store, process, or transmit using the Services.

Usage Data

Operational information about your use of the Services, including resource identifiers, resource names, IP addresses, regions, quotas, usage measurements, billing metrics, API activity, audit events, security events, system logs, performance metrics, configuration metadata, support metadata, and similar information generated by the management and operation of the Services. Usage Data does not include the contents of your files, virtual machine disks, object storage objects, databases, or application payloads.

Services

All ZCP platform services including virtual machines, object storage, block storage, Kubernetes, networking, observability, and related features as described at zcp.zsoftly.ca/services.

Service Level Agreement (SLA)

The uptime commitments and support response times applicable to your support tier, as published at zcp.zsoftly.ca/pricing.

Authorized User

Any individual you permit to access the Services through your Account.

End User

Any individual or entity that accesses, uses, or receives your applications, workloads, content, websites, APIs, or other services hosted on or connected to ZCP.

3. Account Registration and Eligibility

To use the Services, you must register for an Account. You represent that: (a) you are at least 18 years of age; (b) you have the legal capacity to enter into these Terms; (c) all registration information you provide is accurate and current; and (d) if registering on behalf of an organization, you are authorized to do so.

You are responsible for maintaining the security of your Account credentials, including passwords and API keys. You must immediately notify us at security@zsoftly.ca of any unauthorized access to your Account. We are not liable for losses resulting from unauthorized use of your credentials.

The Services are available to businesses and individuals worldwide. Use of the Services from jurisdictions where such use is prohibited by local law is at the Customer's own risk and responsibility.

4. Services

ZSoftly will make the Services available to you in accordance with these Terms and the applicable SLA for your support tier. We reserve the right to modify, update, or discontinue features of the Services with reasonable notice. Where commercially practicable, we will give you at least 30 days' notice of material changes that adversely affect your use.

Some Services may be subject to additional service-specific terms, technical limits, product documentation, or order forms. Those additional terms are incorporated into these Terms for the applicable Services. If there is a conflict, the service-specific terms control only for the affected Service.

Services marked as "Planned" are not yet available and carry no commitment as to availability date.

Beta and preview services. Services or features identified as beta, preview, experimental, early access, or similar are provided for evaluation only, are not recommended for production workloads, may be changed or discontinued at any time, and are excluded from SLA commitments unless we expressly state otherwise in writing. Customer Data used with beta or preview services may be deleted, reset, or become inaccessible as part of changes to those services.

4.1 Service-Specific Responsibilities

Compute and virtual machines. You are responsible for the operating systems, users, SSH keys, passwords, packages, applications, data, firewall rules, security groups, and other configuration inside or attached to your virtual machines, except to the extent ZSoftly expressly provides a managed service in writing. We may reboot, migrate, suspend, or otherwise change the placement of compute resources when reasonably necessary for maintenance, security, platform integrity, or legal compliance.

Object storage. You are responsible for bucket names, object names, access keys, access policies, public access settings, lifecycle rules, and the legality and security of objects you store. If you make a bucket or object public, you are responsible for all consequences of that public access.

DNS. You are responsible for domain ownership, registrar obligations, zone records, record accuracy, and ensuring your DNS use does not violate applicable law or third-party rights. ZSoftly is not responsible for third-party registrar failures, registry actions, or propagation delays outside our control.

Kubernetes. Unless ZSoftly expressly provides a managed Kubernetes service in writing, you are responsible for cluster workloads, namespaces, RBAC, secrets, images, ingress, network policies, application security, and any configuration you apply to your clusters.

