Privacy Policy

Language versions. This Privacy Policy is an English convenience translation. The legally authoritative version is the German "Datenschutzerklärung"; in case of discrepancies, the German version prevails.

Orientation. As a website visitor, Sections 3 to 5 (including the contact form and appointment booking) concern you most. If you deal with us as a contact person of a customer, prospect or partner, additionally Sections 6 and 7. Your rights are summarised in Section 15. A separate Privacy Policy applies to the Zentre AI platform (Section 2).

1. Controller

EZTO TECHNOLOGIES GmbH Am Brand 41, 55116 Mainz, Germany Represented by the Managing Director Martin Knap Commercial register: Local Court (Amtsgericht) Mainz, HRB 54349

Email: info@ezto.io Data protection contact: dpo@ezto.io Legally relevant notices: legal@ezto.io

No data protection officer has been appointed; the point of contact for all data protection matters is dpo@ezto.io. We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG).

2. Scope and delimitation

This Privacy Policy applies to the company website ezto.io (German and English versions), including all sub-pages, contact forms and downloads, and to the business communications of EZTO TECHNOLOGIES GmbH as a technology consulting and development services provider (software development, DevOps and cloud, identity & access management, AI solutions).

Zentre AI. A separate Privacy Policy applies to the Zentre AI SaaS platform (zentre.ai) at zentre.ai/legal/privacy. Where you use or register for Zentre AI, that policy alone governs.

Customer projects. Where we process personal data from our customers' systems in the course of consulting, development or operations services, we do so as a processor (Art. 28 GDPR) under a data processing agreement. In these cases the respective customer is the controller and fulfils the information obligations towards the data subjects.

Employees and applicants. Separate privacy notices apply to employees. Section 8 applies to job applicants.

3. Hosting and server log files

The website is hosted by Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France, in the EU region Paris (fr-par). A data processing agreement (Art. 28 GDPR) is in place with Scaleway; processing takes place in data centres within the EU. The sub-processors engaged by Scaleway are listed in Scaleway's sub-processor list (scaleway.com/en/subprocessorlist).

Each time the website is accessed, the following data is automatically processed in server log files: IP address, date and time of access, page or file requested, volume of data transferred, HTTP status code, referrer URL, and browser type, version and operating system.

Purpose: technical operation and stability of the website, IT security, error analysis and defence against attacks (Art. 32 GDPR). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Retention: log files are deleted after 30 days at the latest, unless longer retention is required in an individual case to investigate a security incident.

4. Cookies, consent management and audience measurement

4.1 Consent management (Usercentrics)

We use the consent management platform of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. On your first visit you are asked to decide on services that require consent. We process your consent decision (opt-in/opt-out per service), date and time, a random consent ID, the banner version and language, the referrer URL and technical browser data (IP address, user agent). Usercentrics operates the platform on Google Cloud (Google Cloud EMEA Ltd.) with server locations in Germany and Belgium. Purpose: obtaining, evidencing and managing consent (Art. 7(1), Art. 5(2) GDPR). Legal basis: Art. 6(1)(c) GDPR (accountability obligation), alternatively Art. 6(1)(f) GDPR. Retention: consent records are kept for up to 3 years.

4.2 Strictly necessary cookies

Strictly necessary cookies and similar technologies (e.g. to store your cookie settings, language selection, security and abuse prevention) are used without consent. They are strictly necessary to provide the service you have expressly requested (Sec. 25(2) no. 2 TDDDG); the legal basis for the associated processing of personal data is Art. 6(1)(f) GDPR.

4.3 Audience measurement (Plausible Analytics)

We use Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia) – a data-minimising, cookieless audience measurement tool operated on servers in Germany – only with your consent (opt-in). Plausible processes pages visited, referrer, browser and device type and the approximate location (country, region, city); IP address and user agent are used only transiently to form a daily-rotating, non-reversible hash and are not stored permanently. No cookies are set and no information is stored on your device. Legal basis: Art. 6(1)(a) GDPR. Without consent, Plausible is not loaded. You may withdraw your consent at any time with effect for the future via the footer link "Cookie Settings".

4.4 Other services requiring consent

Services in the "Marketing" and "External Media" categories (e.g. embedded videos or social media content) are loaded only after your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). The current inventory of all services and cookies used, with provider, purpose and storage duration, is available at any time under "Cookie Settings" in the website footer. Where we additionally publish a Cookie Policy, it applies in addition; in case of conflict, this Privacy Policy prevails.

