Privacy Policy — IBAM solutions AB

This Privacy Policy explains how we process personal data when you visit ibamsolutions.com and/or use our Zendesk-related applications (each an "Application"): the Enhanced Messaging Widget and the IBAM Marketing Automation app for Zendesk ("Zendesk Marketing Tool").

If you use the Application inside your company's Zendesk environment, IBAM will typically process personal data from Zendesk as a processor on behalf of the Customer. In that case, the Data Processing Addendum (DPA) applies.

1. What personal data we process

A) Website and communications

• Contact details (name, email, company, role) if you contact us
• Communication content (emails/support requests)
• Basic technical data when you access our website (IP address, device/browser info, timestamps, pages requested)

B) Enhanced Messaging Widget (Zendesk)

We design the widget to process only the Zendesk data needed for the feature(s) you use, as configured by the Customer and permitted via Zendesk permissions. Depending on configuration and feature usage, this may include:

• Zendesk account identifiers (e.g., subdomain/account ID)
• Agent/user identifiers (e.g., name, email, user ID)
• Ticket identifiers and metadata (e.g., ticket ID, timestamps, field IDs)
• Ticket field values and/or snippets of ticket content only when needed to perform the requested function
• Application configuration settings (e.g., mappings, rules, preferences)
• If the Customer enables the optional analytics feature: widget interaction events (e.g., tab views, article clicks, form submissions), URL path, browser locale/language, and timestamps — used solely to provide aggregated usage analytics to the Customer

Important (Enhanced Messaging Widget): The widget does not store Zendesk ticket content on our servers as a general rule. Ticket content is processed transiently to provide the feature, and then discarded, except where limited retention is unavoidable in infrastructure logs (see Section 7). The analytics feature is opt-in and must be explicitly enabled by the Customer. This does not apply to the Zendesk Marketing Tool, which stores recipient data as described below.

C) Zendesk Marketing Tool

The Zendesk Marketing Tool lets a customer send email campaigns and follow-up sequences to contacts from its Zendesk or from CSV lists. Each email is sent as a ticket in the customer's own Zendesk, and Zendesk sends the email. Recipients can unsubscribe through a link in each email. We process two kinds of personal data:

1. Recipients' data — we are the customer's processor

The customer (the Zendesk account owner) is the controller and decides who is emailed and why; IBAM processes this data on the customer's documented instructions under the DPA. We store, per customer account:

• Recipients: email address, first and last name, merge variables used in an email (for example company or website), send status and timestamps, open and click events (time, link clicked and a shortened browser/mail-client identifier) and the resulting counts, follow-up sequence enrolment and progress, CSV list contacts (including extra columns the customer uploads), and unsubscribe records (email, time, source)
• A usage record of contacts reached per month (email address, last send time) used for plan limits, and in-app notifications that can contain a recipient's email address (for example "X unsubscribed")
• The customer's templates, signatures, segments (filters), campaigns, sequence steps and uploaded images
• Notification settings: the email addresses of the customer's own staff who receive notifications (up to 10) and their notification preferences. Notification emails are sent through the customer's own Zendesk as a ticket from the customer's own support address, so no additional provider is involved; they name campaigns and numbers but never the contact involved

We do not store the rendered email content or attachments (they live as tickets in the customer's Zendesk), the recipient's IP address, or the customer's full contact database: contacts are read live from Zendesk at send time, and only contacts that were mailed, plus CSV uploads, are kept.

2. Customer account, installation and billing — we are the controller

• Account and installation data: Zendesk subdomain and company name, installation ID, OAuth tokens to the customer's Zendesk (encrypted at rest), and which Zendesk user IDs are allowed to use the app
• Billing data: Stripe customer and subscription IDs, plan and status; full Stripe event payloads (customer name and email), which we keep with the billing records for the period required by applicable accounting law
• Terms acceptance: which version of the Terms and DPA was accepted or withdrawn, by which Zendesk user ID (no name or email), and when. An administrator can withdraw the acceptance in Settings; all sending then stops immediately and nothing is deleted

D) Billing

If the widget is purchased via Zendesk Marketplace, payments and tax handling are performed via Marketplace/payment processor flows. Zendesk Marketing Tool subscriptions are paid through Stripe. We typically receive only billing metadata (e.g., plan, subscription status, transaction references), not full payment card details.

2. Why we process personal data

We process personal data to:

• Provide and operate the Application
• Authenticate users and apply permissions
• Provide support and troubleshoot
• Maintain security, prevent abuse, and ensure reliability
• Maintain necessary configuration/state for the Application (e.g., settings)
• Handle billing administration and compliance obligations
• Apply plan limits and record acceptance of the Terms and DPA (Zendesk Marketing Tool)
• Comply with legal obligations

For recipients' data in the Zendesk Marketing Tool, the purposes are decided by the customer; we process it only to provide the service as the customer configures it.

3. Legal bases (GDPR)

Where IBAM acts as controller, we rely primarily on:

• Contract (to deliver the Application/support you request)
• Legitimate interests (security, fraud prevention, service reliability)
• Legal obligation (e.g., accounting rules)

This applies, for example, to the Zendesk Marketing Tool account, installation and billing data, the record of Terms/DPA acceptance and plan-limit usage records, which rely on contract and legitimate interests (proof of agreement and enforcing plan limits).

Where IBAM acts as processor (Zendesk Customer Data), the Customer is controller and the DPA governs.

