Privacy Policy How we handle and protect your data.

GTN Group AG (operating as zwrm) Christaweg 42, 79114 Freiburg, Germany Email: privacy@zwrm.eu

This privacy policy explains how zwrm ("we", "us") collects, uses, and protects personal data when you use our website (zwrm.eu), our cloud platform services and the zwrm app for iPhone and iPad.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR/DSGVO) and the German Federal Data Protection Act (BDSG).

3.1 Website Visitors

When you visit our website, we collect:

• Server log data: IP address, browser type, referring URL, pages visited, date and time of access. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring website security and performance).
• Contact form submissions: Name, email address, company name, and message content. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).
• Waitlist/demo request: Email address. Legal basis: Art. 6(1)(a) GDPR (consent).

3.2 Platform Users

When you use the zwrm platform, we additionally process:

• Account data: Name, email, company name, billing address. Legal basis: Art. 6(1)(b) GDPR (contract performance).
• Usage data: Deployment logs, resource consumption, API calls. Legal basis: Art. 6(1)(b) GDPR (contract performance).
• Payment data: Processed by our payment provider. We do not store credit card numbers.

3.3 Customer Content

Your application data, databases, and files deployed on zwrm are processed solely on your behalf. We act as a data processor under Art. 28 GDPR. A Data Processing Agreement (DPA/AVV) is available on request.

3.4 zwrm App for iPhone and iPad

When you use the zwrm app, we additionally process:

• Account data: your name, email address and the organizations you belong to, which the app loads from your zwrm account after you sign in. The access key that keeps you signed in is stored in your device's keychain. Legal basis: Art. 6(1)(b) GDPR (contract performance).
• Chat content: the messages, photos and files you send to agents, and the agents' replies. They are stored in your organization's workspace on the zwrm platform and processed on your organization's behalf as described in 3.3. To generate a reply, your message is sent to the AI model provider that runs the agent you chat with. The current list of these providers is available on request.
• Push notification token: if you allow notifications, the app sends a token issued by Apple to zwrm. We use it only to tell you, through the Apple Push Notification service of Apple Inc., that an agent has finished replying. A notification shows the agent's name and the first line of its reply. We delete the token when you sign out. Legal basis: Art. 6(1)(b) GDPR (contract performance).

Voice input is transcribed on your device by iOS; the audio is not sent to us. The app asks for microphone access only for voice input, and for photo library access only to save an image you choose to save. The app contains no analytics, advertising or tracking software.

We use personal data to:

• Provide and maintain the zwrm platform
• Process your requests and communicate with you
• Send service-related notifications
• Ensure security and prevent abuse
• Measure website usage in an aggregated, privacy-friendly manner
• Measure the success of our Google Ads campaigns where you have consented
• Comply with legal obligations

We do not sell personal data to third parties. We do not make automated decisions that produce legal or similarly significant effects.

Data relating to the zwrm platform is stored and processed within the European Union. Our core infrastructure is operated by an EU-registered entity.

AI models hosted outside the EU are the exception. If you choose such a model for an agent, for example Claude or Codex through your own Anthropic or OpenAI account, the agent sends the content it needs for a response to that provider. That content may then be processed outside the EU, including in the United States. This processing is based on your own contractual relationship with the provider and is your responsibility. The “EU models only” setting in the dashboard rules out such models for your whole organization.

For consent management we use Usercentrics GmbH, Germany. For privacy-friendly website statistics we use Pirsch Analytics, operated and hosted in Germany. If you consent to Google Ads conversion tracking, data may be processed by Google Ireland Limited and affiliated Google companies. Processing in third countries, including the United States, cannot be ruled out. Google states that it uses recognized transfer mechanisms such as the EU-US Data Privacy Framework and the EU Standard Contractual Clauses where applicable. You can avoid consent-based advertising processing by rejecting or withdrawing advertising consent.

• Account data: Retained for the duration of the contractual relationship, then deleted within 30 days unless legal retention obligations apply.
• Server logs: Deleted after 90 days.
• Contact form data: Deleted after 12 months unless a business relationship is established.
• Billing data: Retained for 10 years as required by German tax law (§ 147 AO).

We use a limited number of service providers to operate our services and website, including Usercentrics GmbH for consent management, Pirsch Analytics for cookieless website statistics, and Google Ireland Limited for Google Ads consent-mode and conversion measurement. Where a provider acts as a processor, it is contractually bound to data-protection requirements. The current platform sub-processor list is available on request.

Under GDPR, you have the right to:

• Access your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent at any time (Art. 7(3) GDPR)

To exercise these rights, contact us at privacy@zwrm.eu.

9.1 Usercentrics

We use Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, as our consent management platform. Usercentrics stores your consent decision so that the website can respect it and so that we can demonstrate consent. This storage is necessary to provide the consent-management function (§ 25(2) no. 2 TDDDG; Art. 6(1)(c) and (f) GDPR). You can change or withdraw your choice at any time via Cookie settings.

9.2 Pirsch Analytics

We use Pirsch Analytics for aggregated website statistics. Pirsch operates without cookies, does not store IP addresses, does not track visitors across websites, and is hosted in Germany. The legal basis is our legitimate interest in understanding and improving our website (Art. 6(1)(f) GDPR).

9.3 Google Ads conversion tracking

We use the Google tag from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in Google Consent Mode. Before you consent to advertising, advertising storage, advertising user data and advertising personalization remain denied, and advertising identifiers are redacted; Google may receive cookieless consent and measurement signals. If you consent, Google Ads conversion tracking helps us determine whether an advertisement led to an action on our website. Depending on the interaction, Google may then process the page URL, browser and device information, IP address, time of access, advertising identifiers and conversion information, and may store technologies such as _gcl_* in your browser. Consent-based advertising processing relies on your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw consent at any time through Cookie settings; withdrawal does not affect processing that occurred before withdrawal. Current storage technologies and durations are also shown in the consent settings.

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, and regular security assessments.

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg)
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "last updated" date. Material changes will be communicated via email to registered users.