5. Contact (contact form, email, telephone)

5.1 Contact forms and enquiries

When you contact us via a contact form, by email or by telephone, we process the data you provide: name, business email address, telephone number and company where given, topic selection, your message and the time of the enquiry. Purpose: handling and responding to your enquiry, preparing an offer or contract. Legal basis: Art. 6(1)(b) GDPR where you yourself are to become a party to the contract; where you act for a company, Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries and in initiating a contract with the company you represent). Consent is not required for this processing and is not requested; the reference to this Privacy Policy at the form is for your information (Art. 13 GDPR). Retention: until your enquiry has been fully handled. If a business relationship arises, Section 6 applies. Otherwise we delete the enquiry at the latest 12 months after the last contact, unless statutory retention obligations apply.

5.2 Bot protection (Friendly Captcha)

To protect our forms against automated abuse we use Friendly Captcha (Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany). Your browser solves a cookieless computational puzzle; technical connection and environment data of your browser is processed, with the IP address anonymised by one-way hashing. We use Friendly Captcha's dedicated EU endpoint (processing in data centres in Germany). No cookies are set and no tracking takes place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of the service, Art. 32 GDPR); access to terminal equipment information is strictly necessary (Sec. 25(2) no. 2 TDDDG) – no consent is required.

5.3 Appointment booking (meetergo)

To schedule calls and meetings we use the appointment booking service meetergo provided by meetergo GmbH, Hauptstraße 44, 40789 Monheim am Rhein, Germany. The booking page is loaded only when you actively open the appointment booking. When you book, we process the data you enter (name, email address, company, telephone number and details of your request where given), the selected time slot and the technical data meetergo collects to secure the booking (IP address, timestamp, user agent; server logs at meetergo for up to 14 days). You receive a booking confirmation and reminders by email. On the booking page meetergo only sets a short-lived session token to secure the booking (Sec. 25(2) no. 2 TDDDG) and loads no analytics or marketing scripts. Purpose: scheduling and holding initial and consulting calls. Legal basis: Art. 6(1)(b) GDPR where you yourself are to become a party to the contract; where you act for a company, Art. 6(1)(f) GDPR (legitimate interest in efficient appointment scheduling). Processing on our behalf: meetergo processes the booking data on our behalf (Art. 28 GDPR) on servers in Germany or the EU. Retention: as for enquiries (Section 5.1): until handled; where a business relationship arises, in accordance with Section 6, otherwise at the latest 12 months after the last contact.

6. Business contacts, contract initiation and performance (B2B)

As a consulting and development services provider we process personal data of contact persons at customers, prospects, partners and suppliers: name, role, company, business contact details (email, telephone, address), communication content, and offer, contract, project and billing data.

Source of the data: where we do not obtain your data directly from you, it comes from the company you work for or from publicly accessible sources (e.g. company websites, commercial registers, professional networks such as LinkedIn). Purposes: preparing offers, concluding and performing contracts, project communication and delivery, invoicing and accounting, asserting or defending legal claims. Legal bases: Art. 6(1)(b) GDPR (contract or pre-contractual measures, where you yourself are a party to the contract), Art. 6(1)(f) GDPR (legitimate interest in communicating with the contact persons of our business partners and in maintaining the business relationship), Art. 6(1)(c) GDPR (commercial and tax law obligations). Recipients: tax advisers (and, where required by law, statutory auditors), banks and payment service providers, legal advisers where necessary, public authorities where legally required, and the processors listed in Section 11. Retention: for the duration of the business relationship and thereafter in accordance with statutory retention periods – generally 6 years for commercial and business correspondence (Sec. 257 HGB, Sec. 147 AO) and 8 years for accounting records or 10 years for books and annual accounts (Sec. 147 AO).

7. Direct marketing (B2B)

We approach companies and their contact persons for marketing purposes only within the legal limits: by post within the limits of Sec. 7(1) UWG, by telephone only where consent may at least be presumed (Sec. 7(2) no. 1 UWG), by email only with your prior express consent (Sec. 7(2) no. 2 UWG) or, for existing customers, under the conditions of Sec. 7(3) UWG. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in direct marketing, Recital 47) or Art. 6(1)(a) GDPR. Objection: you may object to the processing of your data for direct marketing purposes at any time and without giving reasons (Art. 21(2) GDPR), e.g. by email to dpo@ezto.io or via the unsubscribe link in any marketing email. We will then no longer process your data for these purposes; to honour your objection we keep your contact details on a suppression list.

