Privacy Policy
How we process personal data when you visit zelkoa.com, contact us or shop in a ZELKOA online store, and the rights you have under the GDPR.
Last updated: 27 September 2026
Who is responsible
The controller responsible for processing personal data in connection with zelkoa.com and ZELKOA online stores is Zelkoa LLC. For any question about your personal data or to exercise your rights, please email [email protected] (subject: “Privacy request”) or use our Contact page.
Personal data we process
- When you visit the website: technical data that your browser sends automatically, such as IP address, date and time of access, the page requested, referrer and browser and device information (server log data).
- When you contact us: the information you provide, such as your name, email address, the content of your message and, where relevant, your order number.
- When you place an order: your name, billing and delivery address, email address, phone number where needed for delivery, order details and payment-related information. Payment card details are processed by the payment service provider, not by us.
- When you create a customer account (where offered): your login details and account information.
Purposes and legal bases
We process personal data only where the General Data Protection Regulation (EU) 2016/679 (GDPR) allows it:
- Performance of a contract (Article 6(1)(b) GDPR): to process orders, deliver goods, handle withdrawals, returns and guarantee claims, and answer questions about an order.
- Legal obligations (Article 6(1)(c) GDPR): for example tax and accounting record-keeping obligations.
- Legitimate interests (Article 6(1)(f) GDPR): to operate a secure and reliable website, prevent fraud and misuse, and answer enquiries that are not related to a contract. You can object to this processing at any time (see “Your rights”).
- Consent (Article 6(1)(a) GDPR): for example for newsletters or non-essential cookies, where offered. You can withdraw your consent at any time with effect for the future.
Analytics, advertising and server-side measurement
With your consent, we may use analytics and marketing tools to understand how our website and stores are used and to measure and improve our advertising, for example on Google and Meta (Facebook, Instagram) services. We use Google Consent Mode, so Google tags, where used, adapt their behaviour to the choices you make in the cookie settings; by default, all analytics and advertising storage is denied.
We may use server-side tagging, in which measurement data is first sent to a server operated for us (for example on Google Cloud) before selected data is forwarded to analytics or advertising providers. This lets us control and limit what is shared. Server-side measurement is subject to the same consent choices as other analytics and marketing technologies.
The legal basis for analytics and marketing technologies is your consent (Article 6(1)(a) GDPR and the national rules implementing Article 5(3) of the ePrivacy Directive). The specific tools in use are listed in our Cookie Policy.
Google sign-in and Google user data
If we offer features that use Google APIs — for example signing in with a Google account — we access only the Google user data you authorise and that is needed for the feature you use, such as your name, email address and profile picture.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the user-facing features you have chosen; we do not sell it; we do not use or transfer it for serving advertising, including retargeting, personalised or interest-based advertising; we do not use it to train generalised artificial intelligence or machine learning models; and we do not allow humans to read it unless you have given us permission, it is necessary for security purposes or to comply with applicable law, or it has been aggregated and anonymised for internal operations.
You can revoke our access to your Google account at any time in your Google account permissions, and ask us to delete Google user data we hold by contacting us.
Recipients of personal data
We share personal data only where necessary for the purposes described above, with the following categories of recipients:
- hosting, content delivery and IT security providers;
- payment service providers, to process payments;
- delivery and logistics companies, to deliver your order;
- IT, email and customer-service software providers;
- professional advisers such as accountants and lawyers, where necessary;
- public authorities, where we are legally required to disclose data.
Service providers that process data on our behalf do so under data processing agreements in accordance with Article 28 GDPR.
International data transfers
Some recipients may process personal data outside the European Economic Area. Where this happens, we ensure that the transfer is protected by the safeguards required by Chapter V GDPR, such as an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses.
How long we keep data
We keep personal data only for as long as it is needed for the purposes for which it was collected. Server log data is kept for a short period for security purposes. Order and invoice data is kept for as long as statutory retention obligations under tax and commercial law require. Enquiries are deleted when they are no longer needed, unless a longer retention period is required by law.
Your rights
Under the GDPR, you have the right to:
- access your personal data (Article 15);
- have inaccurate data rectified (Article 16);
- have your data erased (Article 17);
- restrict processing (Article 18);
- receive your data in a portable format (Article 20);
- object to processing based on legitimate interests (Article 21);
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3));
- not be subject to a decision based solely on automated processing that significantly affects you (Article 22).
To exercise your rights — including a request to delete your data or data connected to a sign-in with Google or Facebook — email [email protected] with the subject “Privacy request” or “Data deletion request”. We respond within one month, as required by Article 12 GDPR; this period can be extended in complex cases, in which case we will let you know.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).
Is providing data required?
Browsing the website does not require you to provide personal data beyond the technical data your browser sends. Some data is necessary to conclude and perform a contract, for example your delivery address; without it we cannot process your order.
Security
We use appropriate technical and organisational measures to protect personal data (Article 32 GDPR), including encrypted connections (HTTPS) for the entire website.
Changes to this policy
We update this policy when our processing changes or when the law requires it. The date at the top of this page shows when it was last updated.
Social networks
If you visit ZELKOA profiles on social networks or interact with our content there, the privacy policy of the respective platform also applies. Our website does not embed social network plugins that transfer data to those platforms when a page loads.