1. Introduction

This guide explains the practices of Zultys, Inc. (“Zultys” or “we”) with respect to external requests for customer information from law enforcement, government agencies, and third-party requests from individuals involved in civil or criminal litigation.  This policy does not apply to customer requests for their own account information.

We provide this guidance for informational purposes only and may change or depart from it at any time, with or without notice and solely within our discretion.  Zultys reviews each request on a case-by-case basis.

2. Commitment to Privacy and Applicable Law

Zultys is committed to safeguarding the privacy of its customers and complying with applicable laws.  As such, Zultys will reject customer information requests that are legally deficient (e.g., improper service or insufficient legal basis).  Zultys may also reject requests that are:

• overly broad, vague, or burdensome
• infringe on the rights of other customers, or
• violate any applicable law.

Zultys reserves the right to challenge customer information requests that it deems to be deficient in the appropriate forum, on these or any other grounds.

Absent a legally binding non-disclosure order or extraordinary circumstances (as determined in Zulty’s own discretion), it is Zultys’ practice to notify customers of customer information requests.  Extraordinary circumstances may involve, for example:

• circumstances where disclosure would endanger a child or vulnerable adult, or create a serious and imminent risk of serious physical harm or death to an individual, and
• emergency situations that necessitate disclosure before a customer can be notified, such as where risk of harm to Zultys or risk of death or serious physical injury to a person is imminent.

3. Categories of Customer Information Requests

Zultys’ policy is to only release customer information in response to valid compulsory process, which encompasses:

• Warrants
• Subpoenas
• Civil investigative demands (CIDs)
• Preservation letters

and other legally binding demands such as discovery or trial subpoenas obtained by a non-government actor in civil or criminal litigation.  All customer information requests must follow the applicable legal process and have a valid legal basis.

• Standard Requests

Zultys typically responds to non-expedited customer information requests within 30 days, though individual requests may take longer.  To request a response within a shorter period, please submit an emergency or expedited request.

• Expedited and Emergency Requests

To request a response to Zultys within a period of less than 5 days, please submit information regarding the basis for needing an expedited response along with your request.  If your request requires immediate attention due to a serious emergency requiring immediate attention, such as the risk of serious physical harm, death, or destruction of Zultys property, please provide us with details regarding the nature of the emergency by sending an email to legal@zultys.com.

• Preservation Requests

In response to preservation letters, Zultys will generally preserve the requested data for up to 90 days.  Preservation requests may be extended an additional 90 days.  Please note routine data destruction procedures may apply if there is a gap between the expiration date of the initial preservation request and the extension request.

• Service of Process

Zultys accepts service of process not requiring the oral testimony or personal appearance of Zultys personnel (including any such warrant, subpoena, civil investigative demand, or preservation request) by sending a copy via email to legal@zultys.com.

The compulsory process that would involve oral testimony or the personal appearance of Zultys personnel must be served in compliance with the applicable rules of court procedure.  Zultys reserves the right to change its method of accepting service of process at any time without notice.

4. Required Information

All customer information requests must identify the type and scope of information requested and the legal basis for requesting such information.

All requests should be narrowly tailored as possible and should be designed to avoid infringing on the privacy rights of Zultys customers who are not the target of the relevant investigation or litigation.

In addition:

• All requests from law enforcement or government agencies must identify in English:
  • Requesting agency name
  • Individual agent’s contact information (name, badge/identification number, government-issued e-mail address, telephone number (including extension), non-P.O. box mailing address)
  • Requested response date
  • Signature of the authorizing official
  • Copy of the warrant, subpoena, civil investigative demand, preservation letter, and non-disclosure order (if applicable)
• Requests from law enforcement or government agencies not located in the same country as the customer must also supply the basis for the extraterritorial application of the request.
• Non-government actor requests must also include in English the contact information of the requesting party and their legal counsel: name, telephone number, e-mail address, mailing address, and state bar number. Please note your requested response date and include a copy of the subpoena.

5. Categories of Information Provided

Zultys’ response to customer information requests is limited to information retained by Zultys; requested information that has already been deleted in the ordinary course of business (or otherwise) cannot be produced. Additionally, it will typically be unduly burdensome for Zultys to search for information stored exclusively in back-up archives format in the course of responding to a customer information request.  Further detail regarding Zultys’ data retention policy can be found in Zultys’ Privacy Policy, Zultys Cloud Services Terms & Conditions, and other policies.

When responding to a law enforcement request or request from another government agency, and depending on the type of service of process provided, Zultys may provide non-content customer information (e.g., name, address, call detail records, length of service, type of service utilized, telephone numbers and network addresses assigned, means and sources of payment) or communications contents.  Communications contents are released only with customer consent or when required by law.

When responding to requests from non-government actors and depending on the type of service of process provided, Zultys may release non-content customer information where required by applicable law or with the consent of the customer.  Zultys typically does not release communications content to non-government actors, except with the consent of a customer.

6. Questions

For questions about your customer information request or our policy, please email legal@zultys.com.