ZTD OfficeLegal
Privacy Policy
1. Who we are
ZTD Office is a product of ZTD Devs Ltd, a company registered in England & Wales (company number 17348374, registered office Suite RA01, 195-197 Wood Street, London, E17 3NU). ZTD Devs Ltd provides the service and is responsible for the personal data described in this policy.
Questions about privacy: hello@ztdoffice.com.
2. Our two roles
Email in your mailboxes: we are a processor
When a business uses ZTD Office, the email, calendars, contacts and other content in its mailboxes belong to that business. The business is the controller of that data and ZTD Devs Ltd is its processor. We process it only on the business’s instructions, to provide the service, as set out in our Terms of Service.
If you have a question about how a business uses your email, contact that business. We will help them answer it.
Our own customer data: we are the controller
ZTD Devs Ltd is the controller for the personal data we collect to run our business: the people who contact us, our customers’ contacts and admins, and visitors to this website.
3. What we collect as controller, and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Name, email address, phone number and business details when you contact us | To reply and discuss the service with you | Legitimate interests |
| Customer contact and billing details | To provide the service, invoice and keep records | Contract; legal obligation (accounting records) |
| Control panel logins: name, email, password hash, two-factor settings, activity log | To let admins manage the service securely, and to keep an audit trail | Contract; legitimate interests (security) |
| Server logs: IP addresses, times, sign-in attempts, mail delivery records | To run the service, deliver mail, prevent abuse and investigate problems | Legitimate interests (security and service operation) |
| Support conversations | To help you and improve the service | Contract; legitimate interests |
We do not sell personal data, use it for advertising, or use email content to profile anyone. Spam filtering scans incoming mail automatically to protect the service and its users.
4. This website
This website sets no cookies and uses no analytics, tracking or third-party scripts. Our web server keeps standard logs (IP address, page requested, time, browser) for 14 days to keep the site secure. See the cookie notice.
5. Who we share data with
We use the following companies to run ZTD Office.
| Company | What they do for us | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts our mail servers and webmail (mailboxes, calendars, contacts) and the control panel | Helsinki, Finland (EU) |
| Amazon Web Services EMEA SARL (Amazon S3, Amazon SES) | Stores our nightly backups, encrypted before they leave our servers (Amazon S3). Will deliver outgoing email directly once we move from Resend during the pilot (Amazon SES) | London, UK (eu-west-2) |
| Resend, Inc. | Delivers outgoing email today (it sends through Amazon SES), until we move to our own Amazon SES account | Ireland (EU), via Amazon SES |
| Neon, Inc. | Database for the control panel (customer accounts, admin logins, settings) | United States (US East) |
| Stripe Payments Europe, Ltd. | Takes payments and stores card or bank details for billing (we never see full card numbers) | Ireland (EU) |
| Cloudflare, Inc. | DNS hosting for our own domains | Global network (United States company) |
We will tell customers before adding or replacing a sub-processor that handles mailbox data, so they can object. Email you send is, of course, delivered to the recipient’s own email provider.
We may also share data where the law requires it, or with professional advisers under a duty of confidentiality.
6. International transfers
Mailboxes are stored in the EU, which the UK recognises as providing adequate protection. Where a provider is based outside the UK and EU, we rely on the UK International Data Transfer Agreement or Addendum, or the UK–US Data Bridge where the provider is certified.
7. How long we keep data
- Mailbox content: for as long as the customer uses the service, then 30 days after it ends, then deleted. Copies in backups are deleted as those backups expire (after 12 months at most).
- Customer and billing records: 6 years after the end of the tax year, as UK law requires.
- Server and mail delivery logs: up to 90 days.
- Enquiries that don’t lead to a contract: 12 months.
8. Security
We protect data with encryption in transit (TLS), two-factor sign-in for admins, restricted server access, and a documented change process. Read more on our security page.
9. Your rights
Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to data portability. To use these rights, email hello@ztdoffice.com. We will reply within one month.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Changes
We will update this policy when how we handle data changes, and change the date at the top. We will tell customers about significant changes by email.