4. Sharing and disclosures

We share personal data only as necessary with:

Infrastructure / service providers (sub-processors)

• Cloudflare (CDN, security, DNS, edge delivery and protection; Enhanced Messaging Widget only)
• Render (application hosting/runtime and managed database hosting, including Render Postgres)
• Stripe (payment processing for Zendesk Marketing Tool subscriptions; Stripe is also an independent controller for payment data)
• Zendesk — the customer's own platform, which we access with the customer's authorization (OAuth)
• Google Analytics — if the Customer enables the optional analytics feature, widget interaction events are sent to Google Analytics for aggregated usage reporting. This is opt-in only and not active by default.

For the Zendesk Marketing Tool, data is hosted in Frankfurt (EU Central). Where personal data is transferred outside the EU/EEA, we rely on EU Standard Contractual Clauses.

The full sub-processor list, with regions and how changes are notified, is in Annex IV of the DPA. Render hosts the Zendesk Marketing Tool web service and database in Frankfurt (EU Central).

These providers may process technical data and limited content as part of operating the service (e.g., request logs, error logs). Cloudflare uses certain necessary cookies for security and traffic management and documents where cookie data may be processed by default (including the United States) and how localization options can apply.

References:

• Cloudflare cookies documentation
• Cloudflare Customer DPA
• Cloudflare SCCs
• Render security/subprocessors overview
• Render DPA

Legal disclosures

We may disclose information if required to comply with law, legal process, or lawful governmental requests.

5. International transfers

Our providers operate globally. Personal data may be processed outside the EU/EEA depending on provider architecture and configuration. Where such transfers occur, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) as implemented by IBAM and/or our providers.

6. Retention

We retain personal data only as long as necessary for the purposes described:

• Support communications: as needed to handle the matter and reasonable follow-up
• Application configuration/state: for as long as the Application is installed/used
• Infrastructure logs: limited retention as generated by Cloudflare/Render for security and operational reliability (typically short-term)
• Analytics data (if feature enabled): retained for the duration of the subscription, and deleted within 30 days of termination/uninstall
• Zendesk Marketing Tool: the customer chooses how long finished send history is kept (1 to 3,650 days, or indefinitely; default 2 years / 24 months). On expiry, send history is either anonymised (the default; statistics stay) or deleted completely, as the customer chooses. Finished sequence entries, fired trigger events and old notifications are removed. Work in progress, uploaded contact lists and opt-outs are never expired. A job applies the setting every 6 hours.
• Zendesk Marketing Tool deletion: an administrator can delete all of the customer's data in the app (Settings > Delete my data). Sending is paused at once and the data is deleted 7 days later, or 7 days after the subscription ends; it can be cancelled until then, and a "delete now" option cancels the subscription immediately without refund and deletes everything at once. We can also delete on a verified request from a Zendesk administrator, or after uninstall, within 30 days. Not deleted: invoices and payment records in Stripe (kept for the period required by applicable accounting law), campaign tickets and emails in the customer's own Zendesk, and database backups, which age out within 3 days (the database has a point-in-time recovery window of 3 days).

An administrator can download everything held for the account at any time as one JSON file in the app (Settings > Privacy & data > "Download everything"). It never includes connection tokens, secrets or our billing records, and each export is logged with counts only.

Opt-outs are kept as the plain email address, also after a person has been erased, because a person who unsubscribed must never be emailed again. The legal basis is to honour that person's objection to direct marketing (the sender's legitimate interest and its obligation to respect the objection).

Customer Data processed as processor is handled per the DPA.

7. Security

We implement reasonable technical and organizational measures to protect personal data, including access controls, least-privilege, secure secret handling, TLS in transit, tenant isolation and standard platform security controls. No method of transmission/storage is 100% secure. See Security and data handling and Annex III of the DPA.

8. Your rights

If we process your personal data as controller, you may request access, rectification, erasure, restriction, objection, and portability where applicable.

If the request relates to personal data processed in Zendesk Customer Data, we may refer you to the Customer (controller) or support them in responding.

If you received an email sent with the Zendesk Marketing Tool: the sender (our customer) is the controller of your data and decides who is emailed. You can unsubscribe through the link in each email. To access, correct or erase your data, or to object, contact the sender. The sender can look up an email address in the app, see what is held about you, download it as a JSON file and erase you: your sends are anonymised (address, name, merge values, ticket ID and error text removed; only counters remain), the rest (including open and click events) is deleted, and you are removed from notifications. An existing opt-out is kept as your email address so that you are not emailed again. If you contact us (info@ibamsolutions.com), we will refer you to the sender and assist them in responding.

9. Cookies

Our website may use strictly necessary cookies and similar technologies for security and traffic management, primarily via Cloudflare.

If the Customer enables the optional analytics feature in the widget Application, Google Analytics may store cookies or use similar tracking mechanisms (e.g., _ga, _gid) on end-user browsers to distinguish visitors and measure widget interactions. This only applies when analytics is explicitly enabled by the Customer — it is not active by default.

Zendesk Marketing Tool: emails sent with the app contain a tracking pixel and tracked links. Each time a recipient opens or clicks a link, we record the time, the link that was clicked and a shortened browser/mail-client identifier (user agent). We do notstore the recipient's IP address. The customer uses this to see open and click statistics, and we filter out automated events (for example link scanning by corporate mail security systems) so that the statistics reflect real people. The individual events are kept for the customer's chosen retention period (default 24 months), are included in a person's data export, are deleted when the person is erased, and are deleted with the customer's account. The customer is the controller and we are the processor.

10. Contact and complaints

Contact: info@ibamsolutions.com

You can also lodge a complaint with the Swedish authority Integritetsskyddsmyndigheten (IMY).

11. Changes

We may update this policy. Material changes will be communicated via website notice and/or email where appropriate.