5. Acceptable Use Policy

You agree not to use the Services to:

• Violate any applicable law or regulation, including Canadian criminal law, export control laws, and sanctions regimes
• Store, distribute, or transmit malware, ransomware, spyware, or other malicious code
• Launch or facilitate cyberattacks, including DDoS attacks, network scanning, or unauthorized access attempts against any system
• Generate, distribute, or facilitate unsolicited commercial email (spam)
• Mine cryptocurrency without explicit authorization from ZSoftly
• Host, store, or distribute child sexual abuse material (CSAM) or any content that sexually exploits minors
• Engage in or facilitate human trafficking, terrorism, or any activity prohibited under the Criminal Code of Canada
• Infringe the intellectual property rights of any third party
• Circumvent, disable, or otherwise interfere with security or access control features of the Services
• Resell or sublicense the Services without prior written authorization
• Use the Services in a manner that creates an unreasonable security, operational, legal, reputational, or network risk to ZSoftly, other customers, or third parties

We may suspend your Account or affected resources immediately and without prior notice if we have reasonable grounds to believe you are in violation of this Acceptable Use Policy, your Account is compromised, your use threatens the security or availability of the platform, your use causes or contributes to spam, malware, DDoS activity, scanning, fraud, sanctions risk, legal risk, excessive resource abuse, or harm to ZSoftly, other customers, or third parties, or suspension is required by law or lawful authority. We will notify you of the reason and provide an opportunity to respond unless disclosure is prohibited by law or would endanger persons, systems, investigations, or platform integrity.

You must promptly notify us at security@zsoftly.ca if you become aware of compromised credentials, exposed API keys, unauthorized access, abuse complaints, security incidents, or vulnerabilities affecting your Account or workloads. You agree to cooperate with reasonable investigation and remediation requests related to your Account, Authorized Users, End Users, or workloads.

6. Fees and Payment

6.1 Pricing and Currency

All fees are quoted and charged in Canadian dollars (CAD), inclusive of applicable Canadian taxes. Current prices are published at zcp.zsoftly.ca/pricing. We reserve the right to change prices with 30 days' notice.

6.2 Billing

On-demand compute resources are billed hourly and invoiced monthly in arrears. Reserved instances are billed monthly in arrears at the agreed reserved rate for the commitment term. Storage and networking are billed based on actual consumption measured over the billing period.

6.3 Payment

Invoices are due upon receipt. Unpaid invoices will incur interest at 1.5% per month (18% per annum) on outstanding balances. We reserve the right to suspend Services for accounts with invoices more than 15 days overdue after written notice.

If you provide a payment method, you authorize ZSoftly and our payment processor to charge that payment method for fees, taxes, overages, and other amounts due for the Services. You must keep billing and payment information accurate and current. Failed payments, chargebacks, or expired payment methods may result in suspension or termination of Services. You remain responsible for all fees incurred before suspension, termination, or account closure.

Except where required by law or expressly stated in an order form or promotional terms, fees are non-refundable and prepaid credits have no cash value.

6.4 Disputes

You must notify us in writing of any billing dispute within 60 days of the invoice date. We will investigate and respond within 15 business days. Undisputed amounts remain due during any dispute investigation.

6.5 Taxes

You are responsible for any taxes, duties, or levies imposed by your jurisdiction in connection with the Services, other than taxes on ZSoftly's income. Where required by law, we will collect and remit applicable Canadian taxes (GST/HST).

6.6 Launch Credits

Launch credits, where offered, apply to eligible Services during the promotional credit period specified at activation. Unused credits do not carry forward and have no cash value. Accounts that exceed the launch credit balance will be charged for overage at standard on-demand rates.

7. Service Levels

ZSoftly provides uptime commitments and support response times as described in our published SLA, which forms part of these Terms by reference. SLA credits are your sole and exclusive remedy for service interruptions, subject to the credit request procedures described in the SLA. SLA credits are not applicable to scheduled maintenance windows, outages caused by Customer actions, third-party services outside ZSoftly's control, or force majeure events.

YOW (Ottawa) region. We do not currently recommend the YOW region for production workloads. The YOW region operates out of ZSoftly office facilities rather than a commercial data centre and does not carry the compliance standards a commercial data centre provides, such as the facility serving our YUL (Montreal) region. For production workloads, use the YUL region.

