1. Who is responsible
Zustack (KvK 67721540) is responsible for the personal data described in this policy. Where we host your data for you, you are responsible and we are the processor. That part is covered by our data processing agreement. Write to [email protected] with any question about privacy.
2. What we collect and why
| Purpose | Data | Basis |
|---|---|---|
| Visit statistics on zustack.dev | Page, referrer, country, device type. No cookies, and no data that identifies a person. | Legitimate interest: understanding what helps visitors |
| Answering your message | Name, email address, company and the message you send through the contact form or by email. | Legitimate interest, and steps before an agreement |
| Running your account | Name, company, email address, phone number, billing address, VAT number and the services you use. | Performance of the agreement |
| Signing in to My Zustack | Email address, one-time sign-in links and codes, IP address, browser type and time of each sign-in. | Performance of the agreement, and security |
| Registering domains | Registrant name, address, email address and phone number, passed to the registrar and the registry. | Performance of the agreement |
| Administration and bookkeeping | Payments and the details we must record. | Legal obligation |
| Support | The messages you send us and what we did about them. | Performance of the agreement |
We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means.
3. Who we share it with
We share personal data only with parties that help us deliver the service, under agreements that protect it:
- Suppliers of our hosting and IT infrastructure, such as data centres and email services.
- Domain registrars and the registries behind each domain extension, to register domains.
- Our accountant, and authorities where the law requires it.
Our servers are in Germany, and we keep personal data within the European Economic Area. Should a supplier process data elsewhere, we make sure the transfer is covered by an adequacy decision or standard contractual clauses.
4. How long we keep it
- Contact form messages: up to 12 months after the last message.
- Customer account data: for as long as you are a customer, and then as the law requires.
- Bookkeeping records: 7 years, which is the Dutch statutory period.
- Sign-in logs: 12 months.
- Registrant data: as long as the domain is registered through us, and as the registry requires.
5. Security
We protect personal data with measures that fit the risk, including encrypted connections, access limited to the people who need it, regular updates and backups. If a personal data breach puts your rights at risk, we tell you and, where required, the Dutch Data Protection Authority, without undue delay.
6. Your rights
You may ask us to show you the data we have about you, correct it, delete it, limit its use, or hand it to you in a usable format. You may object to processing based on our legitimate interest. Where processing relies on your consent, you may withdraw it at any time. Write to [email protected]. We answer within one month, and we may ask you to prove who you are first. Some data we must keep by law, even when you ask us to delete it.
7. Cookies
Our website sets no tracking cookies. My Zustack uses a small number of functional cookies to keep you signed in. Details are in our cookie policy.
8. Changes
We may update this policy. The version number and date at the top show which one applies. If a change matters to you, we tell you by email.
9. Contact and complaints
Write to [email protected]. If you think we handle your data wrongly and we cannot settle it together, you may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.