Privacy Policy for zplcore.com

1. Controller

1.1The controller responsible for processing personal data on zplcore.com is iqmeta GmbH, Am Sonnenhang 24, 71111 Waldenbuch, Germany, represented by its Managing Director Otto Neff, register court: Local Court (Amtsgericht) Stuttgart, HRB 748338, e-mail: support@zplcore.com, phone: +49 7157 563 111 (“we”).

1.2Data protection officer. No data protection officer has been appointed as there is no obligation to do so. Please send any requests to support@zplcore.com.

1.3This policy applies to the website zplcore.com, including the German version at zplcore.com/de/, the Website Tools and the documentation. The platform zplcloud.com has its own privacy policy. The zplCore SDK, the zplCore Designer and the Tools that you operate yourself send no data to us (Section 18 of the Licence Agreement).

2. Hosting and Server Logs

2.1zplcore.com runs on the controller's own server in Germany. No hosting provider with access to the content is involved.

2.2When a page is requested, the server automatically processes: IP address, date and time, requested address, HTTP status code, amount of data transferred, referring page (referrer) and browser identifier (user agent). In addition, the application logs security-relevant events with the IP address, e.g. rejected or excessive requests to the contact form.

2.3The purpose is secure and error-free operation, defence against attacks and error analysis. The legal basis is Art. 6 (1) (f) GDPR.

2.4We store server and proxy logs, including IP addresses, for 14 days and then delete them automatically. We keep individual entries longer if they are needed to investigate a specific security incident, and only for as long as this requires.

2.5All connections are encrypted with TLS.

3. Fonts

3.1All fonts are loaded from our own server; no connection to font providers takes place.

4. Consent Banner and Browser Storage

4.1On your first visit, a banner asks whether you allow statistics and advertising measurement (Sections 8 and 9). “Decline” and “Allow” are offered as equal choices. Until you decide, and after you decline, neither our statistics run nor is any connection to Google established.

4.2You can change or withdraw your decision at any time via the “Cookie settings” link in the footer of every page. Withdrawal takes effect for the future.

4.3The website stores the following in the browser (no cookie): your banner decision (zplcore-consent), the chosen light/dark display (zplcore-theme) and whether you have closed the language hint (langHint), each in local storage until you delete it; only with consent, additionally a random tab identifier for the statistics in session storage, which is deleted when the tab is closed. The legal basis for the technically necessary entries is § 25 (2) no. 2 TDDDG, for the statistics identifier § 25 (1) TDDDG (consent).

5. Website Tools and Demos

5.1The Website Tools (live demo, RFID Studio, Expression Builder, designed QR codes & barcodes, live editor) calculate their results on our server. Your input is transmitted in encrypted form for this purpose, processed separately for each request in memory, the result is sent back, and the input is neither stored nor logged.

5.2In the live editor you edit labels in your browser. For preview and rendering, the editor sends the design to our server and receives the result back (as in Section 5.1). Opening and saving design files takes place only locally in your browser.

5.3To protect against misuse and overload, the server issues a short-lived access token for the Website Tools that is cryptographically bound to the IP address and browser identifier, and limits the number of requests per IP address per minute and per day. This assignment is kept in memory only and is not stored.

5.4The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to demonstrate zplCore to interested parties and to operate the tools securely and fairly. Please do not enter personal data of third parties into the tools (Terms of Use for Website Tools, Section 3.2).

6. Trial Version Request (Contact Form)

6.1You can request a trial version using the form on the contact page. The following is processed: name, e-mail address, whether you are requesting for a company or as an individual developer, the company name if applicable, the desired licence tier, your message and the language of the page. In addition, the time, IP address, browser identifier and the referring page are recorded in order to detect misuse and to be able to assign requests.

6.2To protect against automated submissions, the form uses an invisible check field, a short-lived time token and a limit on requests per IP address. Rejected attempts are noted with the IP address in the server logs (Section 2.4).

6.3The request is sent by e-mail via our own mail server to our mailbox support@zplcore.com; replies go directly to the address you provided. The request is also stored in our database so that we can process and follow it up. It is not passed on to third parties.

6.4The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request), and Art. 6 (1) (f) GDPR for detecting misuse.

