ZULA — PRIVACY POLICY 

 

Version 2.0 • Effective Date: July 10th, 2026 • Vancouver, British Columbia, Canada

Legal Entity: Zula Lead Intelligence Inc. ("Zula", "we", "us", "our") Registered Office: Vancouver, British Columbia, Canada Contact / Privacy Officer: Matin Nej — matin@zulalead.com Governing Legislation: PIPEDA (S.C. 2000, c. 5); BC Personal Information Protection Act (PIPA)

Our commitment: Zula is committed to protecting the privacy of every individual whose personal information we process — our subscribers, our website visitors, and the property owners whose records inform our intelligence. This Policy explains what we collect, why, how we use it, who we share it with, how long we keep it, and your rights.

 

1. Introduction & Scope

Sections 1.1 (Purpose) and 1.3 (Governing Legislation) are retained from v1.0.

1.2 Who This Policy Applies To (amended). This Policy applies to: subscribers and users of the Platform; visitors to zulalead.com; individuals whose property-related information appears in Lead Intelligence derived from public records or licensed data; homeowners and occupants who receive an agent-branded mail piece prepared through Zula's Direct Mail Program, and those who respond to one (including by scanning a QR code); business contacts and partners; and job applicants and contractors.

1.4 Consent (amended). By accessing or using the Services, creating an account, or providing personal information to Zula, you consent to the practices described in this Policy. For homeowners, the operative consent event is the point-of-collection notice presented when you request a report or connection through a Zula-facilitated channel (Section 5). Consent may be withdrawn at any time, subject to legal and contractual restrictions, by contacting the Privacy Officer; withdrawal does not affect the lawfulness of prior processing and does not require deletion of records we are required or permitted by law to retain (Section 6.2).

 

2. Definitions

Retained from v1.0, with these additions (consistent with T&C v3.0): "Board Data" (data received under a data licence agreement with a real estate board or its authorized distributor); "Campaign", "Declared-Intent Lead", "Suppression List", and "Sensitive Circumstance" as defined in the Terms & Conditions; and "Consent Record" (the record of a consent event, including timestamp, notice version, scope, and channel).

 

3. Information We Collect

3.1 Information You Provide Directly (amended). As v1.0 (account information, professional credentials, billing via processor, communications, referrals), with the Platform usage category made explicit: Command Centre data ("CRM Data") — deal activity records, pipeline stages, contact notes, task items, uploaded documents, and lead outcome and disposition codes you record against Lead Intelligence (for example: contacted, no answer, meeting booked, not now, do-not-contact). CRM Data is retained as described in Section 6 and is used as described in Sections 4 and 12.

3.2 Information We Collect Automatically. Retained from v1.0 (device data, usage data, cookies, city-level IP location).

3.3 Information Derived from Public Records (amended). Property records, ownership records as recorded in public title registries, assessment data, permit and construction data, and publicly filed court and estate records — as v1.0 — with two corrections and one addition:

• Market and listing data is licensed, not public. Where the Platform is informed by MLS-derived listing history, sold data, or days-on-market, that data is received under data licence agreements with real estate boards or their authorized distributors, is handled subject to those licences, and is made available to subscribers only under the agent-only conditions in the Terms & Conditions. It is not "publicly accessible" data and this Policy does not characterize it as such.

• Historical snapshots. Zula retains dated historical versions of public datasets (assessment rolls, permit registries, zoning records) as a longitudinal archive used to compute market trends and property-level change over time. Snapshots are property-keyed; where a public record includes an individual's name (for example, a registered owner in a title record), that element is handled as personal information under this Policy.

• Zula deliberately omits personal email addresses and personal phone numbers from standard Lead Intelligence deliveries (retained from v1.0).

3.4 Information from Third Parties. Retained from v1.0 (payment processors, data partners under signed agreements, social login providers).

