This policy explains what personal data we process when you visit zagrosian.com, contact us or visit our social media profiles, why we process it, and what rights you have. We collect very little, so it is short.

Summary

zagrosian.com has no accounts, forms, advertising, analytics or tracking.
We do not set cookies. Our hosting provider may set a strictly necessary security cookie when it needs to check that traffic is legitimate. If you choose a theme or a language, or turn sound on or off, your browser remembers that choice on your device only.
To deliver the website, our hosting provider processes technical data such as your IP address.
zagrosian.com links to our Instagram and TikTok profiles but loads nothing from those platforms. On the platforms themselves, their own privacy policies apply.
If you email us, we use your message only to reply and follow up. Job applications are deleted within four weeks after the application process ends, unless you agree that we keep them longer.
We do not sell personal data, and we do not use it for advertising or profiling.

Who we are

Zagrosian, based in the Netherlands, is responsible for the processing of personal data described in this policy (the “controller” under the General Data Protection Regulation, or GDPR).

For anything in this policy, including requests about your personal data, email privacy@zagrosian.com. We are not required to appoint a data protection officer and have not done so.

This policy covers zagrosian.com only. Hevalo and our other products have their own privacy policies.

What we process and why

When you visit the website

When you open a page, your browser automatically sends technical information needed to deliver it: your IP address, the date and time of the request, the page requested, your browser and operating system, and the page that referred you, if any.

Our hosting provider, Cloudflare, uses this information to deliver the website, keep it available and protect it from attacks and abuse, for example by filtering malicious traffic. We do not keep server logs ourselves. In our Cloudflare account we can see aggregated statistics, such as the number of requests and the countries they come from, which do not identify you.

Legal basis: our legitimate interest in operating a secure and reliable website (Article 6(1)(f) GDPR).

When you email us

If you email any of our addresses, we process your email address, your name if you provide it, your message and anything else you choose to include. We use this only to read and answer your message and to follow up on it.

Legal basis: our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR) or, if your message is about entering into an agreement with us, taking steps at your request before doing so (Article 6(1)(b) GDPR).

When you apply for a job

If you send an application to careers@zagrosian.com, we process your contact details, your CV and anything else you include, only to assess your application and to communicate with you about it. Please do not send us special categories of personal data, such as health information, unless we ask for it.

Legal basis: taking steps at your request before entering into an employment or other working agreement (Article 6(1)(b) GDPR).

We do not make decisions about you based solely on automated processing, and we do not profile visitors or applicants.

We have profiles on Instagram (@zagrosian_official) and TikTok (@zagrosianofficial). zagrosian.com only links to them: it does not embed posts or load anything from these platforms, so they receive no data from our website until you follow a link.

When you visit, follow or interact with our profiles, the platform processes your personal data under its own privacy policy and is responsible for that processing:

Instagram is provided in the European Union by Meta Platforms Ireland Limited. See the Instagram Privacy Policy.
TikTok is provided in the European Economic Area by TikTok Technology Limited, Ireland. See the TikTok Privacy Policy.

Both platforms show us aggregated statistics about our profiles and posts, such as the number of views and followers and the countries they come from. These statistics do not identify you, and we cannot influence how the platforms compile them. For Instagram, we and Meta are jointly responsible for these statistics under Meta’s Controller Addendum. Meta has taken primary responsibility for them, including for handling requests about your rights, but you can also contact us.

If you comment on our posts or send us a message on these platforms, we see your username, your public profile and your message, and use them only to reply. We handle messages the same way as email.

Legal basis: our legitimate interest in presenting our company and our products and in communicating with people interested in them (Article 6(1)(f) GDPR).

Cookies and local storage

zagrosian.com does not use analytics, advertising or tracking cookies.

If you choose a light or dark theme or a language, turn sound on or off, or close the suggestion to read the site in your language, your browser saves that choice in its local storage (under the names theme, language-chosen and sound), so the website can respect it on your next visit. This information stays on your device, is never sent to us or to anyone else, and you can remove it at any time by clearing the site data in your browser.

Cloudflare may set a strictly necessary cookie, such as __cf_bm or cf_clearance, when it needs to tell people apart from automated traffic or after you complete a security check. These cookies are short-lived, are used only to protect the website, and are not used to follow you across other websites. Because they are strictly necessary for security, they do not require your consent.

We do not sell or rent personal data. We share it only with service providers that help us run the website and handle email, and only as far as they need it:

Cloudflare, Inc. hosts the website and provides content delivery and security. Cloudflare processes data on our behalf under its Data Processing Addendum. See also Cloudflare’s privacy policy.
Email service providers receive, store and send our email.

We may also disclose personal data where the law requires it, for example in response to a lawful request from a public authority, or where it is needed to establish, exercise or defend legal claims.

International transfers

Cloudflare operates a global network, so technical data may be processed outside the European Economic Area (EEA), including in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework and also relies on the European Commission’s Standard Contractual Clauses.

We only use email providers that offer equivalent safeguards for any transfer outside the EEA.

How long we keep data

Technical data: we do not store it. Cloudflare keeps request data for a limited period for security and operational purposes, as described in its privacy policy.
Email and social media messages: we keep correspondence for as long as we need it to handle your message and any follow-up, and delete it no later than two years after our last contact, unless we must keep it longer to meet a legal obligation or to handle a dispute.
Job applications: we delete them no later than four weeks after the application process ends. With your permission, we may keep your application for up to one year, in case another suitable role opens. You can withdraw that permission at any time.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased;
restrict how we process your data;
object to processing based on our legitimate interests;
receive your data in a portable format, where this applies.

To exercise any of these rights, email privacy@zagrosian.com. We will respond within one month. We may ask you to confirm your identity before we act on a request.

You also have the right to lodge a complaint with a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens. You can also contact the authority in the EU country where you live or work. We would appreciate the chance to address your concern first.

Security

The website is served only over encrypted connections and uses a strict Content Security Policy that blocks third-party scripts. It has no user accounts and stores no personal data. If you find a security issue, please read our security policy.

Children

This website is not directed at children, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this policy when our website, our services or the law change. The date at the top of this page shows when it was last updated. If we make significant changes, we will say so clearly on this page.

Contact

For questions about this policy or your personal data, email privacy@zagrosian.com. For anything else, see the contact section on our homepage.