Your privacy, explained around how the data is actually used.

This policy explains how ZoikoSuite-related personal data is collected, used, disclosed, retained, transferred, and protected — and the choices and rights available to you. Final published wording reflects the approved Privacy Processing Registry.

What we collect

VERIFIED

Why we use it

VERIFIED

Who receives it

CONTEXT-DEPENDENT

How long we keep it

VERIFIED

Where it's processed

CONTEXT-DEPENDENT

Your choices & rights

VERIFIED

WHO THIS POLICY APPLIES TO

I am a...

Context

Examples

Required Distinction

Website visitors

Public site browsing, forms, resource downloads, demo requests.

Website and marketing technology practices.

Customer account users

Named users with ZoikoSuite accounts.

Account, authentication, support, usage, and administration data.

Customer-controlled data subjects

People whose data a customer places in ZoikoSuite.

Controller/processor relationship is explicit; rights are routed appropriately.

Applicants

Careers and recruiting workflows.

Linked to applicant-specific notice if separate.

WHO IS RESPONSIBLE FOR YOUR DATA

Verified controller / operator / processor roles

Field

Content

Primary privacy entity

[ Verified legal name; role; registered address; privacy contact — pending registry ]

ZoikoSuite / Zoiko Tech relationship

[ Legal-approved relationship statement ]

Customer processor context

When ZoikoSuite processes customer-controlled personal data under customer instructions, routes to the DPA.

EU/UK representative

[ Only where required and verified ]

PERSONAL DATA WE COLLECT

Registry-backed categories — not generic SaaS patterns

Specific purposes, not "business purposes"

Provide and secure your account

Linked categories: account & identity, usage & service data.

Legal basis: [ counsel-approved ]Automated processing: No

Deliver customer support

Linked categories: support & communications.

Legal basis: [ counsel-approved ]Automated processing: No

Improve and secure the platform

Linked categories: usage & service data.

Legal basis: [ counsel-approved ]Automated processing: Flagged if applicable

Communicate about your account

Linked categories: account & identity, communications preferences.

Legal basis: [ counsel-approved ]Automated processing: No

COOKIES & SIMILAR TECHNOLOGIES

Summary here — controls live in one place

Cookies or similar technologies may be used according to the verified consent/inventory record — essential, preferences, analytics, and advertising categories only as actually configured. This policy does not maintain a second, conflicting cookie inventory.

HOW PERSONAL DATA IS SHARED

Recipient categories, purpose, and control boundaries

Recipient Category

Disclosure Pattern

Cross-Link

Service providers / processors

Category, purpose, data scope, contractual/control model.

Customer organization

Administrative and service data visible to customer admins per role and contract.

Authorities / legal process

Disclosure when legally required or permitted, subject to validated process.

Corporate transactions

If applicable, due diligence / transfer boundary and notice treatment.

INTERNATIONAL TRANSFERS & DATA RESIDENCY

Transfer mechanisms and residency are related, not interchangeable

Layer

What is explained

Processing location

Where relevant processing/support may occur, based on verified operations and deployment.

Residency configuration

Storage/processing/backup/replication constraints vary by deployment and jurisdiction.

Transfer mechanism

Approved legal transfer mechanism by origin/destination/context, only when actually used.

Customer-controlled / sovereign deployments

Availability and boundaries may differ; one deployment is not generalized to all customers.

RETENTION, DELETION & LEGAL HOLDS

Category-level periods, not vague universal wording

Category / Record Type

Default Retention / Criteria

Trigger

Account & identity data

[ Specific period or criteria — registry ]

Account closure

Support & communications

[ Specific period or criteria — registry ]

Support closure

Customer-controlled content

DPA/contract controls and customer configuration.

Contract end

PRIVACY, SECURITY & CONFIDENTIALITY CONTROLS

Reassurance without security marketing

Control Area

Public Treatment

Access governance

Role/need-to-know principles, where implemented.

Encryption

Only verified implementation scope; no blanket claims.

Logging / evidence

Privacy-relevant auditability at a high level.

Data residency

Deployment/status qualifiers preserved.

AI, AUTOMATION & PROFILING

Generated from the AI/processing inventory, not marketing

Question

Required Disclosure

Is personal data used by AI features?

Context, categories, purpose, user/customer control, provider/model boundary, training status — only where verified.

Is customer content used to train models?

A direct yes/no/context-dependent statement only if verified for every applicable product/deployment.

Are decisions made solely by automation?

If applicable: logic, significance, consequences, and rights. If not, the negative statement requires evidence.

Human oversight

Verified review/authority boundaries.

YOUR PRIVACY RIGHTS AND CHOICES

Action-first — no legal-article guesswork required

Access / know

Correction

Deletion

Portability

Object / restrict

Withdraw consent

Marketing opt-out

Sale/share opt-out (CA)

Appeal

Flow: choose request goal → identify relationship/context → provide minimum contact/identity info → risk-proportionate verification → confirmation + reference number → status updates → fulfillment or denial rationale → appeal/complaint path.

CHILDREN & AGE-RELATED PROCESSING

No invented age threshold or child-directed claim

[ Approved age-eligibility and handling statement, reflecting product eligibility, actual audience, and jurisdiction-specific legal review. ]

BUSINESS CUSTOMERS & PROCESSOR CONTEXT

Separating consumer/website data from customer-controlled data

Topic

Requirement

Customer-controlled data

Contractual roles and instructions may differ from ZoikoSuite's independent-controller activities.

Customer privacy requests

Explains when individuals should contact the customer and how ZoikoSuite assists under contract.

Deletion / return

Contract/DPA-driven treatment — never a universal outcome promised in the public policy.

REGIONAL PRIVACY NOTICES

Global baseline + jurisdiction-specific rights

California Privacy Notice

CCPA/CPRA-specific categories, rights, sale/share status, sensitive PI treatment, and direct opt-out links.

UK Privacy Notice

UK GDPR / Data Protection Act controller/representative/DPO, legal bases, transfers, rights, ICO complaint path.

EU Privacy Notice

GDPR-specific controller/representative/DPO, legal bases, transfers, rights, supervisory authority route.

CHANGES TO THIS POLICY

Versioned, dated, never silently edited

Version

Effective Date

Change Summary

[ Current ]

[ Date ]

[ Counsel-approved summary ]

[ Prior ]

[ Date ] – [ Date ]

[ Summary ]

PRIVACY CONTACTS

Routed by topic, not one inbox

Contact

Requirement

Privacy team

Approved monitored address/form.

DPO

Only if designated and publishable.

Security reports

Route to Security Disclosure — not the privacy inbox.

Whistleblowing

Route to Ethics Reporting — not privacy rights intake.

FREQUENTLY ASKED

Common questions

What personal data does ZoikoSuite collect?

Answered from the published category matrix — no generic categories are listed that aren't actually processed.

Does ZoikoSuite sell or share personal information?

Stated only from the California/privacy registry status, with a route to opt-out where applicable.

Does ZoikoSuite use my data to train AI models?

Answered by product/context/provider/deployment only where verified, linking to Responsible AI.

Where is my data stored?

Storage/processing/residency varies by service/deployment — linked to Data Residency.

How do I delete or access my data?

Directed to the rights request flow or account controls.

Who are ZoikoSuite's subprocessors?

Directed to the current Subprocessor List.