8. Customer Data

Ownership. As between you and ZSoftly, you retain all right, title, and interest in and to your Customer Data. These Terms do not grant ZSoftly any ownership rights in your Customer Data.

License to ZSoftly. You grant ZSoftly a limited, non-exclusive license to host, store, copy, and transmit Customer Data solely as necessary to provide the Services to you.

Access. ZSoftly personnel will not access your Customer Data except: (a) with your explicit consent; (b) as required to provide technical support at your request; (c) as required by law; or (d) to investigate suspected violations of these Terms that pose a risk to the platform or other customers.

Responsibility. You are solely responsible for the legality, accuracy, quality, and integrity of your Customer Data, and for ensuring you have all rights necessary to submit it to the Services.

Usage Data. ZSoftly may collect and use Usage Data to operate, secure, monitor, bill, support, troubleshoot, maintain, improve, and plan the Services; detect and prevent fraud, abuse, and security incidents; comply with legal obligations; and create aggregated or anonymized reports and analytics. You should not include personal, confidential, or sensitive information in resource names, tags, labels, metadata, access policy names, support ticket subjects, or similar operational fields unless necessary for your use of the Services.

Authorized Users and End Users. You are responsible for all activity under your Account, including activity by your Authorized Users, employees, contractors, agents, customers, End Users, API keys, access tokens, and workloads. You are responsible for ensuring that your Authorized Users and End Users comply with these Terms and applicable law.

Backups and exports. Unless you have purchased or enabled a specific ZSoftly backup, snapshot, replication, or disaster recovery service, you are responsible for maintaining independent backups and exports of Customer Data. Backup, snapshot, replication, or retention features, where available, are not a substitute for your own disaster recovery planning. ZSoftly is not responsible for data loss caused by your deletion, misconfiguration, compromised credentials, application behavior, failure to maintain backups, or failure to export Customer Data before termination or closure of Services.

9. Security

ZSoftly maintains a security program aligned with ISO/IEC 27001:2022, including encryption in transit and at rest, access controls, continuous monitoring, and incident response procedures. Our current certifications and audit reports are available upon request under NDA.

ZCP follows a shared responsibility model. ZSoftly is responsible for securing the platform components we operate, including the control plane, host infrastructure, physical facilities, and managed service layers we expressly provide. You are responsible for securing what you deploy or configure on the Services, including Account credentials, API keys, access tokens, SSH keys, operating system users, firewall rules, access policies, applications, dependencies, data classification, application-layer encryption, and workload backups.

10. Export Controls and Sanctions

You represent that you and your Authorized Users are not located in, organized under the laws of, or ordinarily resident in a jurisdiction subject to comprehensive trade sanctions, and are not listed on any applicable restricted party, denied party, sanctions, or similar government list. You must not allow access to the Services by any person or entity prohibited by applicable export control, sanctions, or trade compliance laws.

You are responsible for complying with all applicable export, re-export, import, sanctions, and trade control laws in connection with your use of the Services, including laws applicable to software, encryption, technical data, and controlled workloads. You must not use the Services to export, re-export, transfer, or make available controlled software, technology, data, or services in violation of applicable law.

11. Intellectual Property

ZSoftly and its licensors retain all intellectual property rights in the Services, including the software, documentation, user interface, and branding. Nothing in these Terms transfers any ZSoftly intellectual property to you.

The Services are built on open-source software licensed under their respective open source licenses. Nothing in these Terms restricts your rights under those licenses.

If you provide ideas, suggestions, bug reports, feature requests, or other feedback about the Services, you grant ZSoftly a perpetual, irrevocable, worldwide, royalty-free license to use, modify, and incorporate that feedback into our products and services without restriction or obligation to you.

12. Confidentiality

Each party agrees to keep confidential any non-public information of the other party that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information ("Confidential Information"). Each party will use the other's Confidential Information only to exercise its rights and fulfill its obligations under these Terms, and will protect it using at least the same degree of care it uses for its own confidential information, and no less than reasonable care.