We do not currently send a newsletter. Should a newsletter be introduced, sign-up will take place only with consent via a double opt-in procedure (Art. 6(1)(a) GDPR), and this Privacy Policy will be updated accordingly.

8. Job applications

We accept applications by email to the address stated in the respective job advertisement or via career platforms (e.g. LinkedIn), which are independent controllers in that respect. We process the data you submit (cover letter, CV, certificates, contact details, availability and salary expectations) solely to conduct the application procedure. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures), supplemented by Sec. 26(1) BDSG. We process special categories of personal data only where necessary to fulfil obligations under employment law (Art. 9(2)(b) GDPR in conjunction with Sec. 26(3) BDSG, e.g. information on a severe disability) or where you voluntarily provide such data and thereby explicitly consent to its processing (Art. 9(2)(a) GDPR). Retention: after completion of the application procedure, your documents are deleted after 6 months at the latest, unless you consent to longer retention in our talent pool (up to 24 months) or an employment relationship is established. This rule applies to applications at all locations of EZTO TECHNOLOGIES GmbH.

9. Business communications and systems used

Our business email and file storage run on Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland (EU Commission adequacy decision for Switzerland; data processing agreement under Art. 28 GDPR). For project, ticketing and collaboration systems we use services that we operate ourselves on EU infrastructure or obtain from providers in the EU or Switzerland under a data processing agreement. We do not use providers in third countries for these systems (see Section 12).

10. Online presences on social networks

We maintain online presences on LinkedIn and Facebook to communicate with users and provide information about our services. When you visit our profiles, the respective provider processes personal data (e.g. IP address, device information, interactions) under its own responsibility, potentially also outside the EU/EEA. If you are logged in to the respective network, the provider may attribute your visit to your account. Legal basis: Art. 6(1)(f) GDPR (external presentation and communication with users). For page statistics ("Page Insights") we and the respective network are joint controllers (Art. 26 GDPR); you may exercise your rights against us or against the network (Art. 26(3) GDPR).

LinkedIn. Company page with LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Joint controller arrangement (Page Insights Joint Controller Addendum): legal.linkedin.com/pages-joint-controller-addendum · Privacy policy: linkedin.com/legal/privacy-policy · Opt-out: linkedin.com/psettings/guest-controls/retargeting-opt-out

Facebook. Company page with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). Joint controller arrangement for Page Insights: facebook.com/legal/terms/page_controller_addendum · Information about Page Insights: facebook.com/legal/terms/information_about_page_insights_data · Privacy policy: facebook.com/privacy/policy

Third-country transfer: LinkedIn and Meta may transfer data to the USA. The providers base these transfers on the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR) or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

11. Recipients and processors

We disclose personal data only as described in this Privacy Policy, where necessary for contract performance, where required by law or where you request it. We engage processors exclusively under contracts pursuant to Art. 28 GDPR. Currently these are:

LinkedIn and Meta (Section 10) as well as tax advisers, banks and public authorities (Section 6) are not processors but independent or joint controllers.

12. Transfers to third countries

In normal operation we process your data exclusively in the EU/EEA and in Switzerland (adequacy decision). Transfers to the USA are made only by the providers of our social media presences (Section 10) and in connection with consent-based services (Section 4.4); they are based on the EU-US Data Privacy Framework (Art. 45 GDPR) or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For the processing described in this Privacy Policy we do not engage processors established or processing outside the EU/EEA and Switzerland.

Employees outside the EEA. EZTO TECHNOLOGIES GmbH also employs its own staff outside the EU/EEA. They have no access to our production systems, to the website systems or to the data described in Sections 3 to 5. Where employees outside the EEA process personal data in the course of customer projects (Section 6) or of application procedures at those locations (Section 8), this takes place within EZTO TECHNOLOGIES GmbH under the access and security measures set out in Section 14; no transfer to third parties in third countries is involved.

13. Retention periods

Unless stated otherwise in the preceding sections, we delete personal data as soon as the purpose of processing no longer applies and no statutory retention obligations stand in the way. Overview:

14. Data security

We implement appropriate technical and organisational measures to protect personal data (Art. 32 GDPR), depending on the system in particular transport encryption (TLS 1.2 or higher), encryption of stored data, role-based access control with multi-factor authentication, logging, regular backups and security monitoring. EZTO operates an information security management system in accordance with ISO/IEC 27001:2022, certified by InterCert (certificate no. IC-IS-2610067, issued 7 October 2026). We provide the certificate on request.

