IMPORTANT NOTICE: This Policy applies to all individuals whose personal data is processed by ZETA USA Inc. globally, including customers, users, employees, contractors, and business partners. Where applicable, this Policy satisfies the notice requirements of the GDPR (EU), the Austrian Data Protection Act (DSG), the Delaware Personal Data Privacy Act (DPDPA), the California Consumer Privacy Act (CCPA/CPRA), and other applicable data privacy laws. This declaration applies both to data processing within ZETA USA Inc. and its group affiliates, and to the use of our website in the U.S.

This Data Privacy Policy (“Policy”) governs the collection, use, storage, transfer, and disposal of personal data by ZETA USA Inc. (“ZETA USA,” “we,” “us,” or “our”), a corporation organized under the laws of the State of Delaware, with principal operations in Pennsylvania, USA. This Policy applies to information collected through the ZETA USA website and through related communications such as inquiries, event registrations, and requests for technical resources, as well as to data processing within ZETA USA and its group affiliates.

1.1 Who This Policy Covers

This Policy applies to customers, end users, and website visitors located anywhere in the world; interested parties, business partners, and suppliers; newsletter recipients and white paper downloaders; employees, contractors, and job applicants in the U.S. and internationally; and any individual whose personal data we receive from ZETA GmbH, or group affiliates.

1.2 Legal Framework

Due to our corporate structure — a Delaware incorporation with Pennsylvania operations, ZETA GmbH, and a global customer base — this Policy is designed to comply simultaneously with multiple legal frameworks. The EU General Data Protection Regulation (GDPR) applies to all EU/EEA residents’ data, including data transferred from ZETA GmbH. The Austrian Data Protection Act (DSG) applies to processing activities connected to ZETA GmbH’s operations. The Delaware Personal Data Privacy Act (DPDPA), effective January 1, 2025, applies to the extent that we conduct business in Delaware or produce products or services targeted to Delaware residents and meet the applicable statutory volume or revenue thresholds. The California Consumer Privacy Act and its amendment, the CPRA (together, the CCPA), provide the baseline standard for U.S. consumer rights. The privacy laws of Colorado, Connecticut, Virginia, Texas, New Jersey, Maryland, Minnesota, and more than a dozen additional U.S. states apply to residents of those states who are our customers. The FTC Act Section 5 on unfair and deceptive practices applies to all our U.S. commercial activity. The EU-U.S. Data Privacy Framework governs cross-border transfers from the EU/EEA to the U.S.

The following terms have the meanings set out below throughout this Policy.

2.1. “”Personal Data” or “Personal Information” means any information relating to an identified or identifiable natural person, including names, email addresses, IP addresses, location data, device identifiers, and any data that can be linked to an individual. Throughout this Policy, “personal data” and “personal information” are used interchangeably; “personal data” is used primarily in EU/EEA and GDPR contexts, and “personal information” is used primarily in U.S. state law contexts, consistent with the terminology of the applicable legal framework.
2.2. “Sensitive Personal Data” means a subset of personal data requiring heightened protection, including racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, genetic data, sexual orientation, precise geolocation data, Social Security Numbers, and children’s data.
2.3.“Processing” means any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, deletion, or destruction.
2.4. “Controller” means the entity that determines the purposes and means of processing personal data. ZETA USA acts as controller for customer and website data.
2.5. “Processor” means an entity that processes data on behalf of a controller. ZETA USA may act as processor for EU/EEA data received from ZETA GmbH.
2.6. “Data Subject” or “Consumer” means the individual whose personal data is being processed. The term “Consumer” is used in U.S. state law contexts.
2.7. “Sale of Personal Data” means, under U.S. state laws, sharing personal data for monetary or other valuable consideration, including for targeted advertising purposes.
2.8. “Consent” means, under GDPR, a freely given, specific, informed, and unambiguous indication of the data subject’s agreement. Under U.S. law, consent is generally an opt-out model except for sensitive data, where opt-in applies.
2.9. “Joint Controllers” means two or more entities that jointly determine the purposes and means of processing personal data, such as ZETA website and certain social media platforms under GDPR Article 26.

3.1 Data Collected by Category of Data Subject

The personal data we process depends on your relationship with us.
For interested parties and prospects, we process the entity name, the name of the contact person, and their professional contact and address data.
For customers, we process the company name, title and names of contact persons, professional address and contact details, bank details (last four digits only, with full card data processed exclusively by PCI-compliant vendors), and contract data.
For suppliers and business partners, we process the same categories as for customers; in addition, we process image data for publication in print media and on our website on the basis of consent.
For newsletter recipients, we process the e-mail address and name. For white paper downloaders, we process the first and last name, e-mail address, company name, and optionally the telephone number.
For website visitors, we collect the data technically necessary to display our website and ensure its stability and security. This includes the IP address, the date and time of the request and the time zone difference to Coordinated Universal Time, the content of the request and the HTTP status code, the website from which the request originates, and the browser type, operating system, language, and browser version.
This data is not merged with other personal data sources.
For job applicants, we collect CV and resume data, name, contact details, professional history, and qualifications, as described further in Section 12.
Employee and contractor data is governed by a separate HR privacy notice where applicable.

