EU Privacy Notice
This notice explains how the applicable Zoiko entity handles personal data for people in the European Union and European Economic Area, including why we process it, who we share it with, how long we keep it, international transfers, and your data protection rights.
Key facts before the full notice
CONTROLLER
[ Validated legal entity name + address ]
EU REPRESENTATIVE
[ Rendered only when Article 27 applies and is validated ]
DPO / PRIVACY CONTACT
[ Approved contact channel ]
APPLIES TO
[ Validated audience/service scope ]
INTERNATIONAL TRANSFERS
See transfer details — [ status summary, no generic claim ]
RIGHTS
Access, correction, deletion, restriction, portability, objection, consent withdrawal — as contextually applicable.
Controller, Representative & DPO
Use an accountability card model: entity identity on one side, contact actions on the other. For multiple entities, use a footer table—each row must answer "when does this entity apply?"
| FIELD | VALUE |
|---|---|
| Controller legal name | [ Required — validated entity name ] |
| Registered address | [ Required when applicable — structured address ] |
| Contact channel | [ Required — privacy-specific channel preferred; no dead link ] |
| EU representative | [ Conditional — role, name/entity, address/contact only when legally applicable and opted in ] |
| DPO | [ Conditional — functional contact preferred over unnecessary personal name ] |
| Joint controllers | [ Conditional — explains arrangement essence and contact point where applicable ] |
| Processor-only contexts | Controller status is never implied where Zoko acts solely on customer instructions — routed to the customer/controller where appropriate. |
Collection Sources & Personal Data Categories
| SOURCE | DISCLOSURE BEHAVIOR |
|---|---|
| Provided directly by you | Account, contact, form, support, billing, event, or request data — only categories actually collected. |
| Generated through service use | Device, log, usage, configuration, security, or diagnostic data — defined in understandable terms, never "technical data" alone. |
| Customer / organization | Enterprise provisioning, workspace, or employment-related identifiers where applicable, with the customer/controller relationship explained. |
| Third parties | Identity providers, integration partners, public sources — source category and purpose identified; timing/process Legal-reviewed. |
| Cookies / similar technologies | Cross-linked to Cookie Policy and Cookie Preferences. |
Processing Purposes Matrix
The core product-like component of this notice. Forces each purpose to carry the fields needed for understandable accountability, preventing vague statements.
| PURPOSE | DATA CATEGORIES | LEGAL BASIS | RECIPIENTS | TRANSFER |
|---|---|---|---|---|
| [ Validated plain-language outcome ] | [ Specific categories ] | [ Exact approved basis ] | [ Recipient category ] | Y/N/Conditional |
| [ Validated plain-language outcome ] | [ Specific categories ] | [ Exact approved basis ] | [ Recipient category ] | Y/N/Conditional |
Legal Basis & Legitimate Interests Pattern
| BASIS | UI TREATMENT |
|---|---|
| Contract | Explains what service/contractual step the processing supports — never claims necessity without Legal approval. |
| Legal obligation | Names or describes the obligation at an appropriate level where validated. |
| Legitimate interests | States the specific interest with a "Learn about our balancing assessment" route where approved — never uses "business purposes" as the sole explanation. |
| Consent | States what consent covers, with a withdrawal route as easy to find as the original action. |
| Special-category condition | Mapped separately from the Article 6 basis — never conflated. |
International Transfers
| FIELD | REQUIREMENT |
|---|---|
| Destination | Country or region when known and publishable. |
| Mechanism | Adequacy decision, SCCs, BCRs, derogation, or other validated mechanism. |
| Safeguard access | How a data subject can obtain a copy or information about safeguards. |
Retention & Deletion
| FIELD | REQUIREMENT |
|---|---|
| Retention period / criteria | Concrete period when possible; objective criteria if no fixed period. |
| Trigger | Account closure, contract end, request resolution, statutory period, consent withdrawal. |
| Post-retention action | Delete, anonymize, aggregate, or archive under legal hold. |
Automated Decision-Making, Profiling & AI
Conditional but designed in advance — distinguishes ordinary automation/AI from solely automated decisions producing legal or similarly significant effects.
| FIELD (IF APPLICABLE) | VALUE |
|---|---|
| Decision / profiling activity | [ Plain-language description ] |
| Meaningful information about logic | [ Human-understandable factors/process — no security-sensitive disclosure beyond legal requirement ] |
| Human involvement | [ Where and how review occurs ] |
| Right / action | [ Contest, obtain human intervention, express point of view, object ] |
EU/EEA Rights Hub
Access
Ask whether we process your personal data and request access to applicable information/data.
Rectification
Ask us to correct inaccurate or incomplete data.
Erasure
Ask for deletion where the legal conditions are met.
Restriction
Ask us to limit processing in applicable circumstances.
Portability
Request eligible data in a structured, commonly used, machine-readable format where applicable.
Object
Object to certain processing, including processing based on legitimate interests and direct marketing where applicable.
Withdraw consent
Withdraw consent at any time for processing based on consent, without implying retroactive invalidity.
Automated decisions
Exercise applicable rights regarding qualifying automated decision-making.
Complain
Contact the competent supervisory authority — you never need to contact Zoko first.
Rights Request Workflow & Identity Verification
Choose request type
Access, correction, deletion, restriction, portability, objection, consent, automated decision, other privacy question.
Identify relationship/context
Product/service, website, customer organization, applicant, partner, other — "not sure" supported.
Provide contact details
Minimum information needed to locate/respond, with an explanation of why each field is needed.
Verification
Risk-based requests only necessary information — no ID collection by default unless justified.
Request details
Optional free text with structured selectors, with a warning against including unnecessary sensitive data.
Review & submit
Summary, privacy notice link, accessible confirmation.
Confirmation
Reference number, next-step expectations, contact route — no unsupported deadline promise beyond approved policy.
Complaints, Supervisory Authorities & Contact
Individuals may lodge a complaint with a competent data protection supervisory authority. This page never implies a person must contact ZokoSuite first — a privacy contact route is offered only as an option.
| ELEMENT | REQUIREMENT |
|---|---|
| Privacy contact | Approved functional contact or DPO channel. |
| Authority finder | Link to authoritative EU/EEA supervisory-authority resources, or country-specific authority with scope known. |
| Response expectations | Legally and operationally validated timing language, accounting for extensions/identity clarification where applicable. |
Contact
Uses the approved public privacy contact route only — never invents a privacy email, postal address, or phone number.