15. Rights of data subjects

15.1 Your rights at a glance

As a data subject you have the following rights against us:

• Right to be informed (Art. 13, 14 GDPR): you have the right to be informed transparently about which data we process and for which purposes. We fulfil this obligation with this Privacy Policy; on request we will gladly explain individual processing operations in detail.
• Right of access (Art. 15 GDPR): you may request confirmation as to whether and which personal data we process about you, and obtain a copy of that data.
• Right to rectification (Art. 16 GDPR): you may request the rectification of inaccurate data and the completion of incomplete data without undue delay.
• Right to erasure – "right to be forgotten" (Art. 17 GDPR): you may request the erasure of your data, in particular where the purpose no longer applies, you have withdrawn consent or objected, provided no statutory retention obligations stand in the way.
• Right to restriction of processing (Art. 18 GDPR): you may request that we process your data only in a restricted manner, e.g. while we verify the accuracy of the data.
• Notification of recipients (Art. 19 GDPR): we communicate any rectification, erasure or restriction to all recipients to whom we have disclosed your data, unless this proves impossible or involves disproportionate effort; on request we will inform you about those recipients.
• Right to data portability (Art. 20 GDPR): data you have provided to us and which we process by automated means on the basis of consent or a contract will, on request, be provided to you in a structured, commonly used and machine-readable format or – where technically feasible – transmitted directly to another controller.
• Right to object (Art. 21 GDPR): see the separate notice in Section 15.3.
• Automated individual decision-making, including profiling (Art. 22 GDPR): we do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Should this change in the future, we will inform you, and you will have the right to obtain human intervention, to express your point of view and to contest the decision.
• Right to withdraw consent (Art. 7(3) GDPR): you may withdraw any consent given at any time with effect for the future – for cookies and audience measurement via "Cookie Settings" in the footer, otherwise by email to dpo@ezto.io. The lawfulness of processing carried out before the withdrawal remains unaffected.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): without prejudice to any other remedy, you may lodge a complaint with any data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority competent for us is: The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (LfDI RLP), Hintere Bleiche 34, 55116 Mainz, Germany · poststelle@datenschutz.rlp.de · www.datenschutz.rlp.de

15.2 Exercising your rights

Send your request informally to dpo@ezto.io or by post to the address in Section 1. Exercising your rights is free of charge (Art. 12(5) GDPR). We respond to your request without undue delay and in any event within one month of receipt; for complex or numerous requests this period may be extended by up to two further months, in which case we will inform you within the first month, stating the reasons (Art. 12(3) GDPR). Where we have reasonable doubts about your identity, we may request additional information to confirm it (Art. 12(6) GDPR). Where we are joint controller with another provider (Section 10), you may exercise your rights against us or against that provider (Art. 26(3) GDPR). You will suffer no disadvantage from exercising your rights.

15.3 Notice of your right to object (Art. 21 GDPR)

Objection on grounds relating to your particular situation (Art. 21(1) GDPR). You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (legitimate interest). We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Objection to direct marketing (Art. 21(2) GDPR). Where your data is processed for direct marketing purposes, you have the right to object at any time, without giving reasons, to such processing. After your objection, your data will no longer be processed for direct marketing purposes. You may object informally, e.g. by email to dpo@ezto.io.

16. Children's data

Our services are directed exclusively at businesses (B2B) and not at children. We do not knowingly collect personal data of children. Should we become aware that personal data of a child has been provided to us, we will delete it without undue delay; please contact dpo@ezto.io in such a case.

17. Voluntary provision; changes to this Privacy Policy

The provision of personal data is neither legally nor contractually required; however, without the information needed for contract initiation and billing we cannot conclude and perform a contract with you or the company you represent. Otherwise, provision is voluntary.

We update this Privacy Policy when our processing, the legal situation or the services we use change. The version published on the website applies; the date of the last change is stated at the beginning of the document. Earlier versions are available on request.

18. Contact

For data protection enquiries: dpo@ezto.io For legally relevant notices: legal@ezto.io By post: EZTO TECHNOLOGIES GmbH, Am Brand 41, 55116 Mainz, Germany