3.5 Homeowner Campaign & Response Data — NEW. When a Direct Mail Campaign is prepared and dispatched through the Platform, and when a homeowner responds, Zula collects and retains:

• Campaign preparation and send records: the property address, the Lead Intelligence attributes used for selection (including score band), the creative version, the approving subscriber, and dispatch confirmation — retained as the audit trail of each Campaign.

• Delivery and response outcomes at the property level: whether a mail piece generated a response (including QR scan events), and coded outcome data. Non-response is itself recorded as an outcome. This response data is used for campaign measurement and, in aggregated or de-identified form, to improve targeting and messaging models.

• QR scan and report-request data: when an individual scans a Campaign QR code or visits a Campaign landing page, we collect the scan timestamp, the property reference, device and technical data per Section 3.2, and any information the individual chooses to submit (such as name, email address, and their responses to report questions), together with the Consent Record for that interaction.

• Declared-Intent Lead data: where the individual consents to be connected with the named subscriber, we retain the information submitted, the consent scope, and the connection record.

The point-of-collection notice presented at the landing page governs the scope of collection and use for that interaction and prevails over this Policy to the extent it is more specific.

 

4. How We Use Your Information

4.1 Purposes of Collection and Use (amended). Each purpose below is a purpose a reasonable person would consider appropriate in the circumstances (PIPEDA s. 5(3); PIPA s. 11, 14, 17). The v1.0 purpose table is retained with the "legal basis" column restated in Canadian terms (express consent; implied consent; publicly available information under the PIPEDA Regulations (SOR/2001-7) and PIPA Regulations; performance of the subscription contract as a consent-supported purpose; and statutory exceptions), and with these purposes added:

Purpose

Data used

Basis

Retention

Prepare, dispatch, and document Direct Mail Campaigns on a subscriber's instruction

Property records, selection attributes, approval records, send logs

Subscriber contract; publicly available information (property selection); service-provider processing for the subscriber

7 years (audit trail)

Operate the consent gate: deliver requested reports and connect Declared-Intent Leads to the named subscriber

QR response data, submitted contact information, Consent Records

Express consent at point of collection

Section 6 schedule

Maintain Consent Records evidencing consent, scope, and withdrawal

Consent Records

Express consent; legal record-keeping (CASL, PIPEDA accountability)

7 years, including after withdrawal

Honour contact preferences platform-wide

Suppression List entries (property reference, minimal identifiers, request date)

Necessary to honour the individual's own request

Indefinitely

Measure Campaign performance and improve targeting and messaging models

Property-level response/non-response outcomes; aggregated or de-identified derivatives

Reasonable business purpose; de-identified data is not personal information

Identifiable elements per Section 6; derivatives indefinitely

Improve scoring models using subscriber-recorded outcome codes

CRM Data outcome codes, de-identified and aggregated

Subscriber contract (T&C §8.3 licence); de-identified derivatives

Derivatives indefinitely

4.2 Algorithmic Processing (amended for accuracy). Zula's algorithms analyse property-level and market-level signals: property characteristics, assessment history, permit activity, zoning, market patterns, and licensed listing history. Certain publicly filed records associated with a property — such as court filings or permit events — may inform a property's score. Zula does not use credit information, financial account information, or behavioural profiles of identified individuals as scoring inputs, and Zula's outputs never disclose, state, or imply any Sensitive Circumstance concerning a property or its occupants. Subscribers are contractually prohibited from referencing Sensitive Circumstances in any outreach and from attempting to reverse-engineer score inputs (T&C §5.10).

4.3 No Automated Decision-Making Affecting Individuals' Rights. Retained from v1.0: scores prioritize prospecting attention only; no individual's legal rights, employment, credit, insurance, or access to services is determined by Zula's processing.

 

5. Direct Mail Program, QR Responses & Declared-Intent Leads — NEW

5.1 Structure and roles. Mail pieces prepared through the Direct Mail Program are issued in the name, brokerage, and licence of the subscribing real estate professional, who is the advertiser of record and the party responsible for the decision to conduct the solicitation. Zula acts as a technology and fulfilment service provider preparing and dispatching materials on the subscriber's documented instruction, and operates the response and consent infrastructure described in this Section.