Confidential Information does not include information that: (a) is or becomes publicly available without breach of this section; (b) was rightfully known without restriction before disclosure; or (c) is required to be disclosed by law or court order, provided the disclosing party gives reasonable prior notice where legally permitted.

13. Disclaimers

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ZSOFTLY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. ZSOFTLY DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS. YOUR USE OF THE SERVICES IS AT YOUR SOLE RISK, SUBJECT TO THE SLA COMMITMENTS IN YOUR SUPPORT TIER.

14. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ZSOFTLY'S TOTAL CUMULATIVE LIABILITY TO YOU ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICES, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, WILL NOT EXCEED THE GREATER OF: (A) THE TOTAL FEES YOU PAID TO ZSOFTLY IN THE THREE (3) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM; OR (B) ONE THOUSAND CANADIAN DOLLARS (CAD $1,000).

IN NO EVENT WILL ZSOFTLY BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING LOSS OF PROFITS, LOSS OF DATA, LOSS OF BUSINESS, OR BUSINESS INTERRUPTION, EVEN IF ZSOFTLY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Some jurisdictions do not allow the exclusion or limitation of certain damages. In such jurisdictions, ZSoftly's liability is limited to the greatest extent permitted by law.

Except for claims related to non-payment, misuse of ZSoftly intellectual property, or indemnification obligations, no claim arising out of or related to these Terms or the Services may be brought more than two (2) years after the event giving rise to the claim.

15. Indemnification

You agree to defend, indemnify, and hold harmless ZSoftly and its officers, directors, employees, and agents from any claim, demand, loss, liability, or expense (including reasonable legal fees) arising from: (a) your use of the Services in violation of these Terms; (b) your Customer Data; (c) your Authorized Users, End Users, applications, workloads, or public-facing services; (d) your violation of any applicable law; (e) your breach of security or unauthorized access caused by your credentials, systems, or configurations; or (f) your infringement or misappropriation of any third-party right.

16. Term and Termination

These Terms are effective from the date you create an Account and continue until your Account is closed.

Termination by you. You may close your Account and terminate these Terms at any time by deleting your Account through the portal or by written notice to info@zsoftly.ca. You remain responsible for all fees incurred up to the date of termination.

Termination by ZSoftly. We may terminate your Account for cause (material breach of these Terms, non-payment, or AUP violation) with 15 days' written notice and an opportunity to cure, except in cases of serious AUP violations (e.g., CSAM, cyberattacks) where we may terminate immediately.

Effect of termination. Upon termination, your right to access the Services ceases. Your Customer Data will be retained for 30 days to allow export, after which it will be deleted from active systems within 30 days and from backups within 90 days, unless a longer retention is required by law.

Sections that by their nature should survive termination will survive, including provisions relating to fees owed, Customer Data responsibility, Usage Data, intellectual property, confidentiality, disclaimers, limitation of liability, indemnification, dispute resolution, and general provisions.

17. Governing Law and Dispute Resolution

These Terms are governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of law principles.

Informal resolution. Before initiating formal proceedings, both parties agree to attempt good-faith resolution by notifying the other party in writing of the dispute and allowing 30 days to resolve it.

Jurisdiction. If the dispute cannot be resolved informally, each party submits to the exclusive jurisdiction of the courts of the Province of Ontario, Canada.

Waiver of class actions. To the extent permitted by applicable law, any claims must be brought in an individual capacity and not as a plaintiff or class member in any purported class proceeding.

18. Modifications

We reserve the right to modify these Terms at any time. We will email registered account holders about material changes at least 30 days before the effective date. Your continued use of the Services after the effective date constitutes acceptance of the modified Terms. If you do not agree to the modified Terms, you must close your Account before the effective date.

19. General Provisions

Entire Agreement

These Terms, together with our Privacy Policy and any order forms or SOWs, constitute the entire agreement between you and ZSoftly regarding the Services and supersede all prior agreements.

