Privacy Policy

This policy covers Zephior websites, the Ziva software platform, tender intelligence, managed bid services, software engineering and automation engagements, related forms, email communications, checkout flows and support interactions.

Zephior LLC acts as controller for website, account, billing, relationship and operational data. When we process information supplied by a client solely to deliver a contracted project, Zephior generally acts as processor and the client remains controller. The Data Processing Agreement governs that processing where applicable.

Depending on the service, we process:

• Contact and account data: name, work email, company, role, authentication identifiers and support communications.
• Commercial data: subscriptions, order forms, invoices, billing address, tax details and payment status. Payment-card data is handled by a payment provider and is not stored by Zephior.
• Client data: documents and other information submitted, stored or generated through a service or engagement.
• Service data: customer preferences, service configuration, relevant public or licensed business information, reports and account activity.
• Business outreach data: professional identity and role, employer, work contact details, public company identifiers, public procurement participation and award information, opportunity relevance, message history, replies, delivery status and opt-out records.
• Technical data: IP address, user agent, timestamps, service logs, security events, performance data and feature usage.
• Communications data: messages and related delivery or interaction information.

We use data to provide, secure and administer requested services, communicate with users, process payments, respond to enquiries, produce requested output, tailor the service experience, maintain reliability, prevent abuse, improve service quality and meet legal, accounting and tax obligations.

We also use limited business contact and public company data to identify corporate suppliers that may benefit from our procurement intelligence and proposal services, select an accountable professional contact, send relevant B2B communications, respond to replies and maintain suppression records.

Client data is used to perform the client’s instructions. We do not use client data to train general-purpose models for Zephior or third parties.

Where a legal basis is required, we rely on performance of a contract, steps requested before entering a contract, legitimate interests in operating, securing and responsibly promoting a relevant B2B service, compliance with legal obligations and consent where the law requires it.

For carefully selected corporate outreach, our legitimate interests are to make relevant organisations aware of our own procurement intelligence and proposal services and to develop business relationships. We limit the data and audience, assess relevance, avoid sole traders and non-corporate subscribers unless an applicable permission exists, make objection easy and balance these interests against the rights and expectations of business contacts. A client remains responsible for establishing a lawful basis for personal data it instructs Zephior to process on its behalf.

Ziva

Ziva processes content submitted to or generated through the service, together with the account and usage data needed to operate it. Authorized Zephior personnel may access relevant data and functions as necessary for support, maintenance, troubleshooting and security under the Platform Terms. Access is limited to personnel who need it, subject to confidentiality, appropriate permissions and logging, and removed when no longer required.

Connected document sources

When an organization administrator connects Google Drive, SharePoint or OneDrive, we process the connected account identifier and email address, folder and file metadata, and the contents of files selected for synchronization. We read metadata to display available sources and folders; we download or export files within the selected sources and folders into the organization's Library and check for subsequent changes. These integrations read the originals without modifying them.

Synced copies and extracted text are available to authorized organization users for Library preview, retrieval and the document and proposal workflows they request. When a requested workflow uses AI processing, relevant content may be sent to the applicable providers in section 8 under the processing and location arrangements in sections 8 and 9. Connecting a source does not authorize use of its content for unrelated marketing or other organizations.

We store connection credentials in encrypted form to support ongoing synchronization. Disconnecting stops future synchronization and removes the stored authorization credentials; it does not itself delete copies already in Library or revoke the provider's own account permission. The organization can remove retained Library content using the available deletion controls or request assistance at legal@zephior.com. Provider account controls can also revoke access. Retention and backup expiry remain subject to section 10.

Google user data and Limited Use

Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data, including derived data, is used only to provide or improve the prominent user-facing document features for which access was granted. Transfers are limited to providing or improving those features with the user's consent, security purposes, legal obligations, or a merger, acquisition or asset sale with the user's explicit prior consent. We do not sell this data or use or transfer it for advertising, creditworthiness or lending decisions, or training general-purpose AI models.

For Google user data, the general personnel-access description above is limited as follows: humans may read specific data only with the user's prior affirmative agreement, where necessary for security purposes such as investigating a bug or abuse, where required by law, or when the data is aggregated for internal operations in accordance with applicable law. These restrictions also apply to our personnel, contractors and service providers.

Intelligence and managed services

Zephior processes customer profile information and relevant external business information to provide Intelligence and agreed services. Its outputs are decision-support material. For managed execution, staff access is limited to the project and work covered by the accepted, effective SOW, including necessary associated company information. Managed-service access ends with the mandate, subject to agreed remaining work; retained records remain subject to their own purpose and controls.

