Privacy Policy

Effective from October 19, 2026

1. Introduction

Data protection is a very important topic for us. Therefore, we have set ourselves the goal of keeping this privacy policy as simple and transparent as possible.

2. Data Controller

The data controller is Ziya GmbH, Emil-Figge-Straße 80, 44227 Dortmund, Germany. The email address is info@ziya.de.

3. Processing of Personal Data

3.1 Processing of Personal Data When Visiting the Website

When you visit our website, your browser automatically sends information to our server, which is temporarily stored. This information includes your IP address, date and time of access, the page visited, and other information that your browser transmits to us.

We collect this data to ensure the smooth functionality of the website and security, as well as for administrative purposes. If further storage of your data is no longer necessary, it will be deleted.

We use SSL or TLS encryption for the encrypted transmission of data.

The legal basis for data processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest arises from the above-mentioned purposes of data collection.

Please note section "4. Provider for Our Web and Email Servers or Services".

Please also note section "6. Analytics Tools".

3.2 Processing of Personal Data When Contacting Us via Contact Form

When you contact us through the website's contact form, you may be asked to provide personal data such as your name, email address, and the content of your message.

This data is collected to respond to your inquiry and to maintain further contact with you. Technical data, such as your IP address, is also collected. If further storage of your data is no longer necessary, it will be deleted.

Data processing is carried out in accordance with Art. 6 para. 1 lit. a GDPR on the basis of your voluntarily given consent.

Please also note sections "3.1 Processing of Personal Data When Visiting the Website" and "4. Provider for Our Web and Email Servers or Services".

Your request reaches us as an email. We may use AI services when processing it; see section "5. AI Services".

If you have consented to the usage analysis spur, your request, including an appointment booking, is linked to your usage data; see section "6.1 Usage analysis with spur".

3.3 Processing of Personal Data When Contacting Us via Email

To contact us by email, you must provide us with a valid email address so that we can respond to your message.

The data transmitted to us (e.g., your email address) will be stored to enable a response. If further storage of your data is no longer necessary, it will be deleted.

Security gaps in end devices or on the transport route can never be completely ruled out; consequently, the data cannot be completely protected against access by third parties. Please consider this aspect when contacting us.

Data processing is carried out in accordance with Art. 6 para. 1 lit. a GDPR on the basis of your voluntarily given consent.

We may use AI services when processing emails; see section "5. AI Services".

Please note section "4. Provider for Our Web and Email Servers or Services".

3.4 Processing of Personal Data for Newsletter Registration and Usage

When you register for our newsletter, we collect and process your email address to regularly provide you with information about our products, services, and news.

For newsletter registration, we use the double opt-in procedure. This means that after registration, you will receive an email asking you to confirm your registration. This confirmation is necessary to prevent anyone from registering using email addresses that do not belong to them.

Newsletter registrations are logged to verify the registration process. This includes storing the registration time, confirmation time, and IP address.

We analyze the opening and clicking behavior of newsletter recipients to improve the relevance and effectiveness of the content. Anonymized data about opened emails and clicked links are collected for this purpose.

Data processing is based on your consent according to Art. 6 Para. 1 lit. a GDPR. You can withdraw your consent at any time by clicking the unsubscribe link at the end of each newsletter or by sending us a message at newsletter@ziya.de.

Your email address will be stored as long as you remain subscribed to the newsletter. After unsubscribing from the newsletter, your data will be deleted unless you have explicitly consented to further use or we reserve the right to use data beyond this purpose, which is legally permitted.

If you have consented to the usage analysis spur, your registration is linked to your usage data; see section "6.1 Usage analysis with spur".

3.5 Additional Processing of Personal Data for Transfer to Partner Companies and External Service Providers

To process contact inquiries that reach us via the contact form, email, telephone, or calendar services, it may be necessary to transfer your data, in whole or in part, to carefully selected partner companies. These are particularly service providers in the field of artificial intelligence (AI) and IT, who support us in providing content or technical assistance in responding to your inquiry and delivering our services.

The transfer only takes place when it is necessary to appropriately answer your inquiry, process it professionally, or prepare or deliver a requested service. In individual cases, your inquiry may therefore also be completely forwarded to a partner company if it has the required professional expertise.

