Privacy Policy 
(EU GDPR Compliant)

1. Introduction

Welcome to Zento (“we”, “us”, “our”). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how Zento A/S and EPMAP Limited collect, use, disclose, and safeguard your personal data when you use our website, the Zento Platform, or any services accessible through it.

This Privacy Policy applies in addition to any product-specific privacy notices or data processing agreements (“DPA”) we provide to you. Where there is a conflict, the more specific policy or agreement will prevail.

Please read this Privacy Policy carefully so that you understand how and why we use your personal data.

2. Data Controller(s)

ZENTO A/S

Role: Data Controller
Purpose: Personal data processed when you use the Zento website, platform accounts, marketing, customer support, onboarding, and non-financial services.

EPMAP Limited

Role: Data Controller for financial services
Purpose: All personal data processed when you use financial products or payment services accessed through the Zento platform.

EPMAP Limited’s privacy notice is available here:
(Link placeholder; you should replace the URL with an internal link rather than a raw URL)

Where you use a service for which you determine the purposes and means of processing (e.g., when providing employee or customer data), you are the Data Controller and Zento A/S acts as your Data Processor. In these cases, you must enter into a Data Processing Agreement (DPA) with us.

3. When We Act as a Data Processor

Zento A/S acts as a Data Processor only when processing personal data on behalf of a business client (for example, employee or end-customer data that you upload or transmit through the platform).
In such cases, we:

• Process data only according to your written instructions
• Sign and comply with a Data Processing Agreement (DPA)
• Implement appropriate technical and organisational security measures
• Assist you in fulfilling your GDPR obligations regarding data subjects
• Only engage sub-processors with your authorisation

4. Personal Data We Collect

We may collect and process the following categories of personal data depending on how you use our services:

4.1 Identity and Contact Data

• Name, residential and business address
• Email address, phone number
• Contact preferences
  Purpose: Account creation, communication, customer service, contractual obligations.

4.2 Financial and Transaction Data

• Payment card data
• Account numbers
• Transaction history
• Payment instructions
  Purpose: Providing financial services, processing payments, fraud prevention, legal compliance.

4.3 Contractual Data

• Products or services you have purchased or subscribed to
• Records of agreements
  Purpose: Contract performance, billing, account management.

4.4 Technical and Usage Data

• IP address and approximate location
• Log files, browser type, device identifiers
• Activity on the Zento Platform
  Purpose: Service operation, security, analytics, website performance.

4.5 Behavioural Data

• Interaction with products, features, and tools
• Service usage patterns
  Purpose: Improving user experience, product development.

4.6 Documentary Data

• Identity documents (passport, ID card, driver’s licence)
• Address verification documents
  Purpose: Anti-money laundering (AML), KYC, fraud prevention, legal compliance.

4.7 Special Category Data (processed only where strictly necessary)

We may process the following only when required and permitted by law:

• Biometric data (e.g., identity verification photographs)
• Data revealing racial or ethnic origin (where requested for compliance or reporting)
• Health data (e.g., accessibility needs)
  Purpose: Regulatory compliance, fraud prevention, customer support.

4.8 Data Provided by You About Others

When you provide personal data of employees, clients, or other third parties, you confirm that you have a lawful basis to do so. We process this data solely as your Data Processor.

4.9 Third-Party Data Sources

We may receive data from:

• Identity verification partners
• Payment providers
• Fraud and AML databases (e.g., CIFAS or equivalent)
• Public records (Companies House, business registries)

5. How We Collect Your Data

We collect data through:

• Direct interactions: account creation, onboarding, contact forms, emails, calls, customer support
• Automated technologies: cookies, logs, tracking technologies
• Third-party partners: verification providers, payment processors, analytics services
• Public sources: government and corporate registers

Cookie details are available in our Cookie Policy.

6. How We Use Your Data (Legal Basis)

We process your personal data in compliance with EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation):

6.1 To Perform a Contract (Art. 6(1)(b))

• Create and manage user accounts
• Provide access to Zento services
• Process payments and transactions
• Provide customer support

6.2 To Comply with Legal Obligations (Art. 6(1)(c))

• Anti-money laundering (AML) and KYC checks
• Tax and accounting requirements
• Regulatory reporting obligations
• Fraud prevention and risk management

6.3 Our Legitimate Interests (Art. 6(1)(f))

• Improve our services
• Prevent misuse or fraud
• Keep our platform secure
• Conduct analytics and business planning
• Provide marketing communications (where allowed by law)

6.4 Based on Your Consent (Art. 6(1)(a))

• Marketing communications (email/SMS)
• Non-essential cookies
• Certain types of profiling
• Where legally required for processing special category data

You may withdraw your consent at any time. Please contact us if you want to do so at admin@zento.com

7. Who We Share Your Data With

We only share data where necessary and permitted. Data may be shared with:

• EPMAP Limited (Data Controller for financial services)
• Zento A/S group companies
• Identity verification providers (e.g., Flagright, Ondato)
• Cloud hosting and IT service providers
• Payment processors and banking partners
• Regulatory authorities and law enforcement (where legally required)

We do not sell personal data and we do not share data with unrelated third parties for their own marketing purposes.

8. Data Storage, Processing and Retention

We store and process data within EEA.

We retain personal data only as long as necessary for the purposes stated in this policy, including:

• 8 years for financial and transaction records (AML and regulatory requirements) after the termination of the business relationship
• Longer if required for legal claims, disputes, compliance, or investigations
• Certain information may be anonymised and retained for analytics

When data is no longer needed, it is securely deleted or anonymised.

9. Cookies

We use:

• Strictly necessary cookies
• Functional cookies
• Performance/analytics cookies
• Targeting/advertising cookies

You can manage cookies via your browser or our cookie consent tool. Non-essential cookies require your consent.

See our Cookie Policy for details.

10. Your GDPR Rights

You have the following rights under EU law:

• Right to be informed
• Right of access (data subject access request)
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to object
• Right to data portability
• Right to withdraw consent
• Right not to be subject to automated decision-making (where applicable)

To exercise any rights, contact: admin@zento.app

We may request proof of identity to verify your request.
We respond within one month, extendable by two months for complex requests.

11. Complaints

If you are not satisfied with how we handle your data after reaching us at admin@zento.app, you may contact your local EU Supervisory Authority.
A list of authorities is available via the European Commission website.

12. Keeping Your Data Accurate

Please keep your details up to date by updating your account information or contacting us at admin@zento.app.

13. Changes to This Privacy Policy

We may update this Privacy Policy to remain compliant with applicable laws or reflect changes in our services. Updates will be posted on this webpage.