3.2 Additional Categories Collected Automatically

In addition to the above, we may collect identifiers such as names, email addresses, phone numbers, IP addresses, device IDs, and account numbers; commercial information including purchase history, products or services considered, and transaction records; internet and network activity data such as clickstream data, pages visited, time on site, and interactions with cookies and tracking technologies; geolocation data in the form of general location derived from an IP address, with precise geolocation collected only with explicit consent; communications including customer service inquiries, feedback, and survey responses; and inferences drawn from the above categories to understand preferences and improve our services.

3.3 How We Collect Data

We collect personal data directly from you when you register an account, complete a form, make a purchase, sign up for our newsletter, download a white paper, contact us by e-mail, telephone, contact form, or social media, or submit a job application. We also collect data automatically through your use of our website and services via server log files, cookies, and analytics tools described in Section 11. In some cases, we receive data that is not provided directly by the data subject, for example when management bodies provide us with the names and contact details of their employees as part of projects or business relationships.

3.4 Data Minimization

We collect only the personal data that is necessary for the specific, identified purposes described in this Policy. We do not collect personal data speculatively or beyond what is proportionate to those purposes, consistent with the principle of data minimization under GDPR Article 5(1)(c) and applicable U.S. state law.

3.5 Anonymized, Aggregated, and De-identified Data

Where we anonymize, aggregate, or de-identify personal data such that it can no longer reasonably be used to identify an individual, the resulting data is not personal data and is not subject to this Policy or to individual rights requests. We use such data for purposes including website analytics, product and service improvement, internal research, and business reporting. We implement and maintain technical and organizational safeguards designed to prevent re-identification of anonymized or de-identified data, and we do not attempt to re-identify such data. Where we share anonymized, aggregated, or de-identified data with third parties, we require by contract that those recipients likewise refrain from attempting to re-identify the data and maintain appropriate safeguards. For the avoidance of doubt, pseudonymized data — that is, data from which identifying information has been replaced with a pseudonym but which could be re-linked to an individual using additional information we hold — remains personal data and is subject to this Policy.

We process personal information for the purposes described below. The purposes applicable to each category of personal information are identified in the paragraphs that follow and in Section 4.2 of this Policy.

We process your e-mail address for advertising or newsletter purposes, including newsletters and personalized marketing communications, where permitted by applicable law. We also process personal information where we set non-essential cookies or conduct analytics, where we publish image data, and where you otherwise provide information to us for a specific purpose. Where we rely on your consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

We process personal information where necessary to provide, operate, and improve our products and services, to process transactions and fulfil orders and contracts, for contract initiation and fulfilment, for customer support and communications by e-mail, telephone, contact form, and social media, and for providing white paper access or white paper distribution in exchange for contact data.

We process personal information where required to comply with applicable tax, accounting, regulatory, statutory retention, documentation, corporate governance, legal, and compliance obligations, as well as for the operation of our whistleblower and compliance reporting channels.

We process personal information for fraud prevention, network and website security, abuse detection, server log analysis, technical cookie operation, use of the Amazon CloudFront CDN, analytics and website improvement, processing contact enquiry data, recruitment and HR administration, retaining rejected job applicant records for a limited period, operating the LinkedIn Insight Tag for B2B analytics, maintaining our social media presence, and intragroup business operations with ZETA GmbH.

We do not sell personal information for monetary or other valuable consideration. Where we share personal information for cross-context behavioral advertising or process personal information for targeted advertising, you have the right to opt out as described in Section 7.

We process sensitive personal information only where permitted by applicable law, where necessary for the specific purpose for which it was collected, or where you have provided consent if required. We will notify you of the specific purpose at or before the point of collection.

Retention periods for each category of personal information are described in Section 8.

5.1 Transfer of Data

Where we transfer personal information internationally, including within the ZETA group, we do so only where permitted by applicable law and, where required, on the basis of an applicable legal basis and/or transfer mechanism.

• Transfers within the Group: Personal information may be transferred to affiliated companies within the ZETA Group, including parent companies and subsidiaries, where this is necessary for internal administration, IT services, project execution, or business operations. Such transfers are carried out on the basis of appropriate intra-group agreements. A formal intra-group data protection agreement governs personal information flows between ZETA USA and ZETA GmbH. This agreement defines the respective responsibilities of each entity, the categories of personal information transferred, the purposes for which personal information is processed, the applicable security measures, and the procedures for handling individual rights requests.
• Transfers to processors: We engage service providers and processors to support our operations, in particular in the areas of IT services, hosting, communication, newsletter distribution, accounting, and other administrative services. Processing is carried out on the basis of appropriate contractual safeguards, including data processing agreements where required.
• Other recipients: In individual cases, personal information may be disclosed to authorities, courts, auditors, or legal advisers where required by law or necessary for the establishment, exercise, or defense of legal claims.