5.2 What a mail recipient should know. If you received an agent-branded mail piece prepared through Zula: the piece was sent by the named real estate professional; the property was selected using analysis of public records (such as assessment, permit, and zoning data); the mail piece itself contains only public-record information about the property; and no response is required. If you wish to receive no further contact, see Section 5.6.

5.3 The consent gate. Scanning a Campaign QR code or visiting a Campaign landing page presents a privacy notice before any information is collected beyond technical data. The notice identifies the named professional and Zula's service role, describes what will be collected and why, and requests your express consent. You control whether to proceed; declining has no consequence other than not receiving the requested report or connection.

5.4 Retention of QR responses and Consent Records. Zula retains QR scan and response data, information you submit, and the Consent Record for each interaction, for the periods in Section 6. Consent Records are retained for 7 years, including where consent is later withdrawn, because the record of when and how consent was given and withdrawn is itself required to demonstrate compliance with CASL and privacy law. Withdrawal stops further use; it does not erase the evidence that consent existed and was honoured.

5.5 Declared-Intent Leads. Where you consent to be connected with the named professional, your submitted information is provided to that professional only, within the scope of the notice. The professional is thereafter the organization accountable for their relationship with you. You may withdraw from the connection at any time by contacting the professional or Zula's Privacy Officer.

5.6 Suppression List. Any homeowner or occupant may require that no further contact be made through Zula-facilitated channels by emailing matin@zulalead.com (subject line "Property Owner Privacy Request") or by using the opt-out mechanism on any Campaign landing page. Suppression takes effect within 30 days, applies platform-wide across all subscribers, and is maintained indefinitely — we retain the minimal information necessary (property reference, request date) precisely so the request can be honoured permanently. Suppression requests survive any subscriber's cancellation and any change of ownership notified to us.

5.7 Response analytics. Zula records, at the property level, whether Campaigns generate responses, including non-response. These records are used to measure and improve Campaign targeting and messaging. Analytics derivatives are aggregated or de-identified before any use beyond the originating Campaign, and de-identified derivatives may be retained and used indefinitely.

 

6. Data Retention

6.1 Retention Schedule (amended). The v1.0 schedule is retained, corrected and extended as follows:

Data category

Retention period

Basis

Active subscriber account data

Duration of subscription

Contract

Account data after cancellation

24 months post-cancellation

Dispute resolution; legal compliance

Command Centre / CRM Data (deal records, notes, outcome codes)

Duration of subscription + 24 months, then deleted; de-identified, aggregated derivatives retained indefinitely

Contract; T&C §8.3 licence

Billing and transaction records

7 years

CRA requirements

Campaign approval records and send logs

7 years

Regulatory and board audit defence; limitation periods

Consent Records (including marketing consent and QR consent events)

7 years, surviving withdrawal

CASL record-keeping; accountability

QR response and Declared-Intent Lead data held by Zula

24 months from last interaction, unless an active relationship with the named professional continues; Consent Record retained per above

Consent; contract

Suppression List

Indefinitely

Necessary to honour the request

Historical public-record snapshots

Indefinitely (property-keyed archive)

Publicly available information; market analysis

Platform usage and analytics data

36 months, then anonymised

Service improvement

Support and communication records

24 months from last interaction

Service quality

Aggregated, de-identified data

Indefinitely

Not personal information

6.2 Deletion on Request (amended). As v1.0 (30-day processing, written confirmation), with the retained-categories exception stated plainly: deletion requests do not extend to records we are required or permitted to retain by law or to demonstrate compliance — including billing records, Consent Records, Campaign audit trails, breach records, and Suppression List entries — nor to aggregated or de-identified data that no longer identifies you. Where we retain, we will tell you what and why.

6.3 Anonymisation. Retained from v1.0, with one clarification: de-identification is performed so that the data can no longer reasonably be used to identify an individual, directly or in combination with other reasonably available information.

