This Privacy Policy describes how Ignify OÜ, the operator of Zentre (the “Service”), collects, uses, discloses, and protects Personal Data, and the rights you have in respect of it. It applies to our website and to the Service. Capitalised terms have the meanings given in Section 1.
Definitions
- “Controller”, “Processor”, “Personal Data”, “Processing”
- have the meanings given in the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”).
- “Customer”
- a firm or organisation that subscribes to the Service and administers a workspace within it.
- “Customer Data”
- Personal Data relating to a Customer’s own clients and contacts that the Customer submits to, or generates within, the Service.
- “Sub-processor”
- a third party engaged by us to Process Personal Data on our behalf in connection with the Service.
Controller and contact
Zentre is a product of Ignify OÜ, a company established in Estonia. In respect of Personal Data relating to our account holders, prospects, and website visitors, Ignify OÜ is theController. You may contact us regarding this Policy or your rights atprivacy@zentre.io.
Controller and Processor roles
The Service is a multi-tenant platform, and we Process Personal Data in two distinct capacities:
- As Controller — for the account and billing data of Customers and their authorised users (name, email address, hashed credentials, workspace identifiers, subscription and payment records, and service and usage logs), and for data relating to website visitors.
- As Processor — for Customer Data. The Customer is the Controller of Customer Data and determines the purposes and means of its Processing; Ignify OÜ Processes such data solely to provide the Service and in accordance with the Customer’s documented instructions. Where we act as Processor, the Customer’s own privacy notice governs the Processing, and we provide reasonable assistance to the Customer in meeting its obligations.
Purposes and legal bases
Where we act as Controller, we Process Personal Data on the following legal bases under the GDPR:
- Performance of a contract (Art. 6(1)(b)) — to establish accounts and to provide, maintain, and support the Service.
- Legitimate interests (Art. 6(1)(f)) — to secure, monitor, and improve the Service and to prevent abuse, balanced against your rights and freedoms.
- Consent (Art. 6(1)(a)) — where required, for example for certain marketing communications; consent may be withdrawn at any time.
- Compliance with a legal obligation (Art. 6(1)(c)) — including tax, accounting, and regulatory requirements.
Disclosure and Sub-processors
We do not sell Personal Data. We disclose it only to Sub-processors that provide the following categories of service on our behalf, each engaged under a written agreement imposing confidentiality and data-protection obligations consistent with Article 28 of the GDPR:
- cloud hosting and database infrastructure;
- file and document storage;
- subscription and payment processing;
- email delivery for transactional and notification messages;
- product analytics and session replay — to understand how visitors and users navigate the website and Service so we can improve them. This is processed in the European Union; where session replay is used, on-screen inputs and text are masked by default so Customer Data is not captured. It runs on the website only with your analytics-cookie consent (see “Cookies”).
A current list of our Sub-processors, including their identities and locations, is available on request from privacy@zentre.io. We may update our Sub-processors from time to time and, where required, will give notice of material changes.
Separately, the Service offers optional integrations (for example, accounting synchronisation and appointment scheduling) that transmit data to a third party only where a Customer chooses to connect that integration; those third parties act under their own terms, not as our Sub-processors.
We may also disclose Personal Data where required by law, to establish or defend legal claims, or in connection with a merger, acquisition, or other corporate transaction, in each case subject to appropriate safeguards.
International transfers
Personal Data may be Processed within the European Economic Area (the “EEA”), Canada, and the United States. Transfers of Personal Data outside the EEA are made only where a lawful transfer mechanism applies — an adequacy decision of the European Commission (the commercial sector governed by Canada’s PIPEDA benefits from such a decision) or, in the absence of adequacy, the European Commission’s Standard Contractual Clauses together with any supplementary measures required.
Retention
We retain Personal Data only for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements, after which it is deleted or irreversibly anonymised. Customer Data is retained in accordance with the Customer’s instructions and the Terms of Service; a Customer may export its data and request its deletion at any time.
Security
We maintain appropriate technical and organisational measures designed to protect Personal Data, including encryption in transit and at rest, hashing of credentials, logical isolation of each Customer’s data in a dedicated database schema, access controls applied on a need-to-know basis, and audit logging. No method of transmission or storage is entirely secure; we will notify affected parties and the competent supervisory authority of a personal-data breach where and as required by applicable law.
Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the Processing of your Personal Data, the right to data portability, and the right to withdraw consent. Individuals in the EEA exercise these rights under the GDPR; individuals in Canada have corresponding rights under the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, in Québec, under the Act respecting the protection of personal information in the private sector (“Law 25”). To exercise a right, contactprivacy@zentre.io. Where we Process Customer Data as Processor, we will refer your request to the relevant Customer as Controller.
If you are located in the EEA, you also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
Cookies
We use strictly necessary cookies to operate the Service (for example, to maintain an authenticated session). With your consent, we also use analytics cookies for product analytics and session replay to understand how the website and Service are used; these load only after you accept analytics cookies and can be declined without affecting core functionality. See ourCookie Policy for details and your choices.
Children
The Service is intended for use by businesses and is not directed to individuals under the age of 16.
Changes to this Policy
We may amend this Policy from time to time. Material changes will be posted on this page with an updated “Last updated” date and, where required by law, notified to you. Your continued use of the Service after an amendment takes effect constitutes acceptance of the amended Policy.
Contact
Ignify OÜ (Estonia)
Privacy enquiries: privacy@zentre.io
See also our Terms of Service.