5.2 No Sale of Personal Data

We do not sell your personal data for monetary consideration. We do share personal information with third parties for cross-context behavioral advertising or targeted advertising purposes. Where such sharing occurs, you have the right to opt out by using the “Do Not Sell or Share My Personal Information” link in the footer of our website or by contacting us at privacy@[ZETA].com.

Depending on your state of residence and subject to applicable law, you may have certain rights regarding your personal information. These rights may include the rights described below.

You may have the right to know whether we process personal information about you and to access the personal information we maintain about you, including information about the categories of personal information collected, the purposes for which it is processed, the categories of sources from which it is collected, the categories of recipients to whom it is disclosed, and the categories of personal information sold, shared, or disclosed, where applicable.

You may have the right to correct inaccurate personal information that we maintain about you.

You may have the right to request deletion of personal information we collected from or about you, subject to legal exceptions, including where retention is necessary to comply with legal obligations, complete transactions, detect security incidents, prevent fraud, protect legal rights, or comply with applicable recordkeeping requirements.

You may have the right to obtain a copy of personal information that you previously provided to us in a portable and, where technically feasible, readily usable format.

You may have the right to opt out of the sale of your personal information, the sharing of your personal information for cross-context behavioral advertising, or the processing of your personal information for targeted advertising, where applicable. You may exercise this right by using the “Do Not Sell or Share My Personal Information” link available in the footer of our website or by contacting us as described in this Policy.

Where applicable, you may have the right to limit the use or disclosure of sensitive personal information or to withdraw consent for certain processing activities. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You have the right not to be discriminated against or receive retaliatory treatment for exercising your privacy rights.

Where required by applicable law, you may have the right to appeal our decision regarding a privacy rights request. Instructions for submitting an appeal will be provided in our response to your request or are described in Section 18.

6.1 How to Exercise Your Rights

Please send your enquiries and concerns by e-mail to datenschutz@zeta.com or by post to ZETA USA Inc., 2200 Renaissance Boulevard, Suite 170, King of Prussia, PA 19406, USA.

Before processing your request, we may need to verify your identity using a reasonably reliable method. This may include matching the information you provide with information we maintain about you or requesting additional information where necessary to authenticate your request.

You may authorize another person to submit a request on your behalf where permitted by applicable law. We may require the authorized agent to provide proof of authorization, such as written permission signed by you or a valid power of attorney. We may also require you to verify your own identity directly with us and confirm that you authorized the agent to act on your behalf.

We will respond to your request within the timeframe required by applicable law. In general, we aim to respond within 45 days of receiving a verifiable request. Where permitted by law, we may extend this period by an additional 45 days if reasonably necessary, taking into account the complexity and number of requests. If an extension applies, we will inform you within the initial response period.

6.2 Appeal Process

If we deny your privacy rights request in whole or in part, you may have the right to appeal our decision depending on your state of residence. To submit an appeal, please contact us at privacy@zeta.com and describe the basis for your appeal.

We will review and respond to your appeal within the timeframe required by applicable law. If we deny your appeal, we will provide a written explanation of our decision and, where required by applicable law, information on how you may contact the attorney general or other competent regulatory authority in your state of residence.

We retain personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required or permitted by applicable law. Our retention decisions take into account the nature and sensitivity of the personal information, the purpose for which it was collected, our business and legal needs, contractual requirements, applicable recordkeeping obligations, security considerations, and whether the information may be needed to establish, exercise, or defend legal claims.

When personal information is no longer reasonably necessary for the purposes for which it was collected, and we are not required or permitted to retain it under applicable law, we will delete, anonymize, or deidentify it in accordance with our retention practices. In some cases, we may retain personal information for a longer period where necessary to comply with legal, regulatory, accounting, tax, audit, contractual, security, or litigation-related obligations.

Customer account, transaction, and commercial records are retained for the duration of the business relationship and thereafter for the period required or permitted under applicable tax, accounting, audit, and recordkeeping requirements. Contract records are retained for the duration of the contract and thereafter for the applicable limitation period or as otherwise necessary to protect our legal rights.

Marketing and newsletter information is retained until you opt out, unsubscribe, withdraw consent where applicable, or otherwise request deletion, unless retention is still necessary for another legitimate business purpose, legal obligation, or recordkeeping requirement. White paper download data is retained in accordance with the same principle.

Website server logs are retained on a rolling 13-month basis, unless a longer period is necessary for security, fraud prevention, troubleshooting, legal, or compliance purposes. Internet and network activity data, analytics data, device information, and related automatically collected information are retained from the date of collection or for as long as reasonably necessary for the purposes for which they were collected. Inferences drawn from personal information are retained until they are no longer necessary for the purpose for which they were created.

Recruiting and job applicant information is retained for the duration of the application process and thereafter for the period required or permitted under applicable employment, anti-discrimination, recordkeeping, or legal claim requirements. Where you have agreed that we may retain your application for future opportunities, we may retain your application materials for up to one year from the date of your consent, unless a longer period is required or permitted by applicable law.

