Privacy Policy

1. INTRODUCTION

Zeal IO Ltd. ("Zeal", "we", "us", or "our") is committed to protecting your privacy and ensuring transparency in how we collect, use, and share your personal data.

This Privacy Policy explains how we process personal data when you:

• Use our value-added services platform as a merchant
• Interact with our services as a consumer making purchases at merchant locations
• Partner with us as a payment service providerThis policy applies to all personal data we process through:
• Our proprietary software installed on point-of-sale (POS) payment terminals
• Our Merchant Dashboard and mobile applications
• Our Partner Portal for payment service providers
• Our websites and related servicesAbout Zeal:
• Company Name: Zeal IO Ltd.
• Company Number: 11998285 (England and Wales)
• Registered Office: 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom
• Email: privacy@getzeal.io

2. IMPORTANT INFORMATION AND WHO WE ARE

2.1 Data Controller

Zeal acts as a data controller for the personal data we process. This means we determine the purposes and means of processing your personal data.

2.2 Contact Details

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

Data Protection Officer Zeal IO Ltd. 85 Great Portland Street, First Floor London, W1W 7LT United Kingdom Email: privacy@getzeal.io

2.3 Supervisory Authority

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). However, we would appreciate the opportunity to address your concerns before you approach the ICO.

2.4 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by:

• Posting the updated policy on our website
• Sending an email notification to registered merchants
• Displaying a prominent notice in the Merchant DashboardThe "Last Updated" date at the top of this policy indicates when it was last revised.

3. THE DATA WE COLLECT ABOUT YOU

We collect, use, and process different types of personal data depending on your relationship with Zeal:

3.1 For Merchants

When you use our platform as a merchant, we collect:

Business Information:

• Legal business name and trading name
• Business registration number
• Business address and contact details
• Merchant Identification Number (MID)
• Merchant Category Code (MCC)
• Industry sector and business type
• Number of locations and staff count
• Years in operationContact Information:
• Names of business owners, directors, and key personnel
• Email addresses
• Telephone numbers (mobile and landline)
• Business correspondence addressesFinancial and Transaction Information:
• Transaction volumes and values
• Average transaction amounts
• Payment processing history
• Revenue and sales data
• Payment patterns and trends
• POS terminal configuration detailsTechnical Information:
• IP addresses
• Device identifiers
• Log files and usage data
• POS terminal type and software version
• Browser type and version (for Merchant Dashboard)Account Information:
• Login credentials
• Dashboard usage data
• Preferences and settings
• Communication preferences

3.2 For Consumers

When you make purchases at participating merchant locations, we may collect:

Transaction Data:

• Date, time, and location of purchase
• Transaction amount
• Items purchased (basket composition)
• Payment method and card type (last 4 digits only)Card-Based Identification:
• Tokenized payment card identifier (not full card number)
• Card scheme (Visa, Mastercard, etc.)Loyalty Program Data (if you participate):
• Points earned and redeemed
• Program membership number
• Rewards preferences
• Purchase history for loyalty purposesDevice Information (if you use our mobile app):
• Device type and model
• Operating system
• Mobile device identifiers
• App version
• Location data (with your consent)Communications:
• Email address (if provided for receipts or marketing)
• Mobile phone number (if provided for SMS notifications)
• Communication preferences

3.3 For Payment Service Providers

When you partner with us, we collect:

Business Information:

• Company name and registration details
• Registered office address
• Contact details of authorized representatives
• VAT registration numberCommercial Information:
• Banking details for payments
• Performance metrics and reports
• Merchant portfolio data
• Upload and activation statisticsAccount Access Information:
• Partner Portal login credentials
• Usage logs and activity data
• IP addresses

4. HOW WE COLLECT YOUR DATA

We collect personal data through various methods:

4.1 Direct Collection

• When you sign up for our services as a merchant
• When you use our Merchant Dashboard or mobile app
• When you contact our customer support
• When you attend our events or webinars
• When you subscribe to our newsletters or marketing communications

4.2 Automated Collection

• Through software installed on POS terminals at merchant locations
• Through cookies and similar technologies on our websites and applications
• Through log files and analytics tools

4.3 From Third Parties

• Payment Service Providers: We receive merchant data from our payment provider partners when they refer merchants to our platform
• Payment Networks: We may receive transaction authorization and processing data from Visa, Mastercard, and other payment networks
• Publicly Available Sources: We may obtain business information from Companies House and other public registers
• Data Partners: We may receive aggregated or anonymized benchmark data from industry partners

5. HOW AND WHY WE USE YOUR DATA

5.1 Legal Bases for Processing

Under the UK GDPR, we must have a legal basis to process your personal data. We rely on the following legal bases:

Consent: Where you have given clear consent for us to process your personal data for a specific purpose (e.g., marketing communications, location tracking).

Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests.

Legal Obligation: Where we need to process your data to comply with legal or regulatory obligations.

5.2 Purposes of Processing

We use your personal data for the following purposes:

For Merchants:

For Consumers:

For Payment Service Providers:

5.3 Data Monetization

Important Notice: We use transaction data and merchant data for commercial purposes, including sharing with and licensing to third parties. This is a core part of our business model.

How We Monetize Data:

We may share, license, or sell data to:

• FMCG Brands and Retailers: For targeted promotions, campaign measurement, and market insights
• Loyalty Program Providers: For coalition loyalty programs and points-based promotions
• Market Research Firms: For aggregated market trends and consumer behavior analysis
• Financial Institutions and Payment Networks: For fraud prevention, network optimization, and data insights
• Data Analytics Platforms: For business intelligence and benchmarking services
• Investment Firms: For aggregated economic indicators and market intelligenceData Protection Measures:
• When possible, we anonymize and aggregate data before sharing with third parties
• We enter into data processing agreements with recipients requiring them to protect the data
• We conduct data protection impact assessments for high-risk processing activities
• Merchants receive a share of monetization revenue through their payment service provider partnersLegal Basis: Legitimate interests (generating revenue to provide and improve our services) for merchants under contract, and explicit consent for consumers. Where required by law, we obtain explicit consent before monetizing personal data.

6. WHO WE SHARE YOUR DATA WITH

6.1 Categories of Recipients

We may share your personal data with the following categories of recipients:

Service Providers:

• Cloud hosting providers (e.g., AWS, Microsoft Azure)
• Data analytics and business intelligence platforms
• Customer support software providers
• Email and SMS communication services
• Payment processing services
• Cybersecurity and fraud prevention servicesBusiness Partners:
• Payment service providers who referred your business to us
• Payment networks (Visa, Mastercard, etc.)
• Loyalty program providers
• FMCG brands and retailers (for data monetization)
• Market research and data analytics firmsProfessional Advisors:
• Lawyers, accountants, and auditors
• Business consultants
• Insurance providersRegulatory and Law Enforcement:
• UK Information Commissioner's Office (ICO)
• HM Revenue & Customs (HMRC)
• Financial Conduct Authority (FCA)
• Law enforcement agencies
• Courts and dispute resolution bodiesCorporate Transactions:
• Potential buyers, investors, or merger partners (under confidentiality obligations)

6.2 Data Sharing Principles

When we share your data with third parties, we:

• Only share what is necessary for the specific purpose
• Ensure appropriate contractual protections are in place (data processing agreements)
• Require recipients to maintain appropriate security measures
• Conduct due diligence on recipients' data protection practices
• Monitor compliance with data protection requirements

6.3 Payment Service Provider Access

Your payment service provider partner has limited access to data about your account, including:

• Upload and activation status
• Payment and subscription status
• Performance metrics related to their referrals
• Aggregated anonymized data about merchant portfoliosPayment providers do not have access to:
• Detailed transaction data
• Consumer personal data
• Sensitive business information
• Your merchant dashboard account

7. INTERNATIONAL TRANSFERS

7.1 Transfers Outside the UK/EEA

We primarily store and process data within the United Kingdom. However, some of our service providers and data monetization partners are located outside the UK and European Economic Area (EEA), including in the United States.

When we transfer your personal data outside the UK/EEA, we ensure an adequate level of protection through one or more of the following safeguards:

Adequacy Decisions: We transfer data to countries that have been deemed by the UK Government or European Commission to provide an adequate level of data protection (e.g., EU member states).

Standard Contractual Clauses (SCCs): We use the UK International Data Transfer Agreement or EU Standard Contractual Clauses approved by the UK Information Commissioner's Office and European Commission.

Binding Corporate Rules: Some of our service providers operate under approved binding corporate rules.