Order forms and customer documents

No purchase order, vendor registration form, procurement portal term, invoice note, or other customer-supplied document modifies these Terms unless signed by an authorized representative of ZSoftly.

Severability

If any provision of these Terms is found unenforceable, the remaining provisions will continue in full force and effect.

Waiver

Failure to enforce any provision of these Terms does not constitute a waiver of the right to enforce it in the future.

Assignment

You may not assign these Terms without our prior written consent. ZSoftly may assign these Terms in connection with a merger, acquisition, or sale of substantially all assets.

Force Majeure

Neither party is liable for delays or failures in performance resulting from events beyond their reasonable control, including natural disasters, governmental actions, or telecommunications failures.

Notices

Legal notices to ZSoftly must be sent to legal@zsoftly.ca or by registered mail to our Ottawa address. Notices to you will be sent to the email address on your Account.

Language

These Terms are written in English. Any translation is for convenience only. In the event of conflict, the English version prevails.

Relationship

The parties are independent contractors. These Terms do not create a partnership, joint venture, agency, fiduciary, franchise, or employment relationship.

No third-party beneficiaries

These Terms do not create rights for any person or entity that is not a party to these Terms.

Interpretation

The words "including" and "such as" mean "including without limitation." Section headings are for convenience only and do not affect interpretation.

Account Credit, Promotional Terms

ZSoftly offers new ZCP customers up to $300 CAD in account credit. This offer is available until December 31, 2026. The following terms apply.

1. Who qualifies. New ZCP accounts only. One credit per organization.
2. Account activation. Creating an account requires a minimum payment of $1.00 CAD, used to verify and validate your account. The amount you add is credited to your account as infra credit that you can spend.
3. Sign-up credit. $100 CAD is applied to your account automatically at sign-up and is valid for 30 days from the date it is issued.
4. Spend bonus. After you spend $200 CAD on eligible Services, you may request an additional $200 CAD credit by emailing info@zsoftly.ca from your account email address with your account number and the subject “$200 Credit Request”. Once applied, this credit is valid for 60 days, for up to $300 CAD in total credit.
5. Offer period. This promotion is available until December 31, 2026. Bonus credit must be requested on or before December 31, 2026. Unused credit expires at the end of its validity period and has no cash value.
6. Eligible plans. Credit applies to Small, Medium, Large, and XLarge compute plans only, plans CI1-1, CI1-2, CI1-4, and CI1-8 (and their CA1 / CA2 equivalents), currently priced from $12/mo to $96/mo on-demand.
7. Plans not covered. Credit cannot be applied to plans CI1-16 / CA1-16 / CA2-16 or larger, private cloud services, professional services, or managed infrastructure services.
8. Other restrictions. No cash value. Non-transferable. Cannot be combined with other promotions or discounts. Standard rates apply after the credit is exhausted or expires.

Questions about this offer? Email info@zsoftly.ca.

1. About This Policy

ZSoftly Technologies Inc. ("ZSoftly", "we", "us", or "our") is a Canadian corporation incorporated under the laws of Canada, headquartered at 116 Albert Street, Suite 300, Ottawa, Ontario, K1P 5G3.

This Privacy Policy describes how we handle personal information in connection with ZSoftly Cloud Platform ("ZCP"), our website at zcp.zsoftly.ca, the self-service portal at cloud.zcp.zsoftly.ca, and any related services (collectively, the "Services").

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Loi 25), and other applicable Canadian privacy legislation. Where Law 25 imposes stricter obligations than PIPEDA, we apply the stricter standard.

By using our Services, you acknowledge that you have read and understood this Policy.

2. Privacy Officer

We have designated a Privacy Officer who is accountable for our compliance with this Policy and applicable privacy legislation. To reach our Privacy Officer:

3. Personal Information We Collect

We collect personal information only to the extent necessary to provide our Services.