We have concluded joint responsibility agreements with these partner companies in accordance with Art. 26 GDPR. This ensures that your data is only processed for specific purposes and that you can exercise your rights (access, rectification, erasure, restriction, objection, data portability) both towards us and towards the respective partner company. You can exercise your rights at any time via our central contact address info@ziya.de; if you have provided us with a telephone number, we may also contact you by telephone to process your request. We will be happy to provide you with an overview of the partner companies currently in use upon request.

The processing of your data is based on Art. 6 para. 1 lit. a GDPR, provided you have given us your express consent to do so. In addition, the processing is based on Art. 6 para. 1 lit. b GDPR when it is necessary for the processing of your inquiry or for the implementation of pre-contractual measures. In certain cases, the transfer may also be based on our legitimate interest according to Art. 6 para. 1 lit. f GDPR – in particular to ensure efficient and high-quality processing of your inquiry.

No transmission to other third parties or for other purposes takes place.

These partner companies are to be distinguished from the AI services in section "5. AI Services": they do not process data under joint responsibility with us, but solely on our behalf.

4. Provider for Our Web and Email Servers or Services

The provider that provides us with the servers or services so that we can present our website to you and receive and send emails is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter Hetzner).

You can find Hetzner's privacy policy at https://www.hetzner.com/de/legal/privacy-policy/.

We have concluded a data processing agreement (DPA) with Hetzner.

5. AI Services

For certain tasks we use AI services from external providers. They process the data we hand to them for this purpose solely on our behalf and on our instructions (processing on behalf under Art. 28 GDPR). They may not use the data for their own purposes, in particular not to train their AI models.

We use AI services:

when processing emails, including requests that reach us through the contact form or an appointment booking (see sections 3.2 and 3.3), and
when evaluating the usage analysis spur, if you have consented to it (see section 6.1).

The data concerned may be transmitted to the AI service in the process, for example the content of an email together with name and email address, or the usage data of a visit. We review the results ourselves. We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing (Art. 22 GDPR).

Transmission to an AI service is based on the same legal basis as the processing it serves: for the usage analysis on your consent (Art. 6 para. 1 lit. a GDPR), for emails and requests on the legal basis stated in section 3 and on our legitimate interest in handling requests promptly and carefully (Art. 6 para. 1 lit. f GDPR).

5.1 Microsoft Foundry

The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Processing on our behalf is governed by the Microsoft Products and Services Data Protection Addendum. Where data is transferred to the USA in the process, this is based on the EU-U.S. Data Privacy Framework, under which Microsoft Corporation is certified (adequacy decision under Art. 45 GDPR), and on the EU Standard Contractual Clauses agreed in the Data Protection Addendum (Art. 46 para. 2 lit. c GDPR).

You can find Microsoft's privacy policy at https://privacy.microsoft.com/en-us/privacystatement.

5.2 Anthropic

The provider is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Processing on our behalf is governed by the Data Processing Addendum that forms part of Anthropic's terms. Anthropic also processes data in the USA; this transfer is safeguarded by the EU Standard Contractual Clauses agreed in the Data Processing Addendum (Art. 46 para. 2 lit. c GDPR).

You can find Anthropic's privacy policy at https://www.anthropic.com/legal/privacy.

6. Analytics Tools

We use analytics tools to improve and optimize our website.

6.1 Usage analysis with spur (only with your consent)

If you consent in the cookie dialog, we use spur, a usage analysis program that we developed and operate ourselves. It records how you use our website, so that we can see where content is clear and where visitors get stuck, and improve the website on that basis. Without your consent, spur is not loaded; your browser then fetches nothing of it.

The following is recorded:

the pages requested, including navigation within the website, with the page title, the referring page (referrer), campaign parameters of the address and the time spent (in total, visible and active),
clicks and taps, with the element clicked, i.e. its label and, where applicable, its link target, as well as repeated clicks and clicks that have no effect,
mouse movements (sampled every 50 milliseconds), the mouse resting on elements together with their visible text, the scroll depth, which sections of a page were visible and for how long, and which headings were in view at the time,
for forms, which field you selected, whether it was filled in or changed and how long that took, as well as failed submission attempts with the information which fields were invalid – but never what you entered,
when copying, only the length of the copied text, never the text itself, and also whether the tab is in the foreground or background, the window size, script errors on the page and loading times,
a recording of how the page was displayed during your visit (a so-called session replay), from which the course of the visit can be followed. Entries in form fields are illegible in it: every character is replaced by an asterisk, so that it is only apparent that something was entered and how much. Areas that show you your own details are made illegible in the same way; the date and time picker of a booking is not recorded at all, so the appointment you choose is not captured either, and
details of your device: browser, operating system and device type (derived from your browser identification, which itself is not stored), screen and window size, the languages set in your browser, time zone, whether you use light or dark mode, whether you have reduced motion turned on, whether your device has a touchscreen and whether the browser is being controlled automatically, as well as which number of visit it is.