US Data Privacy Framework: For transfers to the United States, we may rely on the EU-U.S. Data Privacy Framework and UK Extension to the EU-U.S. DPF where applicable.

7.2 Details of Transfers

The countries to which we may transfer your data include:

• United States (cloud hosting, data analytics)
• European Economic Area countries (various service providers)
• Other countries with adequacy decisionsYou may contact us at privacy@getzeal.io to obtain:
• A list of countries to which your data may be transferred
• Copies of the safeguards we have put in place
• Further information about specific transfers

8. DATA SECURITY

8.1 Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

Technical Measures:

• Encryption of data in transit (TLS 1.2 or higher)
• Encryption of data at rest (AES-256 or equivalent)
• Multi-factor authentication for account access
• Regular security vulnerability assessments and penetration testing
• Intrusion detection and prevention systems
• Firewalls and network segmentation
• Secure software development practices
• Regular security patches and updatesOrganizational Measures:
• Access controls limiting data access to authorized personnel on a need-to-know basis
• Confidentiality agreements for all employees and contractors
• Regular data protection and security training
• Incident response and breach notification procedures
• Business continuity and disaster recovery plans
• Regular security audits and assessments
• Data Protection Impact Assessments for high-risk processing

8.2 Data Breach Response

In the event of a personal data breach, we will:

• Notify the ICO within 72 hours where required by law
• Notify affected individuals without undue delay if the breach poses a high risk
• Take immediate steps to contain and remediate the breach
• Investigate the cause and implement measures to prevent recurrence
• Maintain records of all breaches

9. DATA RETENTION

9.1 Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

Merchants:

Consumers:

Payment Service Providers:

‍

9.2 Anonymization

Where information is anonymised so that individuals are no longer identifiable, it is no longer personal data. Removing names, hashing identifiers or calling data 'anonymous' does not by itself achieve this. Information that can still identify an individual remains subject to the applicable data protection and retention requirements.

9.3 Deletion Requests

You may request erasure of your personal data before a stated retention period ends; see section 10.4. The right applies in the circumstances set out in data protection law and is subject to specific exceptions. We will explain our decision and any applicable exception when responding to your request.

10. YOUR RIGHTS

10.1 Overview of Rights

Under the UK GDPR, you have the following rights:

• Right to be Informed: You have the right to clear, transparent information about how we use your data (this Privacy Policy).
• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data in certain circumstances.
• Right to Restrict Processing: You have the right to request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and transmit it to another controller.
• Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

10.2 Right of Access (Subject Access Request)

You may request access to your personal data by contacting us at privacy@getzeal.io.

What we'll provide:

• Confirmation that we process your personal data
• A copy of the personal data we hold
• Information about processing purposes, categories, and recipients
• Retention periods or criteria
• Information about your rightsResponse time: Within one month (may be extended by two months for complex requests)

Fee: Free, unless the request is manifestly unfounded or excessive

10.3 Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you may request correction.

For Merchants: You can update most information directly in your Merchant Dashboard, or contact support@getzeal.io

For Consumers: Contact privacy@getzeal.io with details of the correction needed

For Payment Providers: Update information in the Partner Portal or contact your account manager

Response time: Within one month

10.4 Right to Erasure

You may request deletion of your personal data in the following circumstances:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw consent (where processing is based on consent)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased to comply with a legal obligationLimitations: We may refuse erasure if we need the data to:
• Comply with legal obligations
• Establish, exercise, or defend legal claims
• For merchants, deleting information that is necessary to provide a requested service may affect our ability to continue that service. We will explain any such effect when responding to your request. We may retain specific records where the law permits or requires this, and will explain any applicable exception.

10.5 Right to Restrict Processing

You may request that we restrict processing of your personal data in the following circumstances:

• You contest the accuracy of the data (during verification)
• Processing is unlawful but you don't want erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing (pending verification of grounds)

10.6 Right to Data Portability

You may request that we provide your personal data in a structured, commonly used, machine-readable format (e.g., CSV, JSON) so you can:

• Store it for your own purposes
• Transmit it to another service providerApplies to:
• Data provided to us with your consent or for contract performance
• Data processed by automated meansDoes not apply to:
• Data processed for public interest or official authority
• Paper records

10.7 Right to Object

Objection to Direct Marketing: You have an absolute right to object to processing for direct marketing purposes at any time. We will stop processing your data for marketing immediately upon request.

