Who we are
ZDNS Protective DNS ("ZDNS", "we") is a DNS security service for South African businesses, run by ZDNS (Pty) Ltd (registration number 2026/796623/07), First Floor, Liberty Life Building, 21 Aurora Drive, Umhlanga Ridge, Durban. Our Information Officer is Oscar Matthew (Information Regulator registration 2026-068699), reachable at admin@zdns.co.za.
We hold personal information in two different roles. For our website visitors and for our customers' account and billing details, we are the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). For the DNS lookups that come from a customer's network, the customer is the responsible party and we process the lookups on its behalf as its operator, under our Data Processing Agreement.
What we collect and why
| What | Details | Why we need it | How long we keep it |
|---|---|---|---|
| Lookup records from a customer's network | The domain name asked for, the time, what ZDNS did (allowed, blocked, or recorded in shadow mode), the type of finding, and the customer's registered public IP address. Dashboards and reports show the computer that made a lookup only as a keyed hash that cannot be turned back into its address. Card and ID numbers found inside a name are shown masked. | To detect and block data leaving the customer's network, and to show the customer what was found. | 90 days, then deleted automatically. |
| Account details | Company name, contact name, email address, phone number, number of seats, registered public IP addresses, the customer's whitelist, and login email. Passwords are stored as one-way hashes. | To run the account and contact the customer about alerts, billing and changes. | While the account is active, and 12 months after it ends. |
| Payment information | For card payments, our payment provider handles the card. We receive confirmation that a payment was made, the amount, a reference and the email used, and we never see or store card numbers. So that later months can be charged automatically, the payment provider also gives us a reusable reference for the card, and we keep the card type, last four digits and expiry date so you can see which card is on file. For EFT, the payment reaches our bank account with the payer's name, the amount and the reference, and we record only which invoice was paid and when. | To take payment and keep tax and accounting records. | Payment records: 5 years, as the law requires for accounting records. The saved-card reference and card details: until you remove the card or the account is cancelled. |
| Messages to us | Chats with our sign-up assistant, the contact and partner forms (name, company, email, number of seats), and emails to admin@zdns.co.za. | To answer questions and set customers up. | Assistant chats: 30 days. Forms and emails: 12 months. |
| Businesses we contact | A business's name and website, and a general business email address (such as info@ or sales@) that it publishes on its own website, plus any reply. We do not use personal email addresses for this. | To send one email asking whether the business would like to hear about ZDNS, as POPIA section 69 allows. We send nothing further unless they say yes. Anyone who replies "stop" or uses the unsubscribe link is never contacted again. | 12 months after our last contact, then deleted. An address that asked not to be contacted stays on our do-not-contact list, so that we never email it again. |
| Website sign-in | A session cookie that keeps you logged in for up to 24 hours. On the sign-up and partner pages, Google reCAPTCHA may also set its own cookie for the bot check. We use no analytics or advertising cookies. | To keep accounts secure. | Until you log out or it expires. |
| Telegram (optional) | If a customer connects Telegram: the chat identifier and the alerts and replies the bot sends. Telegram handles these under its own terms. | To send alerts and answer commands in the chat the customer chose. | Until the customer disconnects the chat. |
We collect this under POPIA's grounds of performing our contract with the customer, our legitimate interest in running a secure service, and legal obligations such as tax records. We do not sell personal information and we do not use lookup records for advertising. We may use totals that identify no customer, such as the number of lookups checked, to describe and improve the service.
Who we share it with, and where it goes
We use service providers to run ZDNS. They handle personal information only to do the job we give them, under a written agreement. By type they are:
- hosting and servers, in South Africa (Johannesburg)
- card payment processing
- email delivery for alerts and reports
- cloud storage and processing of lookup records, outside South Africa
- an AI service that answers questions in our sign-up chat (it receives what visitors type in that chat), and that helps us research businesses from their public websites and draft our emails and posts; it never receives lookup records
- email routing for messages sent to admin@zdns.co.za
- a list of known dangerous sites (Google Web Risk): to check a site name, our servers send Google at most a short fragment of a scrambled code made from the name, never the name itself or who looked it up
- a bot check on the sign-up and partner forms (Google reCAPTCHA), which looks at the visit (such as the browser, the IP address and how the page was used) to tell people from automated programs
- Telegram, only if a customer connects it
A current list of the named providers is available on request. Some of them, including cloud storage, email delivery, the bot check and the AI service, process information outside South Africa, mainly in the United States and the European Union. Where that happens we send information only to providers bound by an agreement or law that protects it to a standard similar to POPIA's, as POPIA section 72 requires.
If an IT partner (MSP) set up a customer's account, that partner can see the customer's dashboard and alerts. We also disclose information when a court, regulator or other law requires it.
How we protect it
- Each customer can see only its own account.
- The website and portal use encrypted connections, and passwords are stored as one-way hashes.
- Computer addresses in dashboards and reports appear only as keyed hashes, and card and ID numbers appear masked.
- Access to systems is limited to people at ZDNS who need it. The database is backed up every 6 hours, and backups older than 7 days are deleted.
No system is perfectly secure. If someone gets at personal information we hold, we will tell the affected customers and the Information Regulator as soon as reasonably possible, as POPIA section 22 requires, and say what happened and what to do.
Your rights and how to complain
You can ask us whether we hold personal information about you, ask for a copy, ask us to correct it, and ask us to delete it where the law allows. Write to admin@zdns.co.za and we will answer within 30 days.
If your employer's network is protected by ZDNS, your employer decides what happens to those lookup records. Ask your employer first, and we will help it answer you.
If you are not happy with how we handled your information, you can complain to the Information Regulator (South Africa) at www.inforegulator.org.za. ZDNS is for businesses and is not meant for anyone under 18.
We will update this policy when what we do changes, show the date at the top, and email customers about important changes.