Not recorded are the content of your entries, your IP address and your location. Your IP address is processed only transiently in memory when the data is received, in order to fend off abusively many requests, and is not stored. spur does not set cookies.

So that your visits can be related to one another, spur places randomly generated identifiers in your browser: in local storage (localStorage) one identifier for your browser ("spur:v") and one for your current visit ("spur:s"), in session storage (sessionStorage) one for the open tab ("spur:t"). Next to the identifier of your browser are the number of your previous visits and the time of the first one. Beyond that the identifiers contain no information about you, but they make it recognisable that a later visit comes from the same browser. Data that has been captured but could not be sent yet, for instance because the connection dropped, is held back by spur in local storage ("spur:o"), sent on the next page view and then deleted there. Browsers of our own staff additionally carry a mark ("spur:i") so that their visits are kept out of the evaluation; it is not set for you.

If you have consented to the usage analysis and send us a message, book an appointment or sign up for the newsletter via the website, your browser transmits the identifier of your browser and that of your current visit together with your request. We store both with your request, i.e. in the email through which your message or booking reaches us, or with your newsletter subscription. This links the usage data, pseudonymous up to that point, to your request and thereby to your name and email address: we can follow which pages you looked at before your request and answer it better as a result. In spur itself, only the fact that a request was sent successfully is recorded, with the type of form and the page, not its content. Without your consent to the usage analysis, none of this is transmitted.

We evaluate the data ourselves, through a protected interface. For the evaluation we may use AI services, in which case the usage data is transmitted to them; see section "5. AI Services".

spur runs on a server we operate ourselves at Hetzner Online GmbH in Germany (see section 4, including the data processing agreement), and the data is stored there. We neither sell it nor pass it on for advertising purposes.

Placing the identifiers on your device and reading them is based on your consent under Section 25 (1) TDDDG; the further processing of the data, including linking it to your requests, is based on your consent under Art. 6 para. 1 lit. a GDPR.

We store events such as page views, clicks, visible sections and form interactions for 25 months, the recordings of the page display for 90 days and the mouse and pointer data for 13 months. After that, they are deleted automatically. The identifiers transmitted with a request are kept as long as the request itself (see section 3).

You can withdraw your consent at any time with effect for the future. To do so, open "Manage cookies" in the website footer and switch off the usage analysis. spur then stops immediately, the identifiers are deleted from your browser, and all data stored under these identifiers is deleted from our server as well. Identifiers already transmitted to us with a request no longer point to any usage data after that.

6.2 Plausible Analytics (self-hosted)

We use Plausible Analytics to measure the use of our website. We run this software ourselves, on our own server within the European Union. No analytics provider and no other third party is involved in this processing, and no data is transferred to a third country.

Plausible works without cookies. For analytics purposes, no information is stored on your device and no information is read from it – neither through cookies nor through comparable techniques. Consent under Section 25 TDDDG is therefore not required for it. The only information we place on your device in this context is a marker set when you object to the measurement, and that marker is necessary in order to honour your objection.

No identifier is created that would make you recognisable across several days or across different websites. Your IP address and your browser identification are processed only transiently, in order to derive a daily rotating, non-reversible checksum that makes one page view distinguishable from another. Your IP address itself is not stored.

The following is processed:

the page requested,
the referring page, and campaign parameters of the requested address where present,
browser, operating system and device type,
the country, derived from the IP address,
date and time of access, along with the duration and the scroll depth of the page view, and
events triggered – such as clicking a contact button, starting a product video, submitting a form, or opening a QR code short link – each with the technical detail of which control or which section of the page it concerned.

Some of these events are reported from our own server, because only there is it established whether a request was actually delivered. The same applies as above: no cookie, no persistent identifier, no storage of your IP address.

Requests from AI assistants and other automated programs are counted separately from those of human visitors, because they are not people.