How to opt-out:

• Click "unsubscribe" in marketing emails
• Update preferences in your account settings
• Contact privacy@getzeal.io
• Reply "STOP" to SMS messagesObjection to Processing Based on Legitimate Interests: You may object to processing based on legitimate interests (including data monetization). We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, or we need the data for legal claims.

10.8 Rights Related to Automated Decision-Making

We do not currently use automated decision-making that produces legal or similarly significant effects on you. If we do so in the future, you will have the right to:

• Obtain human intervention
• Express your point of view
• Contest the decision

10.9 Exercising Your Rights

To exercise any of your rights:

Email: privacy@getzeal.io Post: Data Protection Officer, Zeal IO Ltd., 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom

What we need from you:

• Sufficient information to identify you (to protect your privacy)
• Specific details of your request
• Proof of identity (if requested)Response time: Within one month (may be extended by two months for complex requests; we'll inform you if we need more time)

No fee: In most cases, unless the request is manifestly unfounded or excessive

11. COOKIES AND SIMILAR TECHNOLOGIES

11.1 What Runs on www.getzeal.io and When

In the UK, the European Economic Area and every region not listed below, optional analytics, advertising and business visitor identification stay off until you enable the relevant category. We do not treat scrolling, closing the banner or continued browsing as consent. If your browser reports a time zone in the United States, Canada, Latin America, Egypt or the Gulf states (UAE, Saudi Arabia, Bahrain, Kuwait, Qatar and Oman), these tools run by default under this notice and you can switch any category off at any time in “Cookie settings” in the footer. In every region, advertising and visitor identification stay off while your browser sends Global Privacy Control.

Essential and requested services: technologies that support security, remember your privacy choices and deliver features you request, such as enquiries and appointment booking.

Your choice: choose “Accept all”, “Reject all” or “Manage preferences”. Rybbit is included in the optional Analytics category. You can browse, enquire and book a call after rejecting optional tracking.

Global Privacy Control: we keep advertising and visitor identification off while this browser signal is present.

11.2 Categories and Providers

Microsoft Clarity runs only when you enable Analytics. It helps us understand website use through heatmaps and session recordings. Advertising consent is separate. We mask the assistant conversation and entry area and use input-field masking. Avoid entering sensitive information in general enquiry or chat fields. Microsoft's privacy statement explains Microsoft's processing. Merely visiting or using this website does not give consent to optional tracking.

11.3 Your Choices

Open “Cookie settings” in the footer to change a category or choose “Reject all”. Withdrawal updates consent signals, removes known first-party tracking identifiers that the website can access and reloads the page to stop active tracking scripts. The choice applies to this browser and website origin. We cannot remove cookies on another provider's own domain; manage these through your browser or the provider's controls. Withdrawal does not affect the lawfulness of earlier processing. To exercise your data rights or object to direct marketing, contact privacy@getzeal.io. We may ask again when a choice expires or purposes or notice materially change.

11.4 Legal Basis and Transfers

In the UK, the EEA and other opt-in regions we obtain consent before enabling optional website analytics, advertising and visitor identification. In the UK this includes applicable PECR and UK GDPR requirements; in the EEA, national ePrivacy rules and EU GDPR also apply. In the notice regions listed in section 11.1 we rely on notice with an easy opt-out, and we honour Global Privacy Control. We do not rely on a blanket statistical-purpose exception for Rybbit. Responding to enquiries and arranging appointments are separate from optional tracking and marketing subscriptions. International transfers are covered in section 7. Contact privacy@getzeal.io for the provider, destination and safeguard used for a particular transfer.

11.5 Other Tracking Technologies

We also use web beacons (pixels) in our emails to measure opens and clicks, and local storage in your browser for the purposes described above. Within our loyalty services (not this website) we may collect device information for fraud prevention, as described in section 5.

12. CHILDREN'S PRIVACY

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16.

For Consumers: Our loyalty programs and consumer-facing services are intended for individuals aged 16 and over.

For Merchants: If you are under 18, you must have parental or guardian consent to use our merchant services. We recommend that businesses using our services have appropriate policies for handling transactions involving minors.

If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information as soon as possible.

If you believe we have collected data from a child, please contact us immediately at privacy@getzeal.io.

