This privacy policy informs you, in accordance with Art. 13 and Art. 14 GDPR, about the processing of personal data when you visit our website and when you use our services.
1. Controller
ZERO Cybernetic Systems & Digital Solutions UG (haftungsbeschränkt)
Fidicinstr. 23
10965 Berlin
Germany
Represented by: Azad Kader, Managing Director
HRB 258363 B (Amtsgericht [Local Court] Berlin-Charlottenburg)
Contact for data protection matters: privacy@zerotrust.is
We have not appointed an external data protection officer, as we do not reach the thresholds of § 38 BDSG (German Federal Data Protection Act).
2. Competent supervisory authority
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information, BlnBDI)
Friedrichstr. 219, 10969 Berlin
https://www.datenschutz-berlin.de
You have the right to lodge a complaint about us with this authority at any time.
3. What data we process
We process only data that is technically necessary for the provision of our services. We do not track, we do not profile, we do not sell data.
3.1 When merely visiting the website
When our pages are accessed, the following data is processed temporarily by the web server:
| Data category | Purpose | Retention period |
|---|---|---|
IP address — stored in truncated form (last octet or the last 96 bits removed, e.g. 203.0.113.0) |
Abuse prevention (rate limiting / attack protection), error analysis | up to 7 days |
| Date + time of access | Error analysis | 7 days |
| Requested URL + HTTP status | Error analysis | 7 days |
| User agent (browser) | Browser compatibility | 7 days |
| Referrer URL | not logged | — |
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in security logging).
The IP address is truncated by the web server at the moment the log entry is written; a complete address is not stored at any time.
3.2 When ordering or contacting us
For orders, beta-interest registrations or contact by email, we collect:
| Data category | Purpose | Retention period |
|---|---|---|
| First and last name | Order processing, delivery | 10 years (§ 147 AO [German Fiscal Code]) |
| Delivery address | Shipping | 10 years (§ 147 AO) |
| Email address | Order confirmation, shipment tracking | 10 years (§ 147 AO) |
| Telephone number (optional) | Queries | until deletion on request |
| Order details, payment method | Billing | 10 years (§ 147 AO) |
| Signal contact (phone number or Signal username) — stored encrypted | Contacting you about a booked consulting or support appointment, queries and rescheduling | 14 days after the appointment, then deleted automatically |
| Appointment slot for workshop service | Drop-off/pickup coordination | until completion of the order + 6 months |
Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract) and lit. c (statutory retention obligation for invoices).
The 10-year retention of order and invoice data is required by law (§ 147 AO, § 257 HGB) and is not a free decision on our part. Without this obligation, we would store this data for a considerably shorter period.
You only provide the Signal contact if you book a consulting or support appointment. It is stored encrypted, does not appear on your order page and is used exclusively for that appointment. A daily job deletes it automatically 14 days after the appointment; if no appointment has been booked yet, the order date applies. Until then we keep it so that we can reach you in the event of rescheduling or open queries. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). You can request earlier deletion at any time — but then the channel through which we reach you for the appointment is gone.
3.3 Cookies
We use no tracking cookies, no advertising cookies, no Google Analytics, no Facebook Pixel.
The following technically necessary cookies are set:
| Cookie | Purpose | Lifetime |
|---|---|---|
wp_* (session) |
WP login + cart | Session |
zero_lang |
Language preference (DE/EN) | 1 year |
| WooCommerce session | Cart persistence | Session |
Legal basis: Art. 6 para. 1 lit. b GDPR or § 25 para. 2 no. 2 TDDDG (technically necessary, no consent required).
4. Processors
We use as few external service providers as possible. Where processing on behalf of a controller pursuant to Art. 28 GDPR takes place, a data processing agreement is in place or will be concluded.
4.1 Hosting
1984 ehf., Reykjavík, Iceland — operation of the website and shop on a server in Iceland. (Iceland is a member of the EEA; the GDPR applies directly, and there is no transfer to a third country.)
– Privacy information: 1984.is/GDPR
4.2 Sending of emails
Transactional emails (order confirmations, shipping notifications) are sent server-side by our shop server (1984, Iceland) — no external email delivery service provider is involved.
Our contact mailboxes (contact@, orders@, privacy@ … @zerotrust.is) are hosted by Proton AG, Geneva, Switzerland (an adequacy decision of the European Commission exists for Switzerland). No advertising emails, no active newsletter.
4.3 Payment processing
- Crypto (BTC/XMR): via a self-hosted BTCPay server on our own infrastructure — no external payment provider, no disclosure to third parties.
- SEPA bank transfer: directly to our business bank — processing by your bank and our bank in accordance with the data protection law applicable to each.
- Cash payment at the workshop appointment: no electronic data processing.
4.4 Appointment booking (workshop services)
Appointments are allocated via self-hosted software on our own infrastructure — no external booking service provider.
4.5 Backups
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — encrypted (GPG) off-site backups on a Storage Box in Germany (EU). Personal data in backups is encrypted client-side.
– Data processing agreement: Hetzner standard data processing agreement.
– Privacy policy: https://www.hetzner.com/legal/privacy-policy
5. Disclosure of data
Your data is disclosed to third parties only:
- to public authorities where we are legally obliged to do so (e.g. the tax office in connection with invoice retention)
- to shipping service providers (DHL, Hermes etc.) — delivery address only, no order contents
- to our tax adviser in the course of bookkeeping (professional secrecy)
- for workshop appointments: NO disclosure of data (service on site by our workshop)
No disclosure of data to advertising providers, analytics tools, tracking services or similar third parties.
6. Your rights as a data subject
You have the following rights vis-à-vis us:
- Right of access (Art. 15 GDPR) — which data we have stored about you
- Right to rectification (Art. 16 GDPR) — correction of inaccurate data
- Right to erasure (Art. 17 GDPR) — provided that no statutory retention obligations preclude it
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR) to processing based on legitimate interests
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — see section 2
To exercise your rights, please contact privacy@zerotrust.is or write to us by post at our address.
7. .onion mirror (Tor)
Our website can also be reached via a Tor hidden service. When using it via Tor:
– NO IP address is logged (Tor architecture)
– server logs show only incoming Tor connections without a source IP
– the connection is end-to-end encrypted by the Tor network
You will find the .onion address in the footer and in the Onion-Location HTTP header.
8. Security
We take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse and unauthorised access — including:
– transport encryption (HTTPS/TLS) on all connections
– data minimisation: we collect only what is necessary for the provision of our services
– access restrictions and regular updating of our systems
– encrypted backups stored separately
For security reasons, we do not disclose details of our protective measures here; we will demonstrate them to the supervisory authority on request.
9. Changes to this policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements. In the event of material changes, we will inform you by email (if you have an active order).