+49 177 2479368 | info@zpasgroup.de
Home › Privacy policy

Privacy policy

Last updated: June 2026 · in accordance with the GDPR (DSGVO) and the TDDDG

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR; German abbreviation: DSGVO), the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) and other national data protection laws is:

ZPAS GROUP GmbH
Torgauer Straße 231–233
04347 Leipzig
Germany

Telephone: +49 177 2479368
Email: info@zpasgroup.de
Managing Director: Dominik Rudy
Commercial register: HRB 28252, Amtsgericht Leipzig (Leipzig Local Court)
VAT ID: DE815365540

If you have any questions about data protection, please contact the controller directly using the contact details given above.

2. General information on data processing

As a matter of principle, we process personal data only to the extent necessary to provide a functional website and our content and services. Personal data is processed only with the consent of the data subject or where the processing is permitted by statutory provisions.

This website uses — only with your consent — Google Analytics 4 (see section 6) and Google Ads conversion tracking (see section 7). In addition, we use Google Consent Mode in its advanced implementation (see section 7). We use no retargeting, no Facebook Pixel and no advertising network cookies that would enable cross-site profiling. No external fonts are embedded — the fonts used are delivered locally from our own server (see section 10). The technologies used are described in section 5 (cookies), section 6 (analytics), section 7 (conversion tracking) and section 10 (fonts).

3. Legal bases for data processing

  • Art. 6(1)(a) GDPR – consent of the data subject
  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR – compliance with a legal obligation
  • Art. 6(1)(f) GDPR – legitimate interests of the controller or a third party
  • § 25(2) no. 2 TDDDG – strictly necessary cookies without consent

4. Provision of the website and server log files

Each time our website is accessed, our hosting system automatically records the following data (server log files):

  • IP address of the requesting computer (anonymised after 7 days)
  • Date and time of access
  • Name and URL of the file accessed
  • Website from which access is made (referrer URL)
  • Browser and operating system used
  • Amount of data transferred and HTTP status code

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security and proper functioning of the website). The log files are deleted after 14 days at the latest. They are not combined with other personal data.

5. Cookies and consent management (Cookiebot)

Our website uses strictly necessary cookies (e.g. the session cookie PHPSESSID for the contact form) and – only with your consent – statistics cookies (Google Analytics, see section 6) and marketing cookies (Google Ads conversion tracking, see section 7). The complete cookie table can be found in our cookie policy (zpas.de/en/cookies.html).

To obtain and manage your consent, we use the consent management service Cookiebot provided by Cybot A/S (Havnegade 39, 1058 Copenhagen, Denmark). Cookiebot stores a strictly necessary cookie (CookieConsent) containing your consent status. When you first visit the site, a consent banner appears through which you can accept or reject cookies that require consent. You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the page footer.

Legal basis for strictly necessary cookies: § 25(2) no. 2 TDDDG. Legal basis for cookies requiring consent: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent).

6. Web analytics with Google Analytics

This website uses – only with your consent – Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies that enable a pseudonymised analysis of your use of the website (e.g. pages visited, time spent on the site, approximate location, device used). The IP address is truncated by Google and is not combined with other data.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR, which you give via the cookie banner and can withdraw at any time. The use of Google Analytics may involve a transfer of data to the USA; Google is certified under both the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. Further information can be found in Google’s privacy policy.

For Google Analytics, too, we use Google Consent Mode in its advanced implementation. If you reject statistics cookies, no Analytics cookies are set; however, cookieless signals may be transmitted to Google. Details can be found in section 7.

7. Conversion tracking with Google Ads

This website uses – only with your consent – Google Ads conversion tracking, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This allows us to measure the success of our online advertisements: if you reach our website via a Google ad and then perform a specific action (e.g. submitting the contact form or a configurator), this is recorded as a “conversion”.

For this purpose, Google sets a cookie (e.g. _gcl_au) as soon as you click on an ad. These cookies are not used to identify you personally. We receive from Google only aggregated statistics on the total number of conversions, not on individual users. We do not recognise you across different websites.

The legal basis is your consent pursuant to § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR, which you give via the cookie banner and can withdraw at any time via the “Cookie settings” link in the page footer. Without your consent, no marketing cookies are set. The use of Google Ads may involve a transfer of data to the USA; Google is certified under both the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. Further information: Google’s privacy policy.

Enhanced Conversions: When you submit our enquiry and contact forms, we transmit the email address you have provided (and, if provided, your telephone number) to Google in pseudonymised form (SHA-256 hash) in order to measure the effectiveness of our advertisements (Enhanced Conversions). This only takes place if you have previously consented to the use of marketing cookies. The legal basis is Art. 6(1)(a) GDPR; you can withdraw your consent at any time via the “Cookie settings” link in the page footer.

Google Consent Mode: We use Google Consent Mode in its advanced implementation. If you reject statistics or marketing cookies, no cookies are set and no cookie-based identifiers are used. In this case, however, your browser transmits cookieless signals (so-called pings) to Google containing the consent status, basic technical information (time of access, referrer URL, approximate device information) and the IP address. These pings contain no cookie identifiers and serve exclusively for aggregated, modelled performance measurement; individual users are not recognised. In addition, the “ads_data_redaction” function is activated, which removes advertising identifiers from these signals. The legal basis for this cookieless processing is Art. 6(1)(f) GDPR (legitimate interest in aggregated reach and conversion measurement).

8. Contact form and contact by email

A contact form is available on our website. The following data is processed:

  • First name and surname (mandatory field)
  • Email address (mandatory field)
  • Company (optional)
  • Telephone number (optional)
  • Product area / subject (optional)
  • Message text (mandatory field)
  • IP address and timestamp (technically necessary, protection against misuse)

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (consent given by submitting the form with the data protection checkbox ticked).