Employee records are retained for the duration of employment and thereafter for the period required or permitted under applicable employment, payroll, tax, benefits, recordkeeping, and legal claim requirements.

Security, fraud prevention, and abuse detection logs are generally retained for 12 to 24 months, unless a longer period is necessary to investigate suspicious activity, protect our systems, comply with legal obligations, or establish, exercise, or defend legal claims.

Whistleblower, compliance, and investigation records are retained for the duration of the relevant review or investigation and thereafter for the period required or permitted under applicable law, compliance obligations, or legal claim requirements. Access to such records is restricted to authorized personnel with a need to know.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction, consistent with the FTC’s reasonable security standard. Our security program includes, without limitation: encryption of personal data in transit and at rest using current industry-standard protocols and algorithms; access controls and role-based permissions applying the principle of least privilege; multi-factor authentication for systems containing personal data; regular security risk assessments and penetration testing; employee privacy and security training; Data Processing Agreements with all third-party processors containing binding security obligations; and incident response and data breach notification procedures. The specific technical and organizational security measures we apply are documented in our internal Information Security Policy, which is reviewed and updated on a regular basis to reflect evolving best practices and applicable regulatory guidance.

No security system is impenetrable. In the event of a personal data breach affecting your data, we will notify you and applicable regulatory authorities as required by law, as described in Section 10.

9.1 Informational Use of the Website

When you visit our website for information purposes only, we collect only the personal data that your browser transmits to our server in the form of server log files. This data is technically necessary for us to display our website to you and to ensure its stability and security. The data collected includes the IP address, the date and time of the request and the time zone difference to Coordinated Universal Time, the content of the request and the HTTP status code, the website from which the request originates, and the browser type, operating system, language, and browser version. This data is not merged with other personal data sources. We reserve the right to review this data retrospectively if we become aware of specific indications of unlawful use and, in the event of a cyber-attack, to pass the data to law enforcement authorities. The data is not otherwise passed to third parties.

9.2  Cookies

Cookies are small text files that are assigned to the browser you are using and stored on your device. They enable us or third-party providers to collect certain information about your visit. Cookies cannot execute programs or transfer viruses to your computer. The information contained in cookies is used, for example, to determine whether you are logged in, to recall data you have entered, or to recognize you as a returning user.

We use cookies and similar technologies for different purposes. Strictly necessary cookies are used to operate our website and provide core functionality. Functional and preference cookies help us remember your settings and improve your user experience. Analytics and performance cookies help us understand how users interact with our website and improve our services. Marketing and advertising cookies may be used to deliver or measure advertising, including targeted advertising, where permitted by applicable law.

You can manage your cookie preferences through our cookie preference center at: [Cookie Preference Centre URL]. Our cookie preference center is designed to provide clear and balanced choices and to avoid interfaces or design elements that subvert or impair user autonomy, decision-making, or choice.

Where required by applicable law, you may opt out of the sale or sharing of personal information and the processing of personal information for targeted advertising through our cookie preference center or by using the “Do Not Sell or Share My Personal Information” link available in the footer of our website.

Opt-Out Preference Signals

Where required by applicable law, we recognize and honor opt-out preference signals transmitted through browser- or device-based technologies, including the Global Privacy Control (“GPC”). Where your browser or device is configured to transmit a GPC or similar legally recognized opt-out preference signal, we will treat that signal as a request to opt out of the sale or sharing of personal information and/or the processing of personal information for targeted advertising, as applicable.

Please note that our response to opt-out preference signals may depend on your state of residence, the specific signal used, and the legal requirements applicable to that jurisdiction.

Certain analytics and session recording tools integrated on our website, including Microsoft Clarity, may collect user interaction data through cookies, scripts, or similar technologies. These tools are configured to exclude sensitive form fields where technically available. Where required by applicable law, their use is subject to your cookie preferences and applicable opt-out rights. If you have concerns about the use of such tools in connection with your session data, please contact us at privacy@zeta.com.

You may also manage or disable cookies through your browser settings. For more information, please refer to the cookie settings or help section of your browser.

Do Not Track

Some browsers may send “Do Not Track” signals to websites. Because there is currently no uniform industry standard for responding to “Do Not Track” signals, we respond to such signals only where required by applicable law. We recognize legally required opt-out preference signals, including Global Privacy Control, as described above.

9.3  Newsletter Registration

You can subscribe to our newsletter by providing your e-mail address and name. You can unsubscribe at any time by using the unsubscribe link found in each newsletter or by sending an e-mail to datenschutz@zeta.com. After unsubscribing, we will no longer use your data to send newsletters. If we have no other business relationship with you and are not subject to any statutory retention obligations, your data will be deleted following unsubscription.

For newsletter distribution and analysis, we use HubSpot Inc.(Massachusetts, USA). HubSpot enables us to analyze recipients’ reading behavior, including whether and which links are clicked, in order to better tailor future content. This evaluation is carried out exclusively for internal analysis purposes.