From time to time we compare different versions of a page, such as a different headline on the home page. Which version you see is derived on our server, when the page is requested, from your IP address, your browser identification and the current date. The value computed for this is not stored, nothing is placed on your device for it, and a new one results the next day. The only additional information passed to Plausible is the name of the version you were shown. The same legal basis applies as for the rest of the reach measurement. If you object to the measurement, the name of the version is no longer passed on either; which version you see is still determined when the page is requested, without anything about it being passed on or kept.

Data processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to understand which content of our website is used, and to improve it on that basis. For this purpose we have chosen the arrangement that interferes least with your rights: our own server, no cookies, no recognition, no disclosure to third parties.

You may object to this processing at any time under Art. 21 GDPR. To do so, open "Manage cookies" in the website footer and switch off the reach measurement. Your objection takes effect immediately and is stored on this device.

The evaluations produced from this data are aggregated and permit no reference to you as a person; they are retained indefinitely. A reference to an individual device is not possible beyond the day of the visit, because the checksum rotates daily.

7. Cookies

We use cookies on this website. Cookies are small text files placed on your device. These can then be retrieved to remember user decisions, identify users, and technically enable other functionalities.

If these cookies are not technically necessary, we ask for your consent before storing cookies.

Besides cookies, we use your browser's local storage: it holds your choice in the cookie dialog and, where applicable, your objection to the reach measurement (see section 6.2), and it is where the usage analysis spur places its identifiers once you have consented (see section 6.1).

8. Disclosure of Your Data to Third Parties

Your data will only be disclosed to third parties if:

You have given your consent in accordance with Art. 6 para. 1 lit. a GDPR,
The disclosure is necessary for the fulfillment of a contract in which you are one of the affected contractual parties according to Art. 6 para. 1 lit. b GDPR, or the disclosure is necessary for the implementation of pre-contractual measures that are carried out at your request,
The disclosure is necessary for the fulfillment of legal obligations according to Art. 6 para. 1 lit. c GDPR, or
The disclosure is necessary to protect our legitimate interest or to protect the legitimate interest of a third party according to Art. 6 para. 1 lit. f GDPR, provided that your interests or fundamental rights and freedoms requiring the protection of your personal data do not prevail.

9. Rights of Data Subjects

9.1 Right of Access

According to Art. 15 GDPR, you have the right to request information about your personal data processed by us.

9.2 Right to Rectification

According to Art. 16 GDPR, you have the right to request immediate rectification of your inaccurate personal data or the completion of your incomplete personal data stored by us.

9.3 Right to Erasure ("Right to be Forgotten")

According to Art. 17 GDPR, you have the right to request the erasure of your personal data stored by us, provided that the requirements of Art. 17 para. 1 GDPR are met. This right does not apply if the processing of your personal data is necessary for exercising the right to freedom of expression and information, for complying with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.

9.4 Right to Restriction of Processing

According to Art. 18 GDPR, you have the right to request the restriction of processing from us if the accuracy of your personal data is contested, the processing is unlawful but you refuse erasure, we no longer need your personal data but you need it for the establishment, exercise, or defense of legal claims, or you have objected to processing in accordance with Art. 21 para. 1 GDPR, as long as it has not yet been determined whether our legitimate grounds override yours.

9.5 Obligation to Notify in Connection with Rectification or Erasure of Personal Data or Restriction of Processing

We communicate any rectification or erasure of your personal data or restriction of processing to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort.

According to Art. 19 GDPR, you have the right to be informed about these recipients by us.

9.6 Right to Data Portability

According to Art. 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, and to request the transfer of your personal data to another controller, insofar as this is technically feasible.

9.7 Right to Withdraw Consent at Any Time

According to Art. 7 para. 3 GDPR, you have the right to withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Data processing based on this consent may not be continued in the future.

9.8 Right to Lodge a Complaint with a Supervisory Authority

According to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority.

10. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

For direct contact or further information, you can contact our data controller; you can find the relevant information in section "2. Data Controller".

11. Changes to the Privacy Policy

We strive to continually improve our applications and services. Due to changes within this endeavor, it may be necessary to adapt our privacy policy. Another aspect that may result in an adjustment of our privacy policy is changed legal or regulatory requirements.

The current version of our privacy policy can be accessed on this website (https://www.ziya.de/privacy-policy).