13. MARKETING COMMUNICATIONS

13.1 Types of Marketing

We may send you marketing communications about:

• New features and product updates
• Industry insights and best practices
• Webinars, events, and training
• Special offers and promotions
• Company news and updates

13.2 Legal Basis

We send marketing communications based on:

• Consent: Where you have explicitly opted in to receive marketing
• Electronic marketing: We use consent where required. Where PECR's products and services soft opt-in applies, it is limited to our own similar products or services, using contact details obtained directly during a sale or genuine sales negotiations, with a clear opportunity to opt out when details are collected and in every message. The soft opt-in is not a UK GDPR lawful basis; any use of personal data also needs an appropriate lawful basis. We respect objections to direct marketing.
• Contract: Service-related communications about your account

13.3 Opt-Out Rights

You can opt out of marketing at any time:

• Click "unsubscribe" in email footers
• Reply "STOP" to SMS messages
• Update preferences in your account dashboard
• Contact privacy@getzeal.io
• Contact our customer supportService Communications: You cannot opt out of essential service communications (e.g., account notifications, security alerts, billing updates) while using our services.

13.4 Frequency

We respect your inbox and will not overwhelm you with emails. Typical frequency:

• Product updates: Monthly
• Industry insights: Bi-weekly
• Promotional offers: As appropriate
• Event invitations: As scheduled

14. THIRD-PARTY LINKS AND SERVICES

Our website and services may contain links to third-party websites, applications, or services that are not operated by us.

We are not responsible for:

• The privacy practices of third parties
• The content of third-party websites
• Any data you provide to third partiesBefore providing personal data to third parties:
• Review their privacy policies
• Understand how they will use your data
• Ensure you're comfortable with their practicesExamples of third-party services we may link to:
• Payment processing partners
• Social media platforms
• Industry resources and publications
• Partner websites

15. DATA PROTECTION IMPACT ASSESSMENTS

We conduct Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risks to individuals' rights and freedoms.

When we conduct DPIAs:

• Large-scale systematic monitoring
• Processing special categories of data
• Data monetization involving sensitive information
• New technologies or innovative uses of data
• Automated decision-making with significant effects
• Large-scale processing of children's dataWhat our DPIAs include:
• Description of processing operations
• Assessment of necessity and proportionality
• Identification of risks to individuals
• Measures to address and mitigate risks
• Consultation with Data Protection Officer
• Review and approval proceduresWe maintain records of all DPIAs and review them regularly.

16. YOUR CALIFORNIA PRIVACY RIGHTS (CCPA)

While we are a UK-based company, we recognize the rights of California residents under the California Consumer Privacy Act (CCPA).

16.1 Categories of Personal Information

We collect the categories of personal information described in Section 3 of this policy.

16.2 Your CCPA Rights

California residents have the right to:

• Know: Request disclosure of personal information collected, sold, or disclosed
• Delete: Request deletion of personal information
• Opt-Out: Opt out of the "sale" of personal information
• Non-Discrimination: Not receive discriminatory treatment for exercising CCPA rights

16.3 Sale of Personal Information

Under CCPA, "sale" includes sharing personal information for monetary or other valuable consideration. Our data monetization activities may constitute "sales" under this definition.

Your Right to Opt-Out: California residents can opt out of data sales by:

• Visiting our "Do Not Sell My Personal Information" page
• Emailing privacy@getzeal.io with "CCPA Opt-Out" in the subject

16.4 Exercising CCPA Rights

To exercise your CCPA rights:

• Email: privacy@getzeal.io with "CCPA Request" in the subject
• Visit: https://www.getzeal.io/data-privacy-request
• ‍Verification: We will verify your identity before processing requests. We may request information such as your name, email address, and merchant ID.

Response Time: Within 45 days (may be extended by 45 days for complex requests)

Authorized Agents: You may designate an authorized agent to make requests on your behalf. We will require proof of authorization.