9.4 White Paper Downloads

You can download a selection of white papers free of charge by providing your first and last name, e-mail address, company name, and optionally your telephone number. When you download a white paper, a contract is concluded between you and us: we provide high-quality specialist content and in return you provide your contact data for the purpose of receiving newsletters and advertising communications. You have the right to unsubscribe from our newsletter at any time. If we have no other business relationship with you and no statutory retention obligations apply, your data will be deleted after you unsubscribe.

9.5 Tracking Pixels 

In addition to cookies, we use tracking pixels — small, transparent image files or code snippets embedded in web pages or emails — to collect information about how you interact with our website and communications. Pixels may be used to measure website traffic, track conversions, analyze user behavior, and enable targeted advertising on third-party platforms. Unlike cookies, pixels do not store information on your device; instead, they transmit data to the server of the pixel operator at the time of the interaction. The specific pixels we use, including the Meta Pixel, Google Ads Conversion Tracking, and the LinkedIn Insight Tag, are described individually in Section 14. Where a pixel transfers personal data to a third country outside the EEA, the applicable transfer mechanism is identified in the relevant Section 14 entry.

9.6 Interest-Based Advertising

Some of the advertising networks we use for interest-based advertising may be members of the Digital Advertising Alliance (“DAA”) or the Network Advertising Initiative (“NAI”). You may learn more about interest-based advertising and opt out of receiving personalized advertising from participating third-party companies by visiting the following resources:

Digital Advertising Alliance: https://optout.aboutads.info

Network Advertising Initiative: https://optout.networkadvertising.org

YourAdChoices: https://youradchoices.com/control

Please note that if you opt out of interest-based advertising, you may still receive online advertising from us; however, such advertising will not be tailored to your interests based on online behavioral information. To successfully opt out using these tools, you must have cookies enabled in your web browser. Your opt-out applies only to the specific browser you use, on the specific device you are using at the time. If you delete your browser’s saved cookies after opting out, you will need to opt out again.0

10.1 Recruitment Processing

If you send us your application documents, we will process the personal data contained therein for the purpose of personnel selection and recruitment. This includes your CV or resume, names, contact details, professional history, and qualifications.

10.2 Rejection and Deletion

In the event of rejection, we will delete your application documents seven months after sending the rejection notice to you, consistent with Austrian anti-discrimination law practice. Where applicable U.S. law requires a longer retention period of up to 12 months, the longer period will apply.

10.3 Retention for Future Consideration

If we wish to retain your application for the purpose of contacting you at a later date should a suitable position arise, we will approach you with a separate request for your consent. If you give us this consent, we will store your application documents. If no suitable position arises within one year of receiving your consent, we will delete all your application documents.

10.4 Third-Party Application Platforms

We use various online application platforms to recruit employees. Applicants decide which data they provide when using such a platform. Personal data entered and documents uploaded are forwarded to us by the platform operator. Both the application platform and we process this data as controllers within the meaning of the GDPR. Please note the privacy policies of the respective platform operators.

We operate social media pages on Instagram, LinkedIn, Facebook, and YouTube. When you visit our social media presence or our YouTube and Vimeo channels, personal data including your IP address is processed by the respective platform provider and cookies are used for data collection. Please refer to the privacy policy of each service for information on exactly what data is transmitted and for details of your rights and available settings.

Your use of these services and their functions is at your own risk. This applies in particular to interactive functions such as sharing, commenting, and rating. The providers of these social media services process personal information in accordance with their own terms and privacy policies. We may process information that you provide to us through social media, such as comments, messages, inquiries, reactions, or profile information, for communication, customer support, marketing, community management, analytics, and other business purposes. If you have privacy rights requests relating to personal information that we process through our social media pages or channels, you may contact us as described in this Policy. If your request relates to information processed independently by the relevant platform provider, you should contact the platform provider directly or use the privacy settings and request mechanisms provided by that platform.

U.S. Note: Our use of social media platforms is also subject to FTC endorsement and disclosure guidelines. Where we publish sponsored content or endorsements, these will be clearly and conspicuously disclosed in accordance with FTC requirements.

We use the following third-party services on our website and in our operations. Each may process personal data as described below.

12.1  Google Services

We use services provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Depending on the specific Google service used, Google may collect and process personal information such as device information, IP address, browser information, usage data, cookie identifiers, and other information generated through your use of our website or services.

Google processes this information in accordance with its own privacy practices and applicable service terms. For further information, please see Google’s Privacy Policy at policies.google.com/privacy.

Google Analytics

We use Google Analytics on our website to analyze how it is used and to better understand how visitors find and use our Services. Depending on your location and applicable law, Google Analytics may be used based on your cookie preferences, consent, or opt-out choices.

Google Analytics may collect information related to your device and browser, usage data, on-site activities, cookie identifiers, and similar information to measure and report statistics about user interactions. Google Analytics 4 does not log or store IP addresses. Google uses the information collected to analyze your use of the website, compile reports on website activity, and provide other services relating to website and internet use.

