Privacy Policy

Zero Day IT 365 Inc. ("Zero Day IT 365", "we", "us", or "our") is a business-to-business (B2B) distributor of enterprise information technology products and managed security services, incorporated and operating in Canada. We serve clients across Canada, the United States, and internationally.

Data Controller Contact:
Zero Day IT 365 Inc. - Privacy Officer
Email: privacy@zerodayit365.com
Phone: 1-866-767-4335

2.1 Information You Provide Directly

• Account Registration: Full name, business name, job title, email address, phone number, business address, and password (hashed and salted).
• Request for Quote (RFQ): Company name, contact details, product requirements, budget range, and timeline.
• Order Placement: Billing address, shipping address, contact person, purchase order reference, and payment information.
• Newsletter & Marketing: Email address and communication preferences.
• Support & Managed Services: Network topology information, device credentials (encrypted), support ticket details, and diagnostic logs shared by you.
• Contact Forms: Name, email, phone, company, and the content of your inquiry.

2.2 Information Collected Automatically

• Usage Data: Pages visited, time on site, referring URL, browser type, operating system, device type, and IP address.
• Cookies & Tracking Technologies: Session cookies, persistent cookies, pixel tags, and local storage. See Section 8 for details.
• Transaction Logs: Order history, quote history, pricing viewed, products added to cart, and checkout activity.
• Communication Records: Emails and chat messages with our team may be stored for quality and compliance purposes.

2.3 Information from Third Parties

• Vendor partner portals (e.g., Fortinet, Cisco, Palo Alto) when registering deals or warranties on your behalf.
• Payment processors (Stripe) - we receive a tokenized reference and last four digits only; full card data never touches our servers.
• Shipping and logistics partners who confirm delivery status.
• Publicly available business directories for account verification purposes.

We use personal information for the following purposes, each grounded in a legitimate legal basis:

• Order Fulfillment (Contract Performance): Processing purchases, issuing invoices, arranging shipping, and managing returns or warranty claims.
• Quote Management (Contract Performance): Preparing, sending, and following up on Requests for Quote.
• Account Management (Contract Performance): Maintaining your account, authenticating your identity, and enabling order history access.
• Managed Services Delivery (Contract Performance): Configuring, monitoring, and supporting managed firewall, SOC, and infrastructure services under your SOW.
• Communications (Legitimate Interest / Consent): Sending order confirmations, shipping updates, product availability notices, and quote follow-ups.
• Marketing (Consent): Sending newsletters, product announcements, promotional offers, and security advisories - only where you have opted in or where permitted by applicable law for existing customers.
• Security & Fraud Prevention (Legitimate Interest / Legal Obligation): Detecting fraudulent transactions, unauthorized account access, and abuse of our platform.
• Legal Compliance (Legal Obligation): Retaining transaction records for tax, customs, and regulatory purposes; responding to lawful government requests.
• Platform Improvement (Legitimate Interest): Analysing site usage to improve our catalogue, search, and user experience.
• Vendor Deal Registration (Consent / Legitimate Interest): Registering deals with manufacturer partner portals to secure authorized reseller pricing on your behalf.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We may share your data with:

• Payment Processors: Stripe Inc. processes card payments. Your payment data is governed by Stripe's Privacy Policy and PCI-DSS compliance framework.
• Shipping & Logistics Partners: Courier and freight companies receive your name, company, and shipping address to deliver orders.
• Cloud Infrastructure Providers: Our platform is hosted on Vercel (frontend) and cloud-based PostgreSQL. These providers are bound by data processing agreements.
• Vendor Partners: Fortinet, Cisco, Palo Alto, HPE, and other manufacturers receive deal registration and warranty information only as required to process your orders and validate authorized pricing.
• Professional Service Providers: Accounting, legal, and IT security firms engaged under confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all assets, your information may be transferred as part of that transaction, subject to equivalent privacy protections.
• Law Enforcement & Legal Authorities: Where required by applicable law, court order, or regulatory requirement, or to protect the rights, property, or safety of Zero Day IT 365, our clients, or the public.