 

7. Your Privacy Rights

Sections 7.1 and 7.2 retained from v1.0 (access, correction, deletion, withdrawal, marketing opt-out, complaint rights; 30-day response standard).

7.3 Rights of Property Owners and Mail Recipients (amended). Individuals whose property information appears in Lead Intelligence, or who receive a Campaign mail piece, may: request confirmation of whether Zula holds data relating to their property and its sources; request correction of inaccurate property data; request suppression from all future Lead Intelligence deliveries and all Zula-facilitated contact (Section 5.6); request a copy of the Consent Record for any consent they gave through a Campaign landing page; and complain to the OPC or BC OIPC. Requests: matin@zulalead.com, subject "Property Owner Privacy Request", with the property address.

 

8. Data Security

Retained from v1.0 in full (Sections 8.1–8.3: safeguards, mandatory breach notification and 24-month breach records, no absolute guarantee), with one addition to 8.1: access to homeowner response data and Consent Records is restricted to personnel operating the Direct Mail Program and to the named subscriber for their own Campaigns only.

 

9. Third-Party Links & Services / 10. Cookies / 11. Children's Privacy

Retained from v1.0 in full.

 

12. Subscriber Responsibilities Regarding Privacy

12.1 Subscriber as Independently Accountable Organization. Retained from v1.0: when a subscriber uses Lead Intelligence to contact or prospect individuals through their own channels, the subscriber is the organization accountable under PIPEDA/PIPA and CASL for that outreach, including lawful basis, consent, DNCL compliance, access requests, and breach reporting for information in their custody.

12.2 Roles for Direct Mail Campaigns (replaces v1.0 §12.2). For Campaigns conducted through the Direct Mail Program, the parties act in the roles defined in the Terms & Conditions (§7.8): the subscriber is the advertiser of record and the organization responsible for the decision to solicit and for any resulting client relationship; Zula is a service provider processing information to prepare and dispatch the Campaign on the subscriber's documented instruction and to operate the consent gate. Each party is responsible for its own obligations in its role. Outside the Direct Mail Program, Zula has no visibility into or responsibility for what a subscriber does with Lead Intelligence after delivery.

12.3 Protecting User Data in the Command Centre. Retained from v1.0.

 

13. Data Provenance & Lawful Basis

13.1 Sources (amended). Lead Intelligence is derived from: publicly accessible government records (LTSA, BC Assessment, municipal open data and permit registries — including City of Vancouver open data used under the Open Government Licence – Vancouver — and publicly filed court records); and licensed professional data received under data licence agreements with real estate boards or their authorized distributors, handled subject to those licences. The v1.0 description of MLS data as "publicly accessible" is withdrawn.

13.2 Basis for Processing Public Record Data (amended). Personal information prescribed as publicly available under the PIPEDA Regulations (SOR/2001-7) and the PIPA Regulations — including information in registries to which public access is authorized by law — may be collected, used, and disclosed without consent where that handling relates directly to the purpose for which the information appears in the record. Zula's position is that its collection and analysis of title, assessment, and permit records for property and market intelligence relates directly to those purposes. For any use going beyond that basis — in particular, connecting a specific homeowner with a specific professional — Zula relies on the express consent obtained through the consent gate described in Section 5, not on the publicly-available exemption.

13.3 Accuracy. Retained from v1.0 (source-registry dependency; correction channel).

13.4 Suppression. Consolidated into Section 5.6.

 

14. Marketing Communications

Retained from v1.0 in full (Zula's own CASL compliance; transactional vs marketing categories; consent records — retention period now 7 years per Section 6.1).

 

15. Changes to This Policy / 16. Contact & Privacy Officer

Retained from v1.0 in full (14 days' notice of material changes; Privacy Officer Matin Nej, matin@zulalead.com; OPC and BC OIPC complaint routes).

 

Document: Privacy Policy  Version: 2.0 Effective date: July 10th, 2026 • 

This Privacy Policy was prepared as a working framework for Zula Lead Intelligence Inc. It does not constitute legal advice.