Parties, roles and what this covers
This agreement is between the customer named in the signatures below (the "Customer") and ZDNS (Pty) Ltd, registration number 2026/796623/07 ("ZDNS"). It sits alongside the ZDNS Terms of Service.
Under the Protection of Personal Information Act 4 of 2013 (POPIA), the Customer is the responsible party for personal information in the DNS lookups made from its network, and ZDNS is its operator. POPIA section 21 requires this agreement in writing. For account, billing and website information, ZDNS is the responsible party and the Privacy Policy applies instead.
What is covered is described in Annex A.
What ZDNS may and may not do with the data
ZDNS will process the lookup data only to provide the service in the Terms of Service: to check lookups, block or record them, and show the Customer the results. It will not use the data for any other purpose, sell it, or share it except as this agreement allows. ZDNS may use totals that identify no customer, such as counts of lookups checked.
ZDNS will treat the data as confidential, and everyone at ZDNS who can reach it is bound to keep it so. If an instruction from the Customer would break the law, ZDNS will say so and may decline it.
Security, sub-operators and data leaving South Africa
ZDNS keeps the data safe with at least these measures: each customer sees only its own data; the portal uses encrypted connections; passwords are stored as one-way hashes; computer addresses appear in dashboards and reports only as keyed hashes; card and ID numbers appear masked; and access is limited to people at ZDNS who need it. The database is also backed up every 6 hours, and backups older than 7 days are deleted.
ZDNS may use sub-operators for hosting, payments, email delivery, cloud storage and processing, an AI service and, if the Customer connects it, Telegram. They are listed by type in the Privacy Policy and by name on request. ZDNS will bind each to terms that protect the data to the same standard, and stays responsible to the Customer for them.
The data is hosted in South Africa. Copies are also stored and processed by cloud sub-operators outside South Africa, mainly in the United States and the European Union, and ZDNS will make sure each such transfer meets POPIA section 72.
Breaches, requests from individuals, audits
If ZDNS has reasonable grounds to believe someone has got at the Customer's data without authority, it will tell the Customer within 48 hours of finding out, say what it knows, and help the Customer meet its duty under POPIA section 22 to notify the Information Regulator and the people affected.
If a person asks ZDNS about their own lookup records, ZDNS will send them to the Customer and will help the Customer answer within the time the law allows. Once a year, or after a breach, ZDNS will answer the Customer's reasonable written questions about how it protects the data.
Breach notices, requests from individuals and any questions about this agreement go to ZDNS at admin@zdns.co.za. The Customer should give ZDNS an email address for the same purpose.
When the service ends: return and deletion
On request within 30 days after the service ends, ZDNS will give the Customer a copy of its reports. Within 90 days it will delete or irreversibly de-identify the Customer's lookup data and confirm that in writing if asked. Blocked-lookup records are deleted automatically after 90 days in any case, including the copies in cloud storage.
ZDNS may keep what the law requires, such as invoices and payment records, for as long as the law requires.
Annex A: description of the processing
| Item | Detail |
|---|---|
| What it is for | Checking the DNS lookups from the Customer's network, blocking or recording suspicious ones, and showing the results. |
| How long | While the Customer uses the service, then as set out under the end of the service. |
| What is processed | The domain name asked for, the time, what ZDNS did, the type of finding, the Customer's registered public IP address, and a keyed hash of the computer that made the lookup. Domain names can reveal which sites and services people use. Card and ID numbers found inside a name are masked in dashboards, reports and alerts. |
| Whose information | People who use the Customer's network, such as employees, contractors and visitors, and the Customer's IT contacts. |
| What ZDNS does not see | Web pages, emails and files. |
Annex B: a notice the Customer can give its staff
The Customer must tell the people on its network that their lookups are recorded. This wording can be used or adapted.
Our network uses a DNS security service. It records the names of the websites and services that devices on our network ask for, the time, and whether the request was allowed or blocked. It does not see web pages, emails or files. We use this to protect the business from data theft and malware. Records are kept for 90 days, and can be seen by our IT team and by our service provider acting for us. Questions: [the Customer's contact name and email].
Signatures
| Customer | ZDNS | |
|---|---|---|
| Name | Oscar Matthew | |
| Position | Director | |
| Signature | ||
| Date |