Legal

Data Privacy

1. Data Controller

Zelara GmbH
Immanuelkirchstr. 35
10405 Berlin, Germany

Email: info@zelara.ai
Website: www.zelara.ai

Zelara GmbH ("Zelara" or "we") is responsible for the processing of your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").

2. Contact Form Data

You may contact us through our website using the available contact form to get in touch with our team. When you contact us via the contact form, we process the personal data you provide in the form, namely your name, your work email address, your company, your role (optional) and the content of your message. We use this data to respond to your request and, where relevant, to schedule and follow up on an introductory call regarding Zelara's services. You may also contact us by email for other business-related inquiries. In this case, we process the personal data you provide to us, in particular your email address and the content of your message.

In addition, if you access our website via a tagged marketing link, campaign attribution data contained in the URL, such as utm_source, utm_medium, utm_campaign, utm_term and utm_content, may be stored together with your form submission. We use this information to understand through which campaign or marketing channel your request originated and to evaluate the effectiveness of our marketing activities.

If you contact us as part of an existing contractual relationship or contact us in advance for information about our range of services, your personal data will be processed for the performance of a contract or in order to take steps prior to entering into a contract and to respond to your contact request in accordance with Art. 6 para. 1 sent. 1 lit. b GDPR. Otherwise, the legal basis for the processing of your personal data is Art. 6 para. 1 sent. 1 lit. f GDPR, based on our legitimate interest in responding to inquiries and managing communication with you.

Retention period: 24 months after your last interaction with us. However, in some cases, e.g., due to legal retention periods, we might be under the legal obligation to continue the storage of your personal data.

3. Automatically Collected Data

When you visit our website, certain data may be collected automatically:

Server log files: Our hosting provider automatically collects and stores data in server log files, which may include:

IP address
Date and time of access
Requested URL and referrer URL
Browser type and version
Operating system

This data is processed on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in ensuring the security and proper functioning of our website. This data is not combined with other data sources and is not used to identify individual users.

Retention period: 30 days. However, in some cases, e.g., due to legal retention periods we might be under the legal obligation to continue the storage of your personal data.

4. Analytics and Marketing Tools

We use analytics and marketing tools on our website, which rely on cookies and similar technologies. The use of such technologies requires your prior consent pursuant to § 25 para. 1 TDDDG. Any processing of personal data in this context is based on your consent under Art. 6 para. 1 lit. a GDPR.

You can withdraw or change your consent at any time with effect for the future by accessing the cookie settings via the Cookiebot icon displayed on our website.

Google Analytics: We use Google Analytics 4 (operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how visitors use our website and to improve our online presence. Google Analytics may process usage-related and technical data such as pages visited, session duration, referrer URLs, approximate location at country or city level, device and browser information, and IP address. Google Analytics is only activated after your consent.

Retention period: 14 months. However, in some cases, e.g., due to legal retention periods, we might be under the legal obligation to continue the storage of your personal data.

Apollo.io: We use Apollo.io (operated by ZenLeads Inc. d/b/a Apollo.io, 440 N Barranca Ave #4750, Covina, CA 91723-1722, USA) for company-level website visitor identification to support our B2B sales analytics. Apollo.io may process technical and usage-related data such as IP address, browser and device information, pages visited, timestamps and referrer URLs. Apollo.io performs reverse IP lookup to identify the company associated with a visit. We do not use Apollo.io to identify individual visitors located in the EU, EEA, UK or Switzerland.

Retention period: 24 months. However, in some cases, e.g., due to legal retention periods, we might be under the legal obligation to continue the storage of your personal data.

RB2B: We use RB2B (operated by Retention.com, Inc., 1207 Delaware Ave #1228, Wilmington, DE 19806, USA) for B2B visitor identification. RB2B may process technical and usage-related data such as IP address, browser and device information, pages visited, timestamps and referrer URLs. RB2B is geo-restricted: for visitors located in the United States, RB2B may identify individual professional visitors, e.g. name, professional email address and LinkedIn profile, based on its first-party data network. For visitors located in the European Union, the European Economic Area, the United Kingdom and Switzerland, RB2B operates in company-level mode only and is not used by us to identify individual persons.

Retention period: 24 months. However, in some cases, e.g., due to legal retention periods, we might be under the legal obligation to continue the storage of your personal data.