Google may also show advertisements for us across the internet and may use cookies and similar technologies to serve ads based on your past visits to our website, where permitted by applicable law and subject to your privacy choices. Any data collected is used in accordance with this Policy and Google’s Privacy Policy.

You can learn more about Google’s privacy practices by visiting policies.google.com/privacy. To opt out of Google’s use of cookies or device identifiers for advertising purposes, please visit Google’s Ads Settings at adssettings.google.com. You may also opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.

This service is subject to the cookie preferences and opt-out choices described in Section 11.2.

Google Ads Conversion Tracking

Our website uses Google Ads Conversion Tracking. If you arrive at our website through a Google advertisement, Google may place a cookie or use similar technologies on your device. These technologies help us understand whether users who clicked on our advertisements were redirected to our website and completed certain actions, such as submitting a form, downloading content, or requesting information.

The information collected through Google Ads Conversion Tracking enables us to measure the effectiveness of our advertising campaigns. We receive conversion statistics and related reporting information, but we do not use this information to directly identify individual users.

This service is subject to the cookie preferences and opt-out choices described in Section 11.2.

Google AdSense

Our website uses Google AdSense for displaying advertisements automatically selected by Google based on our website content and visitor interests. Google AdSense collects data through cookies, web beacons, and usage data including information about pages visited, advertisements clicked, IP address, browser type, and language settings. This information is used to measure advertising effectiveness and may be combined with other data Google holds about you. This service is subject to the cookie preferences and opt-out choices described in Section 11.2.

Google Tag Manager

We use Google Tag Manager to integrate and manage website tags such as tracking codes and conversion pixels. Google Tag Manager itself does not create user profiles or place advertising cookies, but it enables other tags and tools to be deployed on our website. These tags and tools may collect personal information depending on their specific functionality and your privacy choices.

Google Fonts

We use Google Fonts on our website to ensure that fonts and icons are displayed in a uniform and appealing manner. Your browser loads the required fonts from Google Fonts servers, which means that Google becomes aware that our website was accessed via your IP address. For further information, please visit the Google Fonts privacy page.

Google Maps

We use the Google Maps service on this website to display interactive maps. When the map loads, Google receives information that you have accessed the relevant page of our website, together with the technical log data described in Section 11.1. If you are logged in to a Google account, your data will be associated with that account. You can prevent this by logging out of Google before activating the map.

YouTube

We operate a YouTube channel and have integrated YouTube videos on our website. YouTube is operated by YouTube LLC, 901 Cherry Avenue, San Bruno, California 94066, USA, a subsidiary of Google Ireland Limited. We use YouTube in extended data protection mode, which means that YouTube does not store cookies on your device when you visit our website. A connection to YouTube’s servers is only established when you choose to play an embedded video. Once playback begins, YouTube uses cookies and other tracking technologies for data collection and statistical analysis and may use your data for advertising and market research purposes. These tracking technologies enable us to understand and improve our marketing efforts and track the performance of video content. YouTube may also collect information relating to your visit to our website, including the referring IP address, device, and pages you accessed. If you are logged into a YouTube account, your activity will be associated with that account. This service is subject to the cookie preferences and opt-out choices described in Section 11.2.

For further information, see https://policies.google.com/privacy.

12.2 Microsoft Services

We use services provided by Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA. For further information, see privacy.microsoft.com.

Microsoft Advertising (formerly Bing Ads)

Microsoft Advertising enables us to place targeted advertisements in the Bing search results and on other Microsoft properties. When Microsoft Advertising is active, data such as IP addresses, browser information, search queries, device types, and click behavior may be collected to measure the effectiveness of advertising campaigns and to serve personalized advertisements. Microsoft does not share directly identifiable information such as usernames or addresses with us. This service is subject to the cookie preferences and opt-out choices described in Section 11.2.

Microsoft Clarity

We use the Microsoft Clarity analysis tool to understand user behavior on our website and to improve the user experience. Microsoft Clarity uses cookies and other tracking technologies to collect information such as user interactions, mouse movements, scrolling activity, and keystrokes. This data is anonymized and aggregated to help us improve the performance and effectiveness of our website. This service is subject to the cookie preferences and opt-out choices described in Section 11.2.

12.3 Amazon CloudFront CDN

We use Amazon CloudFront, a content delivery network operated by Amazon Web Services Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA, to deliver website content quickly and securely. The CDN service processes the IP address of the website visitor. The IP address is automatically deleted from CloudFront logs after processing. For further information, see aws.amazon.com/privacy.

12.4 HubSpot

Our website uses the services of HubSpot Inc., 2 Canal Park, Cambridge, MA 02141, USA, for the analysis, optimization, and automation of marketing and sales processes. HubSpot enables us to analyze website visitors and deliver targeted marketing measures. Data such as IP address, visitor behavior, and submitted form data may be recorded and stored. This service is subject to the cookie preferences and opt-out choices described in Section 11.2. For further information, see hubspot.com/data-privacy.