6.5We delete requests in our database automatically 24 months after they were received. We delete the associated e-mails 24 months after the last contact if no contract results. If a contract is concluded, we retain the records in accordance with the retention periods under commercial and tax law (up to 6 or 10 years, § 257 HGB, § 147 AO).

7. Orders in the Shop

7.1When you buy licences on the order page (zplcore.com/buy/), we process the company name, contact person, email address, billing address, VAT or tax number, if applicable the licence number and renewal code, the articles ordered and the payment method chosen. For orders by invoice we first send a confirmation link to the email address given.

7.2As evidence against payment fraud and chargebacks we store with the order the time, IP address, browser identifier, the referring page and your acceptance of the licence terms (version and checksum). We delete the IP address, browser identifier and referring page after 24 months.

7.3Payments and invoices are processed by our payment provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe receives the order and billing data, for card payments the card data (you enter them directly at Stripe, they do not reach us) and a checksum of the evidence, but not the IP address we store. Stripe also checks payments to prevent fraud and may transfer data to the USA; Stripe is certified under the EU-US Data Privacy Framework, standard contractual clauses apply in addition. Stripe is itself responsible for fraud prevention and for meeting its own legal obligations. Details: https://stripe.com/privacy.

7.4The legal basis is Art. 6(1)(b) GDPR (performance of the contract), for the evidence against payment fraud Art. 6(1)(f) GDPR and for the retention Art. 6(1)(c) GDPR. We keep order and invoice data for the periods required by commercial and tax law (up to 6 or 10 years, Section 257 HGB, Section 147 AO).

8. Own Page Statistics (Only With Consent)

8.1If you agree in the banner, zplcore.com records its own page statistics without cookies: page visited, referring page, language, device type (desktop, tablet, mobile), truncated browser identifier, campaign parameters in the address (e.g. utm_source) and an event when you request a trial version.

8.2In order to count visits, we derive a pseudonymous visitor identifier from the IP address and browser identifier using a random key generated anew every day. The IP address itself is not stored; after the change of day, the identifier can no longer be linked to new visits. The tab identifier is kept only in your browser's session storage.

8.3The data is stored on our server and evaluated only by us; it is not passed on to third parties.

8.4The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time via “Cookie settings”.

8.5Retention period: We delete the statistics data (page views and request events) automatically 14 months after they were recorded.

9. Google Services (Only With Consent)

9.1Only if you agree in the banner does zplcore.com load the Google tag (gtag.js) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Without consent, the script is not loaded and no connection to Google is established.

9.2We use the Google tag for Google Ads conversion measurement, to learn whether an ad led to a visit or a request, and for Google Analytics 4 to evaluate usage (reach, pages visited, origin, device type). Google processes in particular the IP address, device and browser information, pages visited, times, origin (e.g. ad click) and online identifiers; cookies or similar identifiers may be set for this purpose. Google Analytics 4 does not log or store IP addresses. In Google Analytics, event data retention is set to 14 months and Google Signals is switched off.

9.3The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which can be withdrawn via “Cookie settings”. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. For Google Analytics, Google is our processor (Art. 28 GDPR, Google Ads Data Processing Terms). For Google Ads conversion measurement, we and Google are joint controllers for the collection when the page is opened and the transfer to Google (Art. 26 GDPR); Google is an independent controller for the further processing (Google Ads Controller-Controller Data Protection Terms). Cookie retention: _ga and _ga_* up to 2 years, conversion cookies (_gcl_au, _gcl_aw) up to 90 days.

10. Links to Other Sites

The website links to zplcloud.com, GitHub and nuget.org, among others. Only when you follow such a link does the respective provider process your data in accordance with its own privacy policy.

11. Your Rights

11.1You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).

11.2Right to object. Where we process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation.

11.3An e-mail to support@zplcore.com is sufficient for your requests.

11.4You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

12. Obligation to Provide Data, No Automated Decisions

12.1You are not obliged to provide any data. Without the mandatory information in the form, however, we cannot process a trial version request.

12.2There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Changes

We will adapt this policy if the website or the legal situation changes. The version published on zplcore.com applies.