Other managed projects

These engagements process the data made available by the client for the agreed project. The applicable agreement defines the scope and purpose, and access is limited to the assigned team.

Website analytics

We measure how our public websites, including zephior.com and zelius.ch, are used with Umami, an analytics tool that we host ourselves. For each page view it records the page address, including campaign parameters (for example utm_source), the referring website, browser, operating system, device type, screen size, language and an approximate location (country, region and city) derived from the IP address during the request. It also records a small set of named interactions, such as starting a signup, clicking a booking or contact link, opening a tender notice or following a link to the Ziva application.

Website analytics does not use cookies and stores nothing on your device. IP addresses are not stored. Visits are grouped with an identifier calculated from the IP address, browser details and a secret value that changes every month, so the data cannot identify you and cannot be followed from one month to the next. We do not track you across other websites, combine analytics data with account data, share it with third parties or use it for advertising.

Analytics data is processed on servers we operate in Germany; Cloudflare forwards the requests as described in section 8. Analytics records are deleted after 13 months, and backup copies within 14 days.

We rely on our legitimate interest in understanding how our websites are used, measuring the reach of our communications and improving our content (Art. 6(1)(f) GDPR). Under the Swiss Federal Act on Data Protection, the processing is limited to what this purpose requires and is described in this policy. You can object at any time: if your browser sends a Do Not Track or Global Privacy Control signal, no analytics data is collected. You can also block the script or write to legal@zephior.com.

We process contact details and delivery information to send requested and operational messages and, where permitted, relevant B2B communications. This data is used to operate communications, maintain reliability and respect opt-outs. Our first-contact B2B messages identify Zephior, explain why the communication is relevant, link to this policy and provide a direct way to opt out.

We do not use tracking pixels or link-rewriting for behavioural monitoring in first-contact B2B messages. Non-essential communications can be stopped at any time.

We may obtain business contact and company information from public company websites, Companies House and other official company registers, public procurement portals and award notices, public framework directories, public professional profiles and reputable business-data providers. We do not buy consumer marketing lists for this activity.

We use this information to contact a limited company or other corporate body about Zephior’s own services where its public procurement activity indicates a reasonable professional relevance. We select contacts in roles likely to be accountable for bids, tenders, sales, business development or company leadership. We do not infer sensitive personal characteristics or make decisions about individuals.

Where we obtained personal data from another source, the first communication provides access to this policy. You can ask for the source and categories of data we hold by contacting legal@zephior.com.

We use the providers below to operate Zephior services. A provider processes client data only when the relevant service, deployment or feature uses that provider.

Providers may process data only for the agreed purpose and under applicable contractual and legal duties. Customer-selected integrations are used only when enabled or instructed by the client and may be governed by the client’s own agreement with the integration provider. Service-specific information is available from legal@zephior.com or in the applicable agreement.

Depending on the service, providers may process data in Switzerland, member states of the European Economic Area, the United Kingdom or the United States. Where required, we rely on adequacy decisions, standard contractual clauses or equivalent safeguards. More specific location commitments are stated in the applicable agreement or subprocessor information.

We keep data for as long as necessary for the purpose for which it was collected and to meet contractual or legal obligations. Account and client content is retained during the relationship and for the export or deletion period stated in the applicable terms or order form. Payment and tax records may be retained for statutory periods.

Business outreach records are reviewed for continued relevance and are removed or refreshed when they are no longer needed. Delivery, reply and campaign records are normally kept for up to 24 months after the last contact. Minimal suppression records may be retained for longer so that we can honour an objection and prevent future unwanted sending. Backups expire under controlled retention schedules.

Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability of your personal data. You have an absolute right to object to the use of your personal data for direct marketing. Reply “unsubscribe” to a message or contact legal@zephior.com. We will stop the marketing use and keep only the minimal suppression information needed to respect your choice. We may need to verify your identity before acting on another type of request.

You may also lodge a complaint with the competent data-protection authority. For processing subject to the UK GDPR, this is the UK Information Commissioner’s Office.

For client content processed on behalf of your employer or another client, please direct the request to that controller first. We will assist the controller as required by the Data Processing Agreement.

We use technical and organizational measures appropriate to the service and risk, including access controls, encryption in transit, protected storage, logging, backup and incident-response procedures. No system is completely secure. Deployment-specific controls and commitments are described in the relevant agreement and security documentation.

We update this policy when services or processing practices change. The version and effective date identify the policy currently in force. Material changes will be communicated where required.

Zephior LLC
Reiffergässli 4
6300 Zug, Switzerland

Privacy and legal requests: legal@zephior.com
Security reports: security@zephior.com