12.5 Hotjar

We use Hotjar, provided by Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian’s, STJ 3141, Malta, to analyze user behavior and improve usability. Hotjar collects data including mouse clicks, mouse movements, and scrolling behavior. IP addresses are processed in anonymized form. Hotjar also records screen size, device type, browser information, and country of origin. This information is not used to identify individual users and is not merged with other personal data.

This service is subject to the cookie preferences and opt-out choices described in Section 11.2. For further information, see hotjar.com/legal/privacy-policy.

12.6 Leadfeeder / Dealfront

We use the analytics tool Leadfeeder provided by Dealfront Group GmbH, Durlacher Allee 73, 76131 Karlsruhe, Germany, to manage existing B2B customer contacts and to generate new ones. Dealfront accesses analyses from Google Analytics by matching anonymized IP addresses of website visitors with publicly available company information. Because Google Analytics anonymizes IP addresses by default, no direct personal reference is established through this process, though one may arise when reviewing company-level information.

This service is subject to the cookie preferences and opt-out choices described in Section 11.2.

For further information, see dealfront.com/privacy-policy.

12.7 LinkedIn Insight Tag

Our website uses the LinkedIn Insight Tag, a tracking pixel provided by LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA. The Insight Tag is a JavaScript code snippet embedded on our website that functions as a tracking pixel, enabling collection of data about visits to our website, including URL, referral URL, IP address, device and browser characteristics, timestamps, and page views, and enabling us to track page view and conversion data – including post-click and view-through conversions – for our LinkedIn advertising campaigns. This data is encrypted, anonymized within seven days, and deleted within 90 days. LinkedIn does not share personal data with us; we receive only aggregated reports on website audiences and advertising performance. However, LinkedIn may use the collected information to serve you advertisements on LinkedIn and other platforms. LinkedIn members can control the use of their information for advertising purposes through their LinkedIn account settings. This service is subject to the cookie preferences and opt-out choices described in Section 11.2. For further information, see linkedin.com/legal/privacy-policy.

12.8 Matomo

We have integrated the web analytics service Matomo, provided by InnoCraft Limited, 7 Waterloo Quay, PO625, 6140 Wellington, New Zealand, on our own server for statistical analysis of user behavior and for optimization and marketing purposes. By hosting Matomo on our own server, we ensure that no data is passed to third parties. We operate Matomo with settings that ensure no cookies are set. The data processed includes browser type, browser version, operating system, country of origin, date and time of the server request, number of visits, time spent on the website, and external links clicked. The IP address is anonymized before it is saved. Pseudonymized user profiles may be created and evaluated but are not used to personally identify visitors and are not merged with other personal data. This service is subject to the cookie preferences and opt-out choices described in Section 11.2. For further information, see matomo.org/privacy-policy.

12.9 Meta Pixel

Our website uses the Meta Pixel provided by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. The Meta Pixel enables us to determine website visitors as a target group for the display of advertisements on Meta platforms, including Facebook and Instagram, and to customize and display advertisements only to Facebook users who have shown an interest in our website or services or who have specific characteristics – such as certain demographics or interests in certain topics or products determined by websites visited – that we submit to Meta. The use of Meta Pixel helps ensure that our advertisements are in line with the potential interests of users and do not have a nuisance effect. The Meta Pixel also allows us to track the effectiveness of Facebook advertisements for statistical and market research purposes by seeing whether users have been redirected to our services after clicking on a Facebook advertisement. The pixel records user actions in cookies, which enables Meta to match your user data such as IP address and user ID with data in your Meta account. The data collected through the pixel is anonymous from our perspective and cannot be viewed by us; it can only be used in the context of advertisement targeting and conversion measurement. However, the information collected via the Meta Pixel, on our website as well as on other websites on which Meta Pixel is installed, is also stored and processed by Meta. Meta may link this information to your Facebook account and may also use it for its own promotional purposes in accordance with Meta’s Data Usage Policy. To understand more about Facebook advertising, please visit https://www.facebook.com/about/ads. You may deactivate the Meta Pixel via the Cookie Settings on Facebook, located at https://www.facebook.com/settings/?tab=ads#. If you do not wish the pixel to link your actions to your Meta account, you may also log out of Meta before taking any action on our website. This service is subject to the cookie preferences and opt-out choices described in Section 11.2.For further information, see facebook.com/policy.php.

13.1  Reporting Channel

We have established a whistleblower online portal on our website to enable individuals to contact us and report compliance and legal violations without fear of reprisals. Further information is available at https://app.loupe.link/whistleblowing/45c1aae5-c5ac-4259-b46a-6af673ad74f2.

13.2  U.S. Whistleblower Protections

U.S. employees and contractors are protected from retaliation for good-faith reporting under a range of federal and state laws, and nothing in this Policy restricts or discourages reporting to appropriate internal or external authorities.

