This policy describes the personal data ZetaCert Technologies collects on www.zetacert.com, why it processes it, how long it keeps it and what your rights are. It is written to be read in full in a few minutes: we only collect what you give us, we sell nothing, and we do not track your browsing.
1. Data controller
The controller of the data collected on this website is:
ZetaCert Technologies
Société par actions simplifiée unipersonnelle (SASU) with a share capital of EUR 100
Paris Trade and Companies Register (RCS) 994 424 497
60 rue François 1er, 75008 Paris, France
Contact for any question about personal data: contact@zetacert.com
Given the size of the company and the nature of the processing, no data protection officer has been appointed. Requests are handled directly by the management.
2. Scope
This policy applies to www.zetacert.com and its forms. It does not cover the PKIFactor and ZetaCA software deployed in your own infrastructure: the data they process remains under your control and is governed by the license and support agreement concluded with you.
The website is aimed at professionals. The data collected is professional identification and contact data.
3. Data processed, purposes, legal bases and retention
Each processing activity below corresponds to an action you take on the website. No data is collected without your knowledge, except for the security measures described in section 3.9.
3.1 Contact form
- Data
- Name, email address, phone (optional), company, product of interest, message.
- Purpose
- Answer your request and handle the commercial follow-up.
- Legal basis
- Pre-contractual steps taken at your request (GDPR art. 6(1)(b)) and legitimate interest in answering inquiries.
- Retention
- 3 years from our last exchange with you.
3.2 Demo request
- Data
- Name, email, role, company, industry, size, country, use cases, current PKI, deployment preferences, compliance needs, certificate volume, timeline, message, IP address.
- Purpose
- Prepare and schedule a demo tailored to your context, then handle the commercial follow-up.
- Legal basis
- Pre-contractual steps taken at your request (art. 6(1)(b)). You tick an explicit consent box before sending; it serves as information and agreement for this processing.
- Retention
- 3 years from our last exchange with you.
3.3 Partnership inquiry
- Data
- Name, email, role, LinkedIn profile (optional), company, website, country, size, target markets, current stack, partnership types, message, IP address.
- Purpose
- Assess and process a partnership proposal.
- Legal basis
- Pre-contractual steps taken at your request (art. 6(1)(b)).
- Retention
- 3 years from our last exchange with you.
3.4 Support request
- Data
- Name, email, company, license ID, product and version, environment, severity, issue description, IP address.
- Purpose
- Handle the incident under the support agreement.
- Legal basis
- Performance of the contract (art. 6(1)(b)).
- Retention
- Duration of the support agreement, then 5 years under the contractual limitation period.
3.5 Newsletter
- Data
- Email address, sign-up page, IP address and timestamps of sign-up, confirmation and unsubscription.
- Purpose
- Send you our publications. The subscription is confirmed through a link sent to your address (double opt-in); every email contains an unsubscribe link.
- Legal basis
- Consent (art. 6(1)(a)), which you can withdraw at any time.
- Retention
- Until you unsubscribe. An unconfirmed sign-up is deleted no later than one month after the request.
3.6 White paper downloads
- Data
- First name, last name, company, email, job title (optional), requested document, IP address.
- Purpose
- Send you the requested document, then offer you content and services related to your professional activity.
- Legal basis
- Fulfillment of your request (art. 6(1)(b)) for sending the document; legitimate interest (art. 6(1)(f)) for B2B prospecting, which you may object to at any time.
- Retention
- 3 years from our last exchange with you.
3.7 Blog comments and likes
- Data
- Comments: display name, email (never published), content. Likes: a random identifier stored in a cookie, not linked to your identity.
- Purpose
- Publish comments after moderation and prevent multiple votes.
- Legal basis
- Legitimate interest in running the blog and preventing abuse (art. 6(1)(f)).
- Retention
- Comments: as long as the article is online, deleted on request. Identifier cookie: 1 year.
3.8 Meeting booking
- Data
- The data you enter in the Calendly module (name, email, time slot, optional notes).
- Purpose
- Schedule a meeting with our team.
- Legal basis
- Pre-contractual steps taken at your request (art. 6(1)(b)). The Calendly module is only loaded when you click a booking button; Calendly LLC then processes your data under its own privacy policy.
- Retention
- Duration of the commercial follow-up, at most 3 years after the last exchange.
3.9 Security and abuse prevention
- Data
- IP address and request timestamps.
- Purpose
- Limit the number of submissions per address to block automated submissions, and keep a record of a form's origin in case of abuse.
- Legal basis
- Legitimate interest in protecting the website (art. 6(1)(f)).
- Retention
- Rate-limit counters: a few hours, in memory. IP address attached to a form: same period as the form.
4. What we do not do
- No audience analytics, no advertising pixel, no browsing tracker: no Google Analytics, no Meta Pixel, no LinkedIn Insight Tag.
- No sale, rental or transfer of your data to third parties.
- No profiling and no automated decision producing legal effects concerning you.
- No advertising audiences built from your data.
5. Recipients and processors
Your data is accessible to authorized staff of ZetaCert Technologies and to the following processors, which act on our instructions and are bound by a contract compliant with article 28 of the GDPR:
- Vercel Inc. (United States): website hosting and form execution.
- Neon Inc. (database hosted in the European Union): storage of form submissions, newsletter subscriptions, comments and administrator accounts.
- Resend Inc. (United States): transactional emails (acknowledgements, newsletter confirmation, document delivery).
- Calendly LLC (United States): meeting booking, only if you use that feature.
Your data may also be disclosed to authorities where the law requires it. We use no other processor without updating this page.
6. Transfers outside the European Union
Processors established in the United States are covered by the standard contractual clauses adopted by the European Commission, supplemented where applicable by their certification under the EU-U.S. Data Privacy Framework. Form data is stored in the European Union.
7. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights:
- Access: obtain confirmation that we process your data and receive a copy of it.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: have your data deleted, within the limits of our legal obligations.
- Restriction: ask for the processing to be temporarily frozen.
- Portability: receive the data you provided in a structured, machine-readable format.
- Objection: object at any time to processing based on our legitimate interest, in particular prospecting.
- Withdrawal of consent: withdraw your consent at any time, without affecting the lawfulness of prior processing. For the newsletter, the unsubscribe link is in every email.
To exercise these rights, write to contact@zetacert.com, stating the email address you used on the website. We reply within one month, extendable by two months for complex requests. In case of reasonable doubt about your identity, we may ask for proof.
If you believe your rights are not respected, you may lodge a complaint with the French supervisory authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
8. Security
Exchanges with the website are encrypted (TLS). Access to data is restricted to authorized persons, protected by authentication, and administrator accounts are subject to login attempt throttling. Forms are protected against automated submissions. Our processors are selected for their security and compliance guarantees.
9. Cookies
The website only sets the cookies strictly necessary for it to work, plus one optional third-party cookie for meeting booking. Their full list and how to manage them are described in the Cookie Policy.
10. Minors
The website is aimed at professionals and is not intended for minors. We do not knowingly collect data about them.
11. Changes
This policy may evolve with the website and its processing activities. The last update date is shown at the top of the page. Substantial changes are announced on the website.