Zerozon privacy policy

The data controller is Zerozonas, MB, company code 307224979, address Sorbų g. 16A-2, LT-11330 Vilnius, contact phone +370 674 54013.

At the time of publication of this version, the general and privacy contacts are [email protected] and www.zerozon.eu.

If Zerozon appoints a data protection officer in the future, the contact details will be published on the platform and in this policy.

Zerozon processes only the personal data needed to operate the platform, administer deposits, ensure security, provide customer support, and meet legal requirements.

We receive data directly from you when you register, make a payment, complete forms, or submit inquiries.

Certain data is collected automatically from your device, the app, cookies, or similar technologies when you use the platform.

Some data may also be obtained from payment service providers, partners, IT service providers, fraud-prevention providers, or identity-assurance providers where necessary for a legitimate purpose.

We process personal data only for defined purposes and on applicable legal bases.

Some data is necessary to perform the contract. If you do not provide essential account, payment, or transaction data, Zerozon cannot provide the relevant function, such as enabling deposit payment or initiating its return.

Optional data, such as marketing consents or precise location permissions, is provided voluntarily. Not providing it should not automatically block core platform functions, except where location data is objectively required for a feature.

Zerozon may use automated rules and risk indicators to detect unusual payment behavior, mass QR scanning, duplicated returns, linked accounts, device anomalies, and other possible abuse.

These assessments are generally used for security and legitimate-interest purposes. More significant decisions, such as long-term account blocking or refusal of a refund, should be reviewed by a human where required by the circumstances and applicable law.

We disclose data only to the extent necessary for a specific lawful purpose.

Where service providers or their subcontractors operate outside the European Economic Area, data may be transferred only using a lawful transfer mechanism, such as an adequacy decision by the European Commission, standard contractual clauses, or another valid safeguard.

This section should be read together with Zerozon's actual supplier infrastructure and real data flows.

Account data is stored while the account is active and for a reasonable period after closure where needed for complaints, disputes, security, or legal compliance.

Payment, refund, chargeback, and accounting data is stored for as long as required by accounting, tax, financial, and limitation rules.

Technical security logs are stored for a shorter, proportionate period unless a specific incident requires longer retention.

Marketing consents are stored until they are withdrawn and for a reasonable period afterwards in order to evidence the consent or its withdrawal.

You may request access to your data, rectification of inaccurate data, erasure, restriction of processing, objection where applicable, data portability, and withdrawal of consent at any time where processing is based on consent.

Where processing is based on legitimate interests, you may object, and Zerozon will assess whether its interests override your rights and freedoms.

Requests can be submitted to [email protected] or another official channel indicated on the platform. Zerozon may request reasonably necessary additional information to verify your identity.

The platform is not intended for children who cannot independently enter into the relevant agreements or use payment instruments under applicable law.

If Zerozon learns that data has been collected improperly from a minor, it may take reasonable steps to remove the data or restrict its processing.

Zerozon applies technical and organizational measures such as access management, logs, pseudonymization, TLS protection, restricted vendor access, backups, and incident-management procedures to the extent proportionate to the risks and nature of the service.

No system can guarantee absolute security, so users must also protect their login details and devices.

If you believe your personal data is processed improperly, you have the right to lodge a complaint with the State Data Protection Inspectorate or another competent supervisory authority in the place where you live or work.

This privacy policy may be updated when the service model, suppliers, laws, or data flows change.

The latest version is published on the platform and, where necessary, material changes are communicated separately.