We will not retaliate against any individual who makes a good-faith report through internal or external channels. Our group-wide whistleblower system described in Section 15.1 is available to U.S. employees for group-level reporting as well.

If you believe that we have processed your personal information in violation of applicable privacy law, we encourage you to contact us first so that we can review and address your concern.

Depending on your state of residence, you may also have the right to contact your state attorney general, state privacy regulator, consumer protection authority, or another competent authority regarding alleged violations of applicable privacy law.

If we deny or do not fully grant your privacy rights request, you may have the right to appeal our decision as described in Section 7.2. If your appeal is denied, we will provide information on how you may contact the relevant state attorney general or other competent authority where required by applicable law.

Certain state privacy laws may provide a private right of action for specific violations. For example, California residents may have a private right of action under the CCPA in connection with certain data breaches, subject to the requirements and limitations of applicable law.

For general privacy inquiries and data subject rights requests, please contact us at datenschutz@zeta.com.

We reserve the right to make changes to this Policy from time to time to reflect changes in our practices, applicable law, or business operations. All changes will be published on this page with a revised effective date. We refer you to the current version of this Policy at https://us.zeta.com/data-protection/. For material changes, we will additionally notify account holders by e-mail and display a notice on our website or application. For EU/EEA users, where changes affect consent-based processing, we will seek fresh consent before the change takes effect.

A.1 California Residents (CCPA / CPRA)
In addition to the rights described in Section 7, California residents have the following specific rights. You have the right to know the specific pieces of personal information we have collected about you. You have the right to correct inaccurate personal information we maintain about you. You have the right to limit our use and disclosure of sensitive personal information to purposes necessary for providing our services. You have the right to opt out of the sale or sharing of your personal information, including for targeted advertising purposes, by using the “Do Not Sell or Share My Personal Information” link available in the footer of our website. We do not discriminate against California residents who exercise any of these rights.

California Shine the Light. Under California Civil Code Section 1798.83, California residents who provide personal information in obtaining products or services for personal, family, or household use may be entitled to request and obtain from us once a calendar year information about the information we shared, if any, with other businesses for direct marketing uses. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing, if any, will be included in our response. As part of the California Online Privacy Protection Act, all users of our Services may make any changes to their information at any time by contacting us at datenschutz@zeta.com.

A.2 Delaware Residents (DPDPA)
Delaware residents have all the rights described in Section 7. The Delaware Personal Data Privacy Act (DPDPA), effective January 1, 2025, applies to the extent that we conduct business in Delaware or produce products or services targeted to Delaware residents and meet the applicable statutory volume or revenue thresholds, as described in Section 1.2. Where the DPDPA applies, it includes enhanced protections for children’s data and broader definitions of sensitive personal data. If we deny your rights request in whole or in part, you may appeal our decision by contacting datenschutz@zeta.com within 30 days of receiving our response, and we will respond to the appeal within 60 days.

A.3 Other State Residents
Residents of Colorado, Connecticut, Virginia, Texas, New Jersey, Maryland, Minnesota, New Hampshire, Montana, Nebraska, Oregon, Tennessee, Iowa, Utah, Indiana, Kentucky, Rhode Island, and other states with applicable comprehensive privacy laws have the rights described in Section 7 to the extent required by their state’s law. Where a state law provides rights or protections beyond those described in Section 7, we will honor those additional rights. To exercise any of these rights, please contact us at datenschutz@zeta.com.

This Appendix constitutes the formal information notice required by GDPR Articles 13 and 14 for EU/EEA data subjects. Thank you for visiting our website. The protection of your data is a top priority for us.

The purposes and legal bases for processing your personal data are set out in full in Section 4 of this Policy. Where we process data on the basis of our legitimate interests, those interests are fraud prevention, network and website security, website analytics, intragroup business operations, and maintaining our social media presence. The categories of recipients to whom your data may be disclosed are described in Sections 5 and 14. International transfers of your data and the safeguards applicable to those transfers are described in Section 6; our primary transfer mechanism is Standard Contractual Clauses (SCCs) in the form approved by the EU Commission, supplemented where applicable by the EU-U.S. Data Privacy Framework to the extent ZETA USA has completed or completes DPF self-certification.

Retention periods applicable to your personal data are set out in Section 8. Your rights as a data subject — including the rights of access, rectification, erasure, portability, restriction, and objection — are described in Section 7. You have the right to withdraw consent at any time by contacting datenschutz@zeta.com; withdrawal does not affect the lawfulness of prior processing. You have the right to lodge a complaint with the Austrian Data Protection Authority (DSB) at dsb@dsb.gv.at or dsb.gv.at, or with the supervisory authority in your country of residence or work.

Whether providing your personal data is a statutory or contractual requirement, or a condition necessary for entering into a contract, is disclosed at the point of collection for each processing activity. Where automated decision-making takes place, this is described in Section 17. Where we process personal data that was not collected directly from you, for example where management bodies have provided us with contact details of their employees as part of a business relationship, the relevant information is set out in Section 3.3.