GDPR
Last updated: 5 October 2026
Company and privacy contact
Jonah and Associates Pty Ltd, ABN 86 679 045 044, trading as Spotzee and Sendmux (Sendmux is a brand of the same company).
Level 50, 120 Collins Street, Melbourne VIC 3000, Australia.
Data Protection Lead: Roshan Jonnalagadda, CTO.
Privacy contact: dpo@spotzee.com.
Where customer data lives
All customer data is stored in the European Union.
- Primary: Hetzner Online GmbH, Germany (Falkenstein data centre).
- Backups: Backblaze EU Central region, Amsterdam, Netherlands, encrypted before upload.
- Cloudflare carries traffic (DNS, TLS, DDoS protection) and stores no customer data.
Sub-processors and data processing agreements
Each sub-processor is bound by a data processing agreement; US-based providers are covered by Standard Contractual Clauses (with the UK Addendum) and, for Cloudflare, the EU-U.S. Data Privacy Framework with UK Extension. Customers are told before a sub-processor is added or replaced.
Security
Retention
- Customer data
- Life of the account; customers can delete any record at any time; deleted or returned within 30 days after an account closes
- Delivery records
- With the customer's data, for the life of the account
- Service, application and security logs
- Rotated automatically and kept only as long as needed to run and secure the service
- Database backups
- 28 days (7 daily, 4 weekly)
- Billing records
- As tax law requires (5 years in Australia)
Data subject requests
Individuals contact dpo@spotzee.com. Where we hold data on behalf of a customer, we pass the request to that customer promptly and help them respond. Requests about our own account holders' data are answered within one month.
Breach notification
We notify affected customers without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting their data, with what happened, the data and people affected, likely consequences and the measures taken. Where the law requires, we also notify regulators.