Privacy policy

Legal bases at a glance

We process personal data only where one of the following legal bases of the General Data Protection Regulation (GDPR, in German: DSGVO) permits it:

• Art. 6(1)(b) GDPR (contract and pre-contractual measures): for handling inquiries about a potential project and for carrying out orders.
• Art. 6(1)(c) GDPR (legal obligation): for retaining records as required by commercial and tax law.
• Art. 6(1)(f) GDPR (legitimate interest): for delivering and securing the website, protecting the form against misuse and answering general inquiries.

Where we store information on your device or read information from it, this is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG).

Hosting

We use the hosting services of UTRANET GbR to operate this website.

The application and database servers are operated exclusively in a Digital Realty data center in Frankfurt am Main, Germany. The website is delivered exclusively through an NTT Global Data Centers data center in Frankfurt am Main, Germany.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with UTRANET GbR.

Personal data is processed for the purpose of providing, maintaining and securely providing our online services on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and efficient operation of this website.

No personal data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA) in the course of hosting.

Fonts, images and embedded content

All fonts, images, graphics and scripts on this website are stored on our own server. We do not embed content from third-party servers: no Google Fonts, no content delivery networks, no map services, no embedded videos and no social media plugins. As a result, no third party learns your IP address when you visit a page. The only exception is the spam protection in the contact form: it loads a script from Cloudflare, but only once you click into a field of the form (see Protecting the form against misuse).

Blog posts and their images come from our own content management system. No third-party server is contacted for these either.

Contact by email or phone

If you contact us by email or phone, we process the information you provide (for example your name, email address, phone number and the content of your message) in order to handle your request. If your request concerns a potential project or an existing order, the legal basis is Art. 6(1)(b) GDPR; in all other cases it is Art. 6(1)(f) GDPR. Our legitimate interest lies in answering the inquiries addressed to us.

Contact via WhatsApp

You can also write to us via WhatsApp. Our contact page provides a simple link for this purpose. No data is transferred to WhatsApp when you visit our website. WhatsApp opens only when you click the link.

WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a Meta company. If you write to us there, WhatsApp processes your phone number, your profile name, your messages and usage information, such as the time and device. In the process, data may be transferred to WhatsApp LLC and Meta Platforms, Inc. in the USA. Both companies are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has determined an adequate level of data protection (Art. 45 GDPR). How WhatsApp processes your data is described in the WhatsApp privacy policy at www.whatsapp.com/legal/privacy-policy-eea.

We use your messages only to handle your request. If your request concerns a potential project or an existing order, the legal basis is Art. 6(1)(b) GDPR; otherwise it is Art. 6(1)(f) GDPR. Our legitimate interest lies in offering you a fast way to contact us. We delete the chat history once your request has been dealt with, unless retention obligations require otherwise.

Using WhatsApp is voluntary. If you do not want to send your inquiry through Meta, you can reach us just as well by email or phone.

Contact and inquiry form

The contact page offers a quick contact form and a project inquiry form. We process the information you enter there:

• Quick contact: name, email address and message, optionally a phone number
• Project inquiry: in addition, company and type of project, optionally an existing website, timeframe, budget range, existing content and systems, and the result of the project assistant

When you submit the form, your inquiry is transmitted in encrypted form to our web server and sent from there as an email to info@zeasy.software. A confirmation with a copy of your message is sent to the address you provided. We do not use a database or a CRM for this. After that, the inquiry is stored as an email in our mailbox.

The legal basis is Art. 6(1)(b) GDPR if the inquiry is aimed at a project or a contract; otherwise it is Art. 6(1)(f) GDPR. We need the mandatory fields to answer the inquiry. The form cannot be submitted without them; all other information is voluntary.

We delete the inquiry once it has been fully dealt with, unless statutory retention obligations require otherwise. If the inquiry leads to an order, the retention periods under commercial and tax law apply (up to ten years under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO)).

Protecting the form against misuse

To prevent the form from being misused by automated programs, we use three measures:

• an additional field that is invisible to humans and is filled in only by programs
• a limit on how often the form can be submitted per minute from the same IP address. For this purpose, our server stores only a hash of the IP address, not the IP address itself. The hash is valid for one minute.
• Cloudflare Turnstile, a service that distinguishes humans from programs. In most cases the check runs unnoticed in the background. Only if that is not sufficient does a checkbox appear for you to click.

Turnstile is provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile is loaded only once you click into a field of the form. Merely visiting the contact page does not transmit anything to Cloudflare. From that moment on, Cloudflare processes your IP address, your browser’s user agent, technical characteristics of the connection and the browser (such as a TLS fingerprint), as well as the site key and the address of our website. From this, Cloudflare determines whether a human is using the form and passes a token to your browser. When you submit the form, our server has Cloudflare confirm this token and in doing so also transmits your IP address. Cloudflare does not receive what you write in the form.

Cloudflare performs the check on our behalf. In addition, Cloudflare uses the same data under its own responsibility to improve its bot detection. In the process, data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has determined an adequate level of data protection (Art. 45 GDPR). Cloudflare additionally bases transfers on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). Further details can be found in Cloudflare’s Turnstile privacy notice at www.cloudflare.com/turnstile-privacy-policy and in Cloudflare’s privacy policy at www.cloudflare.com/privacypolicy.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the form and our mailbox against automated mass submissions. To the extent that Turnstile reads information from your browser for this purpose, this is strictly necessary for the submission you have requested (§ 25(2) no. 2 TDDDG).

Project assistant

The project assistant on the home page and the contact page calculates a rough estimate of budget and timeframe from four selections. The calculation runs entirely in your browser. Your selections and the result are transmitted only if you carry them over into an inquiry and submit it.

Storage on your device

This website does not set cookies and does not use any services for audience measurement or advertising. For two purposes, it stores entries in your browser’s storage (localStorage or sessionStorage). They remain on your device and are not transmitted to us:

• “zeasy-thema” (localStorage): the light or dark display mode, if you have chosen it yourself. It remains stored until you delete it in your browser.
• “zeasy-lader” (sessionStorage): records that the intro animation has already played in this session. It is deleted when you close the tab.

These entries are strictly necessary for the use of the website that you have requested. The legal basis is § 25(2) no. 2 TDDDG, and for the subsequent processing Art. 6(1)(f) GDPR.

Links to social networks and other websites

We refer to our profiles on Instagram and LinkedIn and to our clients’ websites by means of simple links. No data is transferred to these providers when you visit our site. Only when you click a link does the third-party page open, and the respective provider is responsible for the processing there.

Encryption

For security reasons, this website uses TLS encryption. You can recognize an encrypted connection by “https://” in your browser’s address bar. Data you transmit to us, for example via the form, therefore cannot be read by third parties.

Storage period

Unless a more specific storage period is stated in this policy, we delete personal data as soon as the purpose of the processing no longer applies or you object to the processing with justification. This does not apply to data that we are required to retain for longer due to statutory retention obligations. Such data is blocked until the retention period expires and deleted afterwards.

Your rights

You have the following rights against us with regard to your personal data:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)

Right to object under Art. 21 GDPR: where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims.

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

For any data protection request, an informal message to the address stated above is sufficient.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR (Art. 77 GDPR). The authority responsible for us is:

The State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de