Privacy Policy

1. Controller

ZopaAI GmbH
Campus A1 1
66123 Saarbrücken
Germany
Email: info@zopaai.com
Phone: +49 151 44234919

ZopaAI GmbH is the controller within the meaning of the General Data Protection Regulation (GDPR) insofar as it determines the purposes and means of the processing described in this Privacy Policy.

2. General principles and legal bases

We process personal data only where a legal basis applies. Depending on the processing activity, the legal basis may in particular be:

• Article 6(1)(a) GDPR – consent;
• Article 6(1)(b) GDPR – performance of a contract or steps taken at the request of the data subject prior to entering into a contract;
• Article 6(1)(c) GDPR – compliance with a legal obligation;
• Article 6(1)(f) GDPR – legitimate interests pursued by ZopaAI GmbH or a third party, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests.

Where we rely on Article 6(1)(f) GDPR, the relevant legitimate interest is described in the applicable section.

Unless stated otherwise, you are not legally or contractually obliged to provide personal data. If you do not provide it, we may not be able to respond to your enquiry, provide certain functions or enter into a business relationship with you.

3. Provision of the website and server log files

When our website is accessed, technical information may be processed automatically. This may include the date and time of access, IP address, host name, referring website, requested pages or resources, information on successful retrieval and transferred data volume, browser type and version, and operating system.

The processing is necessary to provide the website, maintain its technical functionality, detect and prevent misuse and attacks, and ensure the security of our information technology systems. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically reliable operation of the website.

The website is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. To the extent netcup processes personal data on our behalf, it acts as a processor.

Data required solely to provide the website is deleted when the relevant session has ended. Log files are stored for up to 14 days with direct access limited to administrators. After that, they remain available only in backups and are permanently deleted after no more than 30 days.

4. Contact, demo, sales and support enquiries

If you contact us by email, telephone or through a contact, demo, sales or support form, we process the information you provide. This may include your name, business contact details, company, professional role, the content of your enquiry and related communication data.

The processing is carried out to handle and respond to your enquiry and, where applicable, to initiate or manage a business relationship. Depending on the context, the legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR. Our legitimate interest is efficient business communication and the handling of enquiries from customers, prospective customers and business partners.

We retain enquiry data only for as long as necessary to handle the request and any resulting business relationship, subject to statutory retention obligations and the need to establish, exercise or defend legal claims.

5. Business contacts, prospective customers and data from external or publicly available sources

In a B2B context, we may process professional contact and business information relating to representatives, employees, decision-makers and other contacts at existing or prospective customers, suppliers and business partners. This may include name, company, professional contact details, position or function, business area, communication history and information relevant to the business relationship.

Where such data is not collected directly from you, it may originate from your employer or organisation, business partners, publicly accessible company websites, professional networks or other lawfully used business information sources.

The processing may be carried out for business development, customer relationship management, communication, market and account research, and the initiation and management of B2B relationships. The legal basis is generally Article 6(1)(f) GDPR. Our legitimate interests are developing and maintaining business relationships, identifying relevant business contacts, communicating about our B2B services and efficiently organising sales and customer relationship activities.

Where Article 14 GDPR applies, the information required under that provision will be provided within the legally applicable period unless a statutory exception applies.

You may object at any time to processing for direct marketing purposes.

6. Customer Relationship Management (CRM) – Pipedrive

We use Pipedrive as a customer relationship management system to organise and manage business contacts, prospective customers, customers, sales activities and related communications.

Depending on the business relationship, data processed in the CRM may include names, companies, professional positions or functions, business email addresses and telephone numbers, communication history, sales status, activities, notes and other information relevant to the initiation or management of a business relationship.

The processing serves in particular to structure customer and prospect relationships, document communications, coordinate sales activities and efficiently manage B2B business relationships. Depending on the individual case, the legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR. Our legitimate interest is the efficient organisation and management of our business relationships and sales processes.

Pipedrive is provided for European customers by Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia. To the extent Pipedrive processes personal data on our behalf, it acts as a processor.

CRM data is retained only for as long as necessary for the respective business purpose, taking into account statutory retention requirements, objections to direct marketing and the need to establish, exercise or defend legal claims.