Storage period: The data is deleted as soon as the enquiry has been fully dealt with and no statutory retention obligations prevent deletion. Retention periods under commercial and tax law (6 or 10 years under the German Commercial Code (HGB) / German Fiscal Code (AO)) remain unaffected where the enquiry leads to the conclusion of a contract.

Incoming enquiries may be passed on, for the purpose of preparing quotations and clarifying technical matters, to our parent company and the manufacturer of the products, ZPAS S.A., Przygórze 8, 58-410 Marciszów, Poland. ZPAS S.A. processes this data as an independent controller for the purpose of carrying out pre-contractual measures or performing the contract (Art. 6(1)(b) GDPR). Poland is an EU member state; the GDPR applies directly there.

Alternatively, you can contact us directly by email: info@zpasgroup.de. Please note that emails are transmitted unencrypted unless end-to-end encryption is used.

9. Product configurators

Our website offers online configurators for outdoor enclosures, server racks, electrical enclosures, control desks, aisle containment (Databox) and cable trays. The configuration (dimensions, equipment, accessories) is put together exclusively locally in your browser. No personal data is processed in the process, and no data is transferred to us or to third parties.

Only when you request a quote via the enquiry form at the end of the configurator is the following data transmitted to us: name (mandatory field), email address (mandatory field), company (optional), telephone number (optional), remarks (optional), the configuration you have put together, and IP address and timestamp (protection against misuse).

The legal basis, storage period and possible disclosure to our production plant correspond to the information on the contact form (section 8).

10. Fonts (hosted locally)

This website uses the fonts Source Sans Pro and Open Sans. These are delivered exclusively locally from our own server and are an integral part of the website. There is no connection to Google Fonts or other external servers. When the fonts are loaded, no IP address is transmitted to third parties (in particular not to Google).

No consent is required for this, as there is no transfer of data to third parties and no processing beyond what is technically necessary.

11. External links and sharing function

Our website contains links to external websites (e.g. Google Maps for our address, LinkedIn, X (Twitter), YouTube, Facebook, zpasgroup.pl). When you click on these links, you leave our website; the operators of the external sites are responsible for data protection there. Your data is only passed on to these services when you actively click on a link. External services are not embedded (no iFrame, no embedded widget).

On some pages (guides, news, product pages), we offer share buttons for LinkedIn, X (Twitter), Facebook and email. These are implemented as simple links (the so-called “Shariff” solution): no scripts from the networks are loaded and no cookies are set. A connection to the respective network and any transfer of data only take place if you actively click on a share button. The “Copy link” function does not process any personal data and merely copies the page address to your clipboard.

12. Disclosure of data and processing on behalf of the controller

Personal data is only disclosed to third parties if:

  • you have given your express consent pursuant to Art. 6(1)(a) GDPR,
  • the disclosure is necessary pursuant to Art. 6(1)(b) GDPR for the performance of a contract with you,
  • there is a legal obligation pursuant to Art. 6(1)(c) GDPR, or
  • the disclosure is necessary pursuant to Art. 6(1)(f) GDPR for the establishment, exercise or defence of legal claims.

Our website is hosted by a hosting provider based in the EU. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the hosting provider.

13. Your rights as a data subject

You have the following rights vis-à-vis us with regard to your personal data:

  • Access (Art. 15 GDPR): You can request confirmation as to whether we process personal data concerning you, and request access to this data and further information.
  • Rectification (Art. 16 GDPR): You can request the rectification of inaccurate personal data or the completion of incomplete personal data without undue delay.
  • Erasure (Art. 17 GDPR): You can request the erasure of your personal data, provided that no statutory retention obligations prevent this.
  • Restriction of processing (Art. 18 GDPR): You can request that we restrict the processing of your data.
  • Data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
  • Objection (Art. 21 GDPR): You can object to the processing of your data on the basis of legitimate interests.
  • Withdrawal of consent (Art. 7(3) GDPR): You can withdraw any consent you have given at any time with effect for the future.
  • Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for us is:

Saxon Data Protection and Transparency Commissioner
Devrientstraße 5, 01067 Dresden
Telephone: +49 351 85471 101
www.datenschutz.sachsen.de

Alternatively, you can also contact the supervisory authority of your habitual residence — in Austria the Austrian Data Protection Authority (Datenschutzbehörde, www.dsb.gv.at), in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, in German EDÖB, www.edoeb.admin.ch).

To exercise your rights, please contact: info@zpasgroup.de

14. Right to object in the case of legitimate interests

Where we process personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object pursuant to Art. 21 GDPR on grounds relating to your particular situation. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

15. Data security

This website uses SSL/TLS encryption for data transmission. You can recognise an encrypted connection by the padlock symbol in the browser’s address bar and by the fact that the address begins with “https://”. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Our website and the systems used are protected by technical and organisational measures against loss, destruction, access, alteration and dissemination of your data by unauthorised persons.

16. Information for users from Austria or Switzerland

Austria: For users from Austria, the GDPR applies directly; in addition, the Austrian Data Protection Act (Datenschutzgesetz, DSG) must be observed. Your rights and options for lodging a complaint correspond to those set out in section 13.

Switzerland: For users from Switzerland, the revised Swiss Federal Act on Data Protection (revFADP; German abbreviation: revDSG) also applies. The processing described in this policy is carried out in accordance with its principles. Under the revFADP, you have in particular a right of access and a right to the delivery or transfer of your data. Complaints can be addressed to the Federal Data Protection and Information Commissioner (FDPIC).

17. Validity and amendment of this privacy policy

This privacy policy was last updated in June 2026. We reserve the right to amend this policy where changes in data protection law or changes to our website make this necessary. The current version is available at zpas.de/en/privacy-policy.html. Please check the content of our privacy policy regularly.