17. SPECIFIC INFORMATION FOR DIFFERENT USERS

17.1 For Merchants

What makes you unique:

• You have a direct contractual relationship with us
• You control the merchant dashboard account
• You can access, update, and delete most of your data through the dashboard
• You receive detailed transaction and business analytics
• Your data is monetized, and your payment provider partner receives a revenue shareKey points:
• Review and accept our Terms of Service alongside this Privacy Policy
• Ensure your own privacy policy covers data collection at your premises
• Comply with PCI DSS and data protection requirements for your business
• Notify us of any data breaches affecting consumer data
• Update your information promptly when it changes

17.2 For Consumers

What makes you unique:

• You interact with our services through merchant locations
• Your transaction data is collected automatically during purchases
• Your participation in loyalty programs is optional
• Your data may be anonymized and used for analytics and data monetizationKey points:
• You can opt out of loyalty programs at any time
• You control whether your data can be used for data monetization purposes
• Your payment card data is tokenized (we never see full card numbers)
• You can request details of transactions we've recorded
• Anonymized data may still be used after you opt outHow to identify Zeal at merchant locations:
• Look for Zeal branding on POS terminals
• Check for notices about loyalty programs
• Ask merchant staff about loyalty and data practices
• Review merchants' privacy policies

17.3 For Payment Service Providers

What makes you unique:

• You have a commercial partnership agreement with us
• You refer merchants to our platform
• You receive compensation and data monetization revenue share
• You access the Partner PortalKey points:
• You must obtain proper merchant consents before referring merchants
• You're responsible for data protection compliance in your merchant relationships
• You have audit rights regarding data monetization calculations
• Your access to merchant data is limited and controlled
• You must maintain confidentiality of commercial terms

18. DATA PROTECTION BY DESIGN AND BY DEFAULT

We implement data protection by design and by default in all our processing activities:

Privacy by Design:

• Privacy considerations from the earliest design stages
• Privacy impact assessments for new projects
• Security controls built into systems and processes
• Regular security testing and auditsPrivacy by Default:
• Minimal data collection by default
• Strongest privacy settings by default
• No personal data processed beyond what's necessary
• Automatic deletion of data when no longer needed
• Pseudonymization and anonymization where possible

19. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

General Privacy Inquiries: Email: privacy@getzeal.io Post: Data Protection Officer, Zeal IO Ltd., 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom

Merchant Support: Email: support@getzeal.io

Payment Provider Support: Email: partners@getzeal.io

Legal Department: Email: legal@getzeal.io

Response Time: We aim to respond to all privacy inquiries within 5 business days.

20. COMPLAINTS

If you're not satisfied with how we've handled your personal data or responded to your concerns, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner's Office (ICO) Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF United Kingdom

Phone: 0303 123 1113 Website: www.ico.org.uk Online reporting: https://ico.org.uk/make-a-complaint/

Before contacting the ICO: We encourage you to contact us first at privacy@getzeal.io so we can try to resolve your concerns directly.

21. UPDATES TO THIS POLICY

Version History:

We will update this section whenever we make material changes to this Privacy Policy.

22. VISITOR IDENTIFICATION AND MARKETING TECHNOLOGIES

22.1 Tools We Use

Our optional website tools and purposes are listed in section 11.2. They remain off until you grant their category's permission. Google Tag Manager manages relevant tags and consent controls. HubSpot receives and manages all new website enquiries and bookings. Cal.com remains involved only in appointments arranged before this change until those appointments are completed or migrated. These details are used to handle your request. Using these features does not itself subscribe you to marketing emails or authorise advertising audience matching. The assistant does not send general question text to Webflow for answer-improvement logs.

22.2 Visitor Identification and Data Partners

With Business visitor identification permission, Apollo, Leadfeeder / Dealfront and RB2B can process website activity and identifiers to provide business-visitor insights. Company identification can involve personal data; a business IP address or professional context does not remove privacy obligations. Where supported, RB2B may associate a United States visitor with professional contact details using its data partners. Company-level services may operate elsewhere when enabled. These tools do not load when Global Privacy Control is enabled. Withdraw permission in “Cookie settings” or contact privacy@getzeal.io.

An identified visit is not an enquiry, appointment or marketing subscription. Subsequent contact must have an appropriate legal basis and respect your objections and communication preferences. RB2B also provides an opt-out at https://app.retention.com/optout.

22.3 Tools We May Use in the Future

We may replace or add website providers as our services change. We update the named provider and purpose information before relying on permission for new processing, and obtain fresh consent where required. Optional tools continue to follow section 11. A provider change does not override a rejection or withdrawal.

By using our services, you acknowledge that you have read and understood this Privacy Policy.

END OF PRIVACY POLICY

Website tracking information in sections 11 and 22 was revised on 24 September 2026. Other policy provisions retain their existing effective dates.

‍

‍

‍

‍

‍