7. Newsletter and email communications

If you subscribe to a ZopaAI newsletter or other consent-based email communication, we process your email address and, where provided, your name, as well as technical registration information such as the IP address and time of registration. Where this is technically enabled, we may also evaluate whether newsletters are opened and which links are clicked, in order to improve our content.

Newsletter delivery and the related evaluation are based on your consent pursuant to Article 6(1)(a) GDPR. Where registration data is retained to demonstrate consent and prevent misuse, processing may additionally be based on Article 6(1)(c) and/or Article 6(1)(f) GDPR.

We use a technical service provider for sending emails, which processes the data on our behalf as a processor. You can withdraw your consent at any time with effect for the future, in particular through the unsubscribe link contained in every newsletter. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Newsletter data is deleted when it is no longer required for the relevant purpose, subject to any limited retention necessary to document consent or an objection to further marketing.

8. Direct marketing and advertising

We may use business contact data to inform existing or prospective business customers about ZopaAI services, products or topics that may be relevant to their professional activities, where permitted by law.

Where personal data is processed for direct marketing on the basis of legitimate interests, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the marketing of our B2B products and services and the development of business relationships.

The permissibility of a specific advertising communication – in particular advertising by email or other electronic communication – is additionally assessed under the applicable rules governing electronic marketing.

You have the right to object at any time to the processing of your personal data for direct marketing purposes. If you object, we will no longer process the relevant personal data for those purposes.

9. Cookies, similar technologies and consent management

Our website may use cookies and similar technologies. Where information is stored on your terminal equipment or information already stored there is accessed, Section 25 TDDDG applies. Unless an exception under Section 25(2) TDDDG applies, such storage or access generally requires your consent. Any subsequent processing of personal data is additionally governed by the GDPR.

We manage consent ourselves, with the open-source software CookieConsent running on our own server; no consent management provider is involved. Your choices and a random consent ID are stored on your device in the cookie cc_cookie for six months. To be able to demonstrate consent, our server records, for each choice, the consent ID, the categories you accepted or rejected, the version and language of the consent banner, and the time. This record contains no IP address and no other information that identifies you. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR (obligation to demonstrate consent). The records are deleted once they are no longer needed for that purpose, at the latest three years after the choice was made.

On our industry pages we embed forms for requesting case studies from Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia. A form is only loaded after you have consented, either with the "Load form" button next to it or in the cookie settings. When it loads, your browser connects to Pipedrive and transmits your IP address and technical browser information. Pipedrive protects its forms against abuse with Cloudflare and against spam with Google reCAPTCHA (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); both may store cookies or similar information on your device, as listed below. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the adequacy decision of the European Commission (Article 45 GDPR). What you enter in the form is processed in our CRM (see Section 6). The legal basis is your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. Showing available demo appointments in the booking form does not involve this: our own server fetches them from Pipedrive, so your browser does not connect to Pipedrive until you book.

With your consent, we use PostHog, a product analytics service provided by PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA, which processes the data on our behalf as a processor (Article 28 GDPR), on servers in the European Union (PostHog EU Cloud). Your browser sends the data to our own domain (zopaai.com/_t/), from where our server forwards it to PostHog; your browser does not contact PostHog directly. We record which pages you visit and for how long, which buttons and links you click, the page and campaign (UTM parameters) that brought you to us, and information about your device and browser. Your IP address is discarded by PostHog on receipt and not stored. Individual visits may be recorded as a replay of page layout, scrolling and clicks; anything you type into forms is masked and not recorded. PostHog stores a random visitor ID in a cookie and in local storage, as listed below. If you book a meeting, we link your visit with the email address you entered, so that we can see which page or campaign led you to us. Analytics data is deleted after 12 months, replays after 30 days. As PostHog Inc. is based in the USA, access to the data from the USA cannot be ruled out; such transfers are based on the EU Standard Contractual Clauses (Article 46(2)(c) GDPR) in our data processing agreement with PostHog. The legal basis is your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. If you withdraw it via "Cookie settings", analytics stops and the identifiers PostHog stored in your browser are deleted.

You can change or withdraw your consent at any time with effect for the future using the "Cookie settings" link at the bottom of every page. Non-essential technologies are only activated once you have given your consent. Everything our website stores on your device is listed below.