We retain personal information for as long as necessary to fulfil the purposes described in this policy, subject to the following retention schedules:

• Active Accounts: Data is retained while your account remains active. You may request deletion at any time.
• Transaction Records: Order, invoice, and payment records are retained for seven (7) years for tax, customs, and accounting compliance under Canadian federal and provincial law.
• Quote & RFQ Records: Retained for three (3) years for business continuity and dispute resolution.
• Managed Services Logs: Network and security logs are retained according to the terms of your individual SOW, typically 90 days to 1 year.
• Marketing Preferences: Retained until you opt out, after which we retain a record of the opt-out for compliance purposes.
• Deleted Accounts: Account data is purged within 90 days of deletion, except where retention is required by law.

We use the following types of cookies and tracking technologies:

• Strictly Necessary Cookies: Required for authentication, session management, and shopping cart functionality. These cannot be disabled.
• Analytics Cookies: Aggregated, anonymized data about site usage to help us improve performance. We use privacy-respecting analytics tools.
• Preference Cookies: Remember your currency selection (CAD/USD), language, and display preferences.
• Marketing Cookies: Used only with your consent to track effectiveness of advertising campaigns. We do not use invasive third-party ad trackers by default.

You may manage cookie preferences through your browser settings or our cookie consent tool. Disabling strictly necessary cookies may affect your ability to use core features of our platform.

For full details, see our Cookie Policy.

We implement industry-standard technical and organizational security measures including:

• Encryption in Transit: All data transmitted between your browser and our platform is protected by TLS 1.2/1.3 (HTTPS).
• Encryption at Rest: Sensitive database fields and stored files are encrypted using AES-256.
• Password Security: Passwords are hashed using bcrypt with per-user salts. We never store plaintext passwords.
• Access Controls: Role-based access controls (RBAC) ensure employees only access data necessary for their role. Administrative access requires multi-factor authentication.
• Payment Security: We are PCI-DSS compliant through our payment processor (Stripe). Full card numbers are never stored on our systems.
• Vendor Security: Third-party service providers are evaluated for security practices and bound by data processing agreements.
• Incident Response: We maintain an incident response plan. In the event of a data breach affecting your rights and freedoms, we will notify you and applicable regulators within the timeframes required by law (72 hours under GDPR; as required under PIPEDA).

No security measure is 100% foolproof. If you suspect unauthorized access to your account, contact us immediately at security@zerodayit365.com.

Depending on your jurisdiction, you may have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention obligations.
• Right to Restrict Processing: Request that we limit processing of your data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Rights Related to Automated Decision-Making: We do not make solely automated decisions that produce significant legal effects on you.

Canadian Residents (PIPEDA / Quebec Law 25): You have the right to access your personal information, challenge its accuracy, and withdraw consent. Quebec residents have additional rights under Law 25 including the right to data portability and the right to de-indexation.

California Residents (CCPA/CPRA): You have the right to know what personal information we collect and how it is used, the right to delete, the right to opt out of sale (we do not sell data), and the right to non-discrimination.

EEA/UK Residents (GDPR/UK GDPR): You have all rights enumerated above and the right to lodge a complaint with your national Data Protection Authority.

To exercise any right, submit a request to privacy@zerodayit365.com. We will respond within 30 days (or shorter where required by law).

Zero Day IT 365 operates in Canada and may transfer personal data to third-party service providers located in the United States or other jurisdictions. When we transfer personal data outside Canada or the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission or UK ICO, where applicable.
• Data processing agreements with all sub-processors containing GDPR-equivalent protections.
• Transfers to the United States are conducted under providers with ISO 27001 certification and SOC 2 compliance where available.

Our platform is intended for business use by individuals aged 18 and over. We do not knowingly collect personal information from persons under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us at privacy@zerodayit365.com and we will promptly delete such information.

Our website may contain links to third-party websites, including vendor partner portals and industry resources. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices of third parties.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. We will:

• Post the revised policy on this page with an updated "Last updated" date.
• Notify registered users by email for material changes.
• Where required by law, seek your renewed consent before applying material changes to how we process existing data.

Your continued use of our platform after changes take effect constitutes acceptance of the updated policy.

For privacy-related inquiries, access requests, or complaints:

Zero Day IT 365 Inc. - Privacy Officer
Email: privacy@zerodayit365.com
Phone: 1-866-767-4335
Mail: Privacy Officer, Zero Day IT 365 Inc., Canada

If you are not satisfied with our response, you may lodge a complaint with:

• Canada: Office of the Privacy Commissioner of Canada - priv.gc.ca
• Quebec: Commission d'accès à l'information - cai.gouv.qc.ca
• European Union: Your national Data Protection Authority.
• United Kingdom: Information Commissioner's Office - ico.org.uk