Zevio Privacy Policy
Effective from: 03.03.2026
1. Data controller
The personal data controller is:
ZEVIO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
ul. Szlak 77 / 222
31-153 Kraków
KRS: 0001224773
NIP: 6762713546
REGON: 544029502
Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI Wydział Gospodarczy Krajowego Rejestru Sądowego
Kapitał zakładowy: 250 000 zł
Contact for data protection matters: contact@zevio.io
2. Scope of data processed
Depending on how you use the Platform, we process in particular:
- account data (first name, last name, email address),
- organisation data (name, registration details, NIP, address),
- transaction data (amount, currency, status, transaction ID),
- subscription-related data,
- technical data (IP address, device identifiers, system logs, session data).
For BLIK recurring payments, the following may also be processed:
- Payer consent identifier,
- subscription parameters (amount, frequency, validity date),
- consent status for initiating transactions,
- history of recurring payment attempts.
Zevio does not store payment card data - it is processed solely by external payment operators in accordance with applicable security standards (PCI DSS).
3. Purposes of processing
Data is processed for:
- performance of services under the Platform,
- handling one-off and recurring payments,
- execution of recurring payments initiated by the Merchant on the basis of the Payer's consent,
- handling complaints related to transactions, including Recurring Transactions,
- fulfilment of accounting and tax obligations,
- ensuring system security and preventing abuse,
- technical and statistical analysis of the Platform's operation.
4. Legal basis for processing
Data is processed on the basis of:
- Article 6(1)(b) GDPR - performance of a contract or steps prior to entering into a contract,
- Article 6(1)(c) GDPR - compliance with legal obligations of the Controller,
- Article 6(1)(f) GDPR - legitimate interest of the Controller (e.g. security, pursuing claims, preventing abuse).
5. Recipients and processors
Data may be disclosed to:
1) Payment operators
In particular: Krajowy Integrator Płatności S.A. (Tpay) - for handling and settling transactions (including BLIK and recurring payments).
For Recurring Payments, data is disclosed to the payment operator, payment service provider (PSP) and the Issuer (Payer's bank) in accordance with BLIK system rules.
2) Cloud infrastructure providers
The Zevio Platform is hosted on Google Cloud Platform (GCP) in the European region (EU).
Data is processed in Google cloud services, including:
- server environment (Google Cloud - App Engine / Cloud Run),
- databases,
- Google Cloud Storage (file and asset storage).
Google acts as a processor under data processing agreements in accordance with the GDPR.
3) IT and communications service providers
- email service providers (e.g. transactional emails),
- analytics and monitoring tools,
- entities supporting system maintenance and development.
All entities process data under appropriate data processing agreements.
6. Transfer of data outside the EEA
Data is as a rule processed within the European Economic Area (EEA).
Any transfer outside the EEA is carried out only on the basis of appropriate safeguards under the GDPR (e.g. standard contractual clauses).
7. User rights
You have the right to:
- access your data,
- rectification,
- erasure,
- restriction of processing,
- data portability,
- object to processing,
- lodge a complaint with the President of the Personal Data Protection Office.
To exercise your rights, please contact the Controller at the email address provided.
8. Data retention
Data is retained:
- for the duration of the agreement and use of the Platform,
- for the period required by law (e.g. tax and accounting),
- for the period necessary to establish, pursue or defend claims.
9. Security
The Controller implements appropriate technical and organisational measures to protect the data processed, including:
- data transmission encryption (HTTPS / TLS),
- access control (roles, authorisation),
- authentication and session management,
- event logging (system logs, audit),
- safeguards against abuse and attacks.
10. Cookies and analytics tools
The zevio.io website uses cookies and similar technologies. On your first visit we display a consent banner where you can accept all categories, accept only the necessary ones, or choose specific categories. You can change your choice at any time - the "Cookie settings" link sits in the footer of every page.
Cookies are split into three categories. Only the "Necessary" category is enabled by default - the others require your explicit consent.
Necessary (always on)
Required for the site to work - cannot be disabled without losing basic functionality:
- user session and security mechanisms (Firebase, first-party cookies),
- storing your cookie consent (cookie `zevio_cc`, valid for 12 months),
- Zevio assistant (support chatbot) - stores conversation history within the current session.
Analytics (optional, consent required)
Google Analytics 4 (Google Ireland Limited / Google LLC) - measures traffic and user behaviour. We use Google Consent Mode v2: without your consent GA4 runs in "cookieless" mode - sending only aggregate, anonymous signals about the visit, without identifiers, without cookies, with no way of linking the data to a specific person. After your consent GA4 switches to full mode (cookies `_ga`, `_ga_*`, client identifier, conversion modelling).
Microsoft Clarity (Microsoft Ireland Operations Limited) - click maps and session recordings (with automatic masking of sensitive fields such as passwords, card data, login forms). Loaded only after you have consented to the "Analytics" category.
Marketing (optional, consent required)
DMSales (dmsales.com) - AI-powered B2B lead generation: identifies companies visiting the site and enriches data about potential buyers. The tracking script is loaded from analytics.greensender.pl (legacy infrastructure under the service's previous Greensender brand). Activated only after you have consented to the "Marketing" category.
Meta Pixel (Meta Platforms Ireland Ltd.) - measuring the performance of advertising campaigns across Meta services (Facebook, Instagram) and remarketing. The pixel stores identifiers in cookies (incl. _fbp, _fbc) and sends events to Meta such as page view and form submission (the "Lead" event). Activated only after you have consented to the "Marketing" category. Meta may process data outside the EU - under the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC).
Zevio assistant (chat support)
The help chat shown on zevio.io and inside the signed-in app.zevio.io dashboard is powered by the Claude large language model from Anthropic, PBC (USA). The assistant answers product questions, helps navigate the documentation and routes you to the right Zevio team member. The text of your message and the running conversation history are sent to Anthropic to generate a reply. Under the commercial agreement with Anthropic, your data is not used to train AI models.
Other data recipients (outside the cookie layer)
Independently of cookies, data may be transferred to the following processors under data processing agreements (Article 28 GDPR):
- Brevo (Sendinblue SAS, France) - delivery of transactional emails (confirmations, contact-form auto-replies),
- Tpay (Krajowy Integrator Płatności S.A., Poland) - BLIK Recurring and card payment operator,
- Stripe (Stripe Payments Europe Limited, Ireland) - card payment operator for EUR/USD customers outside Poland,
- Anthropic (Anthropic, PBC, USA) - provider of the Claude model powering the Zevio assistant (see section above),
- Google Cloud Platform (Google Ireland Limited) - server infrastructure, Cloud SQL database, GCS storage,
- Firebase (Google Ireland Limited) - user authentication for the Zevio dashboard.
Transfers to third countries
Google Analytics 4, Microsoft Clarity, Stripe and Anthropic (Zevio assistant) may transfer data to the United States. The transfer takes place under the EU-US Data Privacy Framework (European Commission decision of 10 July 2023) or Standard Contractual Clauses (SCCs) approved by the Commission, with additional technical safeguards (IP anonymisation, encryption in transit). The full list of transfer mechanisms is available on request at contact@zevio.io.
Managing your consent
You can change or withdraw your consent at any time by clicking the "Cookie settings" link in the footer of every page. Withdrawal does not affect the lawfulness of processing carried out under consent before it was withdrawn. You can also manage and delete cookies directly in your browser settings.