1. Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
- Address
- ZCP UG (haftungsbeschränkt), represented by its managing director Hadi Sultani · Kaitzer Straße 131 · 01187 Dresden · Germany
- Contact
- Phone +49 176 84362604 · Email info@zcp-de.com
2. Data protection officer
We have not appointed a data protection officer, as there is no legal obligation to do so. Please send any questions about data protection to the contact details under 1.
3. Hosting and server logs
This website is operated on our behalf by Arcturis, owner Nikita Medvedev, Ahornstr. 5C, 01458 Medingen, Germany. Arcturis delivers it from its own server in Germany; each client website runs there in its own isolated environment. The server is located in the Falkenstein data centre (FSN1) of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. We have a data processing agreement with Arcturis under Article 28 GDPR. Hetzner, as data centre operator, is a sub-processor of Arcturis under an agreement of the same kind. No data are transferred to countries outside the EU.
When you visit the website, the server automatically processes: shortened IP address, date and time, requested address, amount of data transferred, status code, and browser and operating system. This is technically necessary to deliver the website, to keep it secure and to prevent and investigate attacks. The data are not combined with other data.
- Legal basis
- Article 6(1)(f) GDPR. Our legitimate interest is the secure and error-free operation of the website.
- Retention
- The logs are deleted after 7 days unless they are needed to investigate a security incident.
- Encryption
- The connection between your browser and the server is encrypted with TLS.
4. Cookies and storage in your browser
We do not set cookies. In your browser we store only what a function you use requires, and only until you close the window: whether you have agreed in the chat to your questions being stored, and your details from the feasibility check so that you can carry them over into the Sample Lab or the contact form.
- Legal basis
- Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); Article 6(1)(f) GDPR.
5. Contact form, meeting requests and email
If you write to us via the contact form, the meeting request or by email, we process your details to answer your enquiry.
- Data
- Name, company, role, email address, optionally phone and country, the details for the chosen enquiry type and your message; for a meeting request, your preferred time. Details carried over from the feasibility check, the Sample Lab or the chat are only transmitted when you send the form.
- Transmission
- Transmission is encrypted and runs via the Arcturis server. From there, the details are sent by email to our mailbox at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.
- Purpose
- Handling your enquiry, preparing a meeting and preparing a possible collaboration.
- Legal basis
- Article 6(1)(b) GDPR where your enquiry relates to a contract; otherwise Article 6(1)(f) GDPR (legitimate interest in answering enquiries).
- Spam protection
- To protect against automated submissions, we use a hidden field and a time check on the server. No data are passed to third parties.
- Disclosure
- We do not pass your enquiry on to third parties. If we would like to involve our network partner Innonet in Canada in our answer, we will ask you first.
- Video calls
- If a meeting takes place by video, we will tell you the service in advance. Its privacy notice then also applies.
- Retention
- We delete your enquiry once it has been fully handled and no collaboration follows, at the latest after 6 months. Statutory retention obligations under commercial and tax law (Section 257 HGB, Section 147 AO) remain unaffected.
6. Sample requests (Sample Lab)
- Data
- In addition to contact details: company and delivery address, technical details (substrate, processing, temperature, quantity, test objective) and an attached file if you upload one. Each request receives a reference number.
- Transmission
- As for contact enquiries (section 5).
- Purpose and legal basis
- Reviewing, preparing and shipping the sample; Article 6(1)(b) GDPR and your consent in the form (Article 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.
- Recipients
- For shipping, we pass your name, company and delivery address to the carrier we commission.
- Retention
- As for contact enquiries; shipping records in line with statutory retention periods.
7. Feasibility check
The feasibility check runs in your browser. Your details only leave it when you send us the project brief. Section 5 then applies; your consent when sending is an additional legal basis (Article 6(1)(a) GDPR).
8. Chat assistant “Ask ZCP”
The assistant is an AI system. It answers questions from the content of this website. The language model runs on the Arcturis server in Germany (section 3); your questions are not sent to external AI providers.
- Processing
- To answer, the server processes your question, the language of the page and a random session ID. It briefly keeps the context of your last questions in memory to understand follow-up questions. To prevent misuse, it counts requests per IP address; this count is also held in memory only and is not stored.
- Log
- Without your consent, we log for each question only the time, the language, the detected intent, the knowledge entries used and the response time, without the text of the question and without the IP address. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is operating and improving the assistant.
- With consent
- If you agree in the chat, we also store the text of your questions to improve the assistant. Email addresses, phone numbers and names are automatically masked first; at most 200 characters per question are stored. The legal basis is Article 6(1)(a) GDPR. You can withdraw your consent at any time by unticking the box.
- Retention
- We delete the logs after 30 days.
- In your browser
- We do not store the conversation in your browser. “Clear conversation” removes it from the window.
- Hand-over
- If you choose “Check feasibility”, “Request samples” or “Book a meeting”, details from the chat are carried over into the relevant form. They are only transmitted when you send that form.
- Please note
- Please do not enter health or patient data in the chat. The assistant's answers are not advice and may contain errors.
9. Fonts
The fonts on this website (Instrument Sans, Instrument Serif, Geist Mono) are hosted on our server. No connection to Google or other font providers is made when the page loads.
10. Maps and social networks
The map on the contact page is a graphic on our server. Only if you choose “Open in OpenStreetMap” do you leave our website; the privacy policy of the OpenStreetMap Foundation then applies. We do not use social media plugins.
11. Recipients and transfers to third countries
Your data are received only by us and, as processors, Arcturis (operation of the website, see section 3) with Hetzner Online GmbH (data centre) and IONOS SE (email), plus the carrier we commission when samples are shipped. No data are transferred to countries outside the EU.
12. Obligation to provide data
You are not obliged to provide data. Without the details marked as required, however, we cannot handle an enquiry, sample request or meeting request.
13. Retention periods at a glance
- Server logs
- 7 days
- Enquiries without collaboration
- until closed, no longer than 6 months
- Business correspondence and accounting records
- under Section 257 HGB and Section 147 AO, up to ten years
- Chat logs
- 30 days
- Chat context and count per IP address
- in memory only, not stored
14. Your rights
You have the following rights towards us. An informal message to info@zcp-de.com is sufficient.
- Access to your stored data (Article 15 GDPR)
- Rectification of inaccurate data (Article 16 GDPR)
- Erasure (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Withdrawal of consent with effect for the future (Article 7(3) GDPR)
Right to object under Article 21 GDPR
Where we process your data on the basis of a legitimate interest (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds or the processing serves legal claims.
You may object to the use of your data for direct marketing at any time without giving reasons.
15. Right to lodge a complaint with a supervisory authority
You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is:
- Authority
- Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner) · Maternistraße 17 · 01067 Dresden · Postal address: Postfach 11 01 32, 01330 Dresden · www.datenschutz.sachsen.de
16. Changes
We update this policy when services or the legal situation change. The version published here applies.
- As of
- October 2026