3.1 Account and Identity Information

When you register for an account, we collect your first and last name, work email address, company or organization name, and job title (optional). This information is required to create and administer your account.

3.2 Billing and Payment Information

We collect billing contact details (name, address) and payment method information to process charges for the Services. Our payment processor processes and stores payment card data. We do not store it on ZSoftly systems. We retain records of transactions, invoices, and billing history as required for accounting and legal purposes.

3.3 Usage and Technical Data

We automatically collect data about how you interact with our Services, including IP addresses, browser type, device and operating system information, pages visited, features used, timestamps of portal activity, API activity, audit events, security events, resource identifiers, resource names, IP addresses assigned to resources, regions, quotas, usage measurements, billing metrics, system logs, performance metrics, configuration metadata, and support metadata. This data is used for service operation, billing, security monitoring, abuse prevention, troubleshooting, support, capacity planning, and service improvement.

3.4 Communications

When you contact us by email, through our contact form, or by opening a support ticket, we retain the content of those communications, your contact information, and records of our responses.

3.5 Customer Data

You may store, process, or transmit data on ZCP infrastructure as part of using the Services ("Customer Data"). Customer Data is yours. We do not access, use, or disclose Customer Data except as necessary to deliver the Services, comply with a legal obligation, or respond to your support requests. Customer Data is not used to train models or for our commercial purposes.

3.6 Social Login and Authentication Providers

If you choose to sign in using a third-party identity provider, we may receive information from that provider such as your name, email address, provider account identifier, profile image, organization information, and authentication tokens or assertions needed to authenticate you and maintain your session. Your use of the third-party identity provider remains subject to that provider's own terms and privacy policy.

3.7 CAPTCHA and Abuse Prevention

We may use CAPTCHA, bot detection, fraud prevention, and security challenge providers to protect the Services from automated abuse, credential attacks, spam, and malicious activity. These providers may process IP addresses, browser and device signals, interaction data, and security challenge results for abuse prevention and service security.

4. How We Use Your Information

We use personal information for the following purposes, which we identify at or before the time of collection:

• Provisioning and operating the Services you have requested
• Processing payments and issuing invoices
• Authenticating your identity and maintaining account security
• Providing technical support and responding to inquiries
• Sending transactional communications (invoices, security alerts, service notices)
• Monitoring for security incidents, fraud, and abuse
• Measuring usage, calculating charges, enforcing quotas, and planning capacity
• Investigating support requests, service incidents, and performance issues
• Complying with legal and regulatory obligations
• Enforcing our Terms of Service
• Improving and developing the Services (using aggregated and anonymized data)

We will not use your personal information for purposes other than those identified above without first obtaining your consent, unless required or permitted by law.

5. Consent

We obtain your consent at or before the time of collection. By registering for the Services, you consent to the collection, use, and disclosure of your personal information as described in this Policy. You may withdraw consent at any time, subject to legal and contractual restrictions, by contacting our Privacy Officer. Withdrawal of consent may affect our ability to provide the Services to you.

For optional communications such as product announcements and newsletters, we obtain express opt-in consent and honor opt-out requests promptly.

6. Disclosure of Personal Information

We do not sell your personal information. We may disclose it only in the following circumstances:

6.1 Service Providers

We engage third-party service providers who process personal information on our behalf, including payment processing, transactional email delivery, CAPTCHA and abuse prevention, identity and social login, support, monitoring, logging, security, analytics, and infrastructure tooling. Each provider is bound by contractual privacy and security obligations consistent with this Policy and applicable law.

Our current categories of sub-processors include:

You may request additional information about current sub-processors, processing locations, and foreign service providers by contacting our Privacy Officer.

6.2 Legal Requirements

We may disclose personal information when required by law, court order, or lawful government authority. Where legally permissible, we will notify you before complying with such a request.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal information may be transferred as part of that transaction. We will notify affected individuals and provide an opportunity to withdraw consent before personal information is subject to a materially different privacy policy.

