Privacy Policy

GTN Group AG (operating as zwrm) Christaweg 42, 79114 Freiburg, Germany Email: privacy@zwrm.eu

This privacy policy explains how zwrm ("we", "us") collects, uses, and protects personal data when you use our website (zwrm.eu) and our cloud platform services.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR/DSGVO) and the German Federal Data Protection Act (BDSG).

3.1 Website Visitors

When you visit our website, we collect:

• Server log data: IP address, browser type, referring URL, pages visited, date and time of access. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring website security and performance).
• Contact form submissions: Name, email address, company name, and message content. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).
• Waitlist/demo request: Email address. Legal basis: Art. 6(1)(a) GDPR (consent).

3.2 Platform Users

When you use the zwrm platform, we additionally process:

• Account data: Name, email, company name, billing address. Legal basis: Art. 6(1)(b) GDPR (contract performance).
• Usage data: Deployment logs, resource consumption, API calls. Legal basis: Art. 6(1)(b) GDPR (contract performance).
• Payment data: Processed by our payment provider. We do not store credit card numbers.

3.3 Customer Content

Your application data, databases, and files deployed on zwrm are processed solely on your behalf. We act as a data processor under Art. 28 GDPR. A Data Processing Agreement (DPA/AVV) is available on request.

We use personal data to:

• Provide and maintain the zwrm platform
• Process your requests and communicate with you
• Send service-related notifications
• Ensure security and prevent abuse
• Measure website usage in an aggregated, privacy-friendly manner
• Measure the success of our Google Ads campaigns where you have consented
• Comply with legal obligations

We do not sell personal data to third parties. We do not make automated decisions that produce legal or similarly significant effects.

Data relating to the zwrm platform is stored and processed within the European Union. Our core infrastructure is operated by an EU-registered entity.

For consent management we use Usercentrics GmbH, Germany. For privacy-friendly website statistics we use Pirsch Analytics, operated and hosted in Germany. If you consent to Google Ads conversion tracking, data may be processed by Google Ireland Limited and affiliated Google companies. Processing in third countries, including the United States, cannot be ruled out. Google states that it uses recognized transfer mechanisms such as the EU-US Data Privacy Framework and the EU Standard Contractual Clauses where applicable. You can avoid consent-based advertising processing by rejecting or withdrawing advertising consent.

• Account data: Retained for the duration of the contractual relationship, then deleted within 30 days unless legal retention obligations apply.
• Server logs: Deleted after 90 days.
• Contact form data: Deleted after 12 months unless a business relationship is established.
• Billing data: Retained for 10 years as required by German tax law (§ 147 AO).

We use a limited number of service providers to operate our services and website, including Usercentrics GmbH for consent management, Pirsch Analytics for cookieless website statistics, and Google Ireland Limited for Google Ads consent-mode and conversion measurement. Where a provider acts as a processor, it is contractually bound to data-protection requirements. See our Trust Center for the current platform sub-processor list.

Under GDPR, you have the right to:

• Access your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent at any time (Art. 7(3) GDPR)

To exercise these rights, contact us at privacy@zwrm.eu.

9.1 Usercentrics

We use Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, as our consent management platform. Usercentrics stores your consent decision so that the website can respect it and so that we can demonstrate consent. This storage is necessary to provide the consent-management function (§ 25(2) no. 2 TDDDG; Art. 6(1)(c) and (f) GDPR). You can change or withdraw your choice at any time via Cookie settings.

9.2 Pirsch Analytics

We use Pirsch Analytics for aggregated website statistics. Pirsch operates without cookies, does not store IP addresses, does not track visitors across websites, and is hosted in Germany. The legal basis is our legitimate interest in understanding and improving our website (Art. 6(1)(f) GDPR).

9.3 Google Ads conversion tracking

We use the Google tag from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in Google Consent Mode. Before you consent to advertising, advertising storage, advertising user data and advertising personalization remain denied, and advertising identifiers are redacted; Google may receive cookieless consent and measurement signals. If you consent, Google Ads conversion tracking helps us determine whether an advertisement led to an action on our website. Depending on the interaction, Google may then process the page URL, browser and device information, IP address, time of access, advertising identifiers and conversion information, and may store technologies such as _gcl_* in your browser. Consent-based advertising processing relies on your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw consent at any time through Cookie settings; withdrawal does not affect processing that occurred before withdrawal. Current storage technologies and durations are also shown in the consent settings.

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, and regular security assessments.

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

Supervisory authority placeholder. To be filled based on registered office location

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "last updated" date. Material changes will be communicated via email to registered users.