10. Google Web Fonts

The fonts on our website are hosted locally on our own server. Google Fonts is only loaded from Google servers inside the Pipedrive forms (see Section 9), and only if you have given your consent. In that case, your browser connects to Google servers and technical data such as your IP address is transmitted to Google.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis is your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR, which you can withdraw at any time with effect for the future via the consent settings. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the adequacy decision of the European Commission (Article 45 GDPR).

11. ZopaAI platform, user accounts and AI functions

When users access the ZopaAI platform, we may process account and authentication information, business contact information, usage and session information and content actively provided through the platform. Depending on the functions used, this may include prompts, questions, instructions, uploaded content or documents, contextual information, feedback and generated outputs.

Such data may be processed to provide and secure the platform, authenticate users, perform requested AI-supported functions, respond to support requests, maintain service quality and troubleshoot technical issues. Where processing is necessary to provide a service requested by a user or customer, Article 6(1)(b) GDPR may apply. Security-related and technically necessary processing may also be based on Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the platform.

The concrete processing depends on the functions used. Where external cloud, AI model, authentication or infrastructure providers process personal data on our behalf, we engage them as processors on the basis of a data processing agreement pursuant to Article 28 GDPR.

12. Processing on behalf of business customers

Where a business customer determines the purposes and essential means of processing personal data within the ZopaAI platform and ZopaAI processes that data solely on the customer's documented instructions, the customer may be the controller and ZopaAI may act as processor within the meaning of Article 28 GDPR.

In such cases, the respective roles and processing activities are governed in particular by the applicable data processing agreement and the customer's own privacy information. This Privacy Policy does not replace privacy information that a ZopaAI customer is required to provide for processing for which that customer is the controller.

13. Recipients, processors and other platforms

Personal data may be disclosed to processors and other recipients where this is necessary for the purposes described in this Privacy Policy.

Depending on the processing activity, recipients may include providers of hosting and IT infrastructure, CRM systems, newsletter and email services, consent management, cloud and AI services, authentication, analytics and other technical or business services.

The services described in this Privacy Policy include netcup GmbH for hosting, Pipedrive OÜ for CRM, sales management and website functions, a technical service provider for sending emails and, only if you have consented, PostHog for website analytics (hosted in the EU) and Google Ireland Limited for reCAPTCHA and Google Fonts inside the Pipedrive forms.

14. Storage and deletion

Unless a specific retention period is stated in this Privacy Policy, we retain personal data only for as long as necessary for the respective processing purpose.

Data may be retained for a longer period where statutory retention obligations apply or where it is necessary for the establishment, exercise or defence of legal claims. Once the relevant purpose and any applicable retention requirements cease to apply, the data is deleted or anonymised.

15. Data security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures are reviewed and adapted taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the risks to data subjects.

16. Your rights

Subject to the applicable legal requirements, you have in particular the following rights:

• Right of access (Article 15 GDPR);
• Right to rectification (Article 16 GDPR);
• Right to erasure (Article 17 GDPR);
• Right to restriction of processing (Article 18 GDPR);
• Right to data portability (Article 20 GDPR), where the statutory requirements are met;
• Right to object (Article 21 GDPR);
• Right to withdraw consent at any time with effect for the future where processing is based on consent;
• Right to lodge a complaint with a competent data protection supervisory authority.

17. Right to object under Article 21 GDPR

Where we process personal data on the basis of Article 6(1)(e) or (f) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to that processing, including profiling based on those provisions.

We will no longer process the relevant personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Direct marketing: If personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing, including related profiling. If you object, the personal data will no longer be processed for those direct marketing purposes.

18. Automated decision-making and profiling

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

If this changes, we will update this Privacy Policy accordingly, including information on the logic involved and the significance and envisaged consequences of the processing.

19. Right to lodge a complaint and supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority competent for ZopaAI GmbH is the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany, poststelle@datenschutz.saarland.de. You may also contact the supervisory authority in the EU member state of your habitual residence or place of work.

20. Changes to this Privacy Policy

We may update this Privacy Policy where processing activities, technologies, services or legal requirements change. The current version will be made available on our website.