Factors.ai: We use Factors.ai (operated by Factors AI, Inc., 2261 Market Street #4889, San Francisco, CA 94114, USA) for company-level B2B website analytics and account-level engagement insights to understand how companies engage with our content. Factors.ai may process technical and usage-related data such as IP address, browser and device information, pages visited, timestamps, referrer URLs and company-level information inferred from the IP address. Factors.ai performs reverse IP lookup to associate visits with companies and aggregates visit behaviour at the account level. We do not use Factors.ai to identify individual visitors located in the EU, EEA, UK or Switzerland.

Retention period: 24 months. However, in some cases, e.g., due to legal retention periods, we might be under the legal obligation to continue the storage of your personal data.

Google Tag Manager: We use Google Tag Manager (operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to manage and deploy tags on our website. Google Tag Manager is used to load and control analytics and marketing tools, including Google Analytics, Apollo.io, RB2B and Factors.ai. Where these tools rely on cookies or similar technologies or process personal data for analytics or marketing purposes, they are only activated after your consent. The legal basis is § 25 para. 1 TDDDG and Art. 6 para. 1 lit. a GDPR.

Retention period: Google Tag Manager itself does not store analytics or marketing data for us. The retention periods are determined by the respective tools loaded via Google Tag Manager, as described above.

5. Consent Management

We use Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark) as our consent management platform. Cookiebot enables us to obtain, manage and document your consent preferences. In this context, Cookiebot processes your consent status, including your consent choices, the time of consent and technical information such as browser and device data. This processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in ensuring the lawful use of cookies and similar technologies and in documenting and managing user consent in accordance with legal requirements.

Retention period: 12 months. However, in some cases, e.g., due to legal retention periods, we might be under the legal obligation to continue the storage of your personal data.

6. Obligation to Provide Data

Providing your personal data is voluntary. There is no statutory or contractual obligation to provide such data. However, without providing the mandatory form fields, namely your name, work email address and company, you will not be able to submit the contact form and schedule an introductory call through our website. Providing your role is optional.

7. Data Receivers

The service providers listed in this privacy policy may act as recipients of personal data.

Where service providers process personal data on our behalf, the processing is governed by applicable data processing terms or data processing agreements in accordance with Art. 28 GDPR. Where service providers are located outside the European Economic Area, appropriate safeguards for international data transfers are applied in accordance with Chapter V GDPR.

Hosting: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, for cloud-based hosting on Amazon Web Services (AWS), with data centres within the European Union.
Consent management: Cookiebot (Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark), for managing cookie consent preferences.
Cloudflare: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, for content delivery, website security, performance optimization and protection against abusive traffic. In this context, Cloudflare may process technical data such as IP addresses, request data, browser and device information, log data and security event data.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

8. International Data Transfers

Your personal data is primarily processed within the European Economic Area. However, it may also be transferred to recipients located outside the European Economic Area (third countries), such as the United States. In such cases, data transfers are carried out in compliance with the requirements of Chapter V GDPR. This includes, in particular, the use of standard contractual clauses adopted by the European Commission pursuant to Art. 46 para. 2 lit. c GDPR or, where applicable, transfers on the basis of an adequacy decision pursuant to Art. 45 GDPR (e.g. the EU-US Data Privacy Framework). You may request further information on the applicable transfer mechanisms as well as a copy at any time. Please contact us at info@zelara.ai.

9. No Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data, subject to the applicable legal requirements:

Right of access (Art. 15 GDPR) — obtain confirmation and a copy of your data.
Right to rectification (Art. 16 GDPR) — correct inaccurate data.
Right to erasure (Art. 17 GDPR) — request deletion of your data.
Right to restriction of processing (Art. 18 GDPR) — limit how we process your data.
Right to data portability (Art. 20 GDPR) — receive your data in a structured, machine-readable format.
Right to object (Art. 21 GDPR) — object to data processing.
Right to withdraw consent (Art. 7(3) GDPR) — withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Right to lodge a complaint (Art. 77 GDPR) — file a complaint with a supervisory authority. The competent authority for Zelara GmbH is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany.

To exercise your rights, contact us at info@zelara.ai.

11. Changes to this Policy

We may update this privacy policy from time to time. Any changes will be posted on this page. We encourage you to review this policy periodically.

12. Contact

For any privacy-related questions, please contact: info@zelara.ai