7. Data Residency

All ZCP infrastructure is located in Canada, in facilities we operate or colocate in. Personal information we collect and Customer Data you store on ZCP are held in Canada. We do not transfer personal information outside Canada except where a service provider operates in another jurisdiction, in which case we contractually require that provider to protect your information to a standard equivalent to Canadian law.

You may request information about where your personal information is held and the identities of any foreign service providers by contacting our Privacy Officer.

If you are located outside Canada, you understand that your personal information may be processed in Canada, where privacy laws may differ from those in your jurisdiction. Where required by applicable law, we use appropriate contractual, organizational, and technical safeguards for cross-border processing.

8. Retention

We retain personal information only as long as necessary for the purposes for which it was collected, or as required by law:

When Customer Data is deleted by you or following account termination, we delete it from active systems within 30 days and from backups within 90 days, unless a longer retention is required by law.

9. Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the personal information we hold. Our security program is aligned with ISO/IEC 27001:2022 and includes:

• Encryption of personal information in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls with principle of least privilege
• Multi-factor authentication on all administrative access
• Continuous security monitoring and intrusion detection
• Regular vulnerability assessments and penetration testing
• Formal incident response and breach notification procedures
• Employee security training and background screening
• Physical security controls at our hosting facilities

No security measure is perfect. In the event of a privacy breach that creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required by PIPEDA's breach reporting regulations (SOR/2018-64), and notify the Commission d'accès à l'information du Québec (CAI) as required by Law 25, within the legally prescribed timeframes.

10. Your Privacy Rights

10.1 Under PIPEDA (Federal)

You have the right to:

• Know what personal information we hold about you
• Access your personal information and receive a copy
• Challenge the accuracy and completeness of your information and have it corrected
• Know how your information has been used and to whom it has been disclosed
• Withdraw consent to the use and disclosure of your information
• Lodge a complaint with the Office of the Privacy Commissioner of Canada

10.2 Under Quebec Law 25 (Loi 25)

If you are a Quebec resident, you additionally have the right to:

• Data portability: receive your personal information in a commonly used, structured, technological format
• Deindexation: request that hyperlinks providing access to your information be deindexed, where applicable
• Automated decision review: be informed of and contest any decision made solely by automated means
• Lodge a complaint with the Commission d'accès à l'information du Québec (CAI)

To exercise any of these rights, contact our Privacy Officer at privacy@zsoftly.ca. We will respond within 30 days. If we are unable to fulfill a request, we will explain why in writing.

11. Cookies and Analytics

Our marketing website uses self-hosted Umami Analytics, which collects anonymized, aggregate usage data without the use of cookies and without collecting personally identifiable information.

Our marketing website also uses third-party marketing analytics and lead-attribution services, currently DS360 (Lead Onion) and Zymplify, to understand how visitors discover and engage with us. These services may set cookies and process information such as your IP address, device and browser characteristics, pages viewed, and referral source. We use them for marketing measurement and lead attribution, not for third-party behavioural advertising, and we do not sell your personal information. You can block these cookies through your browser settings without affecting your use of the Services.

The self-service portal may use session cookies strictly necessary for authentication, security, account management, CAPTCHA or abuse prevention, and service operation. These cookies are not used for third-party advertising. They expire at the end of your session or within 24 hours unless a longer duration is necessary for security or account functionality.

12. Children's Privacy

The Services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected such information, we will delete it promptly. Contact our Privacy Officer if you believe a minor's information has been submitted to us.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by posting the revised Policy on this page with an updated effective date, and by email notification to registered account holders at least 30 days before the changes take effect. Continued use of the Services after the effective date constitutes acceptance of the revised Policy.

14. Filing a Complaint

We take privacy concerns seriously. If you believe we have not handled your personal information in accordance with this Policy or applicable law, please contact our Privacy Officer first. If you are not satisfied with our response, you may file a complaint with: