Privacy Notice

Last updated: 21 October 2026

Privacy Notice

At a glance

• We only use cookies and analytics/marketing tools with your consent.

• Your data may be transferred to the USA in certain cases – see section 10.

• You can withdraw your consent at any time with effect for the future (cookie settings in the footer).

• The controllers are Zingerle Group AG and the national company responsible for your country (section 1).

• Your rights (access, erasure, objection, etc.) are set out in section 9. 

Table of contents

2. Data protection officer

No data protection officer within the meaning of Art. 37 GDPR has been appointed to date. For any data protection queries, please contact the address given in section 1. 

3. General information on data processing

We only process our users' personal data to the extent necessary to provide a functioning website and our content and services, or where a legal basis or your consent applies.

Legal bases

Google Analytics 4 

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Evaluates pages visited, time spent and referring page; for technical reasons your IP address reaches Google when a page is loaded, but GA4 does not log or store it.

Meta Pixel

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Used for conversion tracking and building remarketing audiences. When Custom Audiences are used, our customers’ e-mail addresses are pseudonymised with a one-way hash before transmission; Meta matches the hash values against its own user accounts in order to identify the same persons and show them advertising (this is not anonymisation). This list matching has nothing to do with cookies and takes place exclusively on the basis of separate consent (Art. 6(1)(a) GDPR), which we obtain at registration or newsletter sign-up and which you can withdraw at any time by e-mail to [email protected].

Google Ads / Customer Match 

Provider: Google Ireland Limited. Shows website visitors interest-based advertising on other websites; for Customer Match, hashed (pseudonymised) e-mail addresses of our customers are matched against Google accounts in order to target these persons within Google services. This list matching does not rely on the cookie consent but exclusively on separate consent (Art. 6(1)(a) GDPR), which we obtain at registration or newsletter sign-up and which you can withdraw at any time by e-mail to [email protected]. 

Hotjar 

Provider: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julians STJ 3141, Malta. Used for pseudonymised analysis of user behaviour (e.g. scroll depth, clicks as aggregated heatmaps); IP addresses are stored only in anonymised form.

7. Enquiries, quotes, registration and orders

Through this website you can submit an enquiry (contact form, e-mail, phone), register a customer account or, where offered, order directly. Depending on the process, we collect: company, first and last name, phone number, e-mail address, address, country and product-related details.

Process for direct enquiries: your enquiry is handled by the responsible sales representative; once the order is confirmed, it is put into production, shipped and invoiced. Process for the online shop with direct checkout (where offered on this website): once the order is submitted and payment confirmed, the contract is deemed concluded; a confirmation e-mail is sent. The legal basis in each case is Art. 6(1)(b) GDPR. 

Retention period: we store this data for the duration of the business relationship and thereafter in accordance with the statutory retention periods of the country in which the contract is concluded (commercial- and tax-law retention periods; currently up to 10 years from the end of the financial year). 

Data is passed on to third parties only where necessary for the performance of the contract, e.g. to payment service providers and shipping providers. Data is transmitted for advertising purposes only within the framework of the analytics and marketing tools (section 6; matching of customer e-mail lists) and exclusively with your separate consent.

8. Careers and job applications 

Through the “Careers” section of this website you can submit a speculative application or apply for an advertised position. We process the data you enter in the application form: first and last name, address, postcode, date of birth (if provided), e-mail address, phone number, your message and uploaded documents (e.g. CV, references). The purpose is to carry out the application process; the legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) and, where applicable, the relevant national rules on employee data protection.

Controllership for applicant data follows section 1: Zingerle Group AG together with the Zingerle Group company to which you apply or which advertised the position. Your documents are made available only to persons involved in the selection process. Please do not submit special categories of personal data (e.g. health data, religious beliefs) unless they are necessary for your application. 

Retention: we store your application data until the application process is complete and, if unsuccessful, as a rule for up to six months afterwards, unless longer statutory retention is required or you have consented to longer storage (e.g. inclusion in a talent pool). If you are hired, the data is transferred to your personnel file. 

9. Your rights

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw any consent given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or of the alleged infringement. The authority responsible for Zingerle Group AG is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy (www.gpdp.it). 

Right to object (Art. 21 GDPR) 

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. Where your data is processed for direct marketing purposes, you have the right to object at any time without giving reasons; your data will then no longer be processed for that purpose. You may object informally by e-mail to [email protected]. 

Automated decisions and provision of data

There is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. The provision of personal data is neither a statutory nor a contractual requirement unless indicated in the individual case; however, for enquiries, orders and applications the details marked as mandatory are required, as otherwise we cannot handle the enquiry, conclude the contract or consider the application. Processing of log file data is technically necessary to deliver the website.

10. International data transfers to the USA

When using the Google and Meta services referred to above, and when clicking links to Meta and LinkedIn, personal data may be transferred to the USA (Hotjar processes data within the EU/Malta). We base such transfers on the EU-US Data Privacy Framework (DPF), supplemented as a precaution by EU Standard Contractual Clauses under Art. 46(2)(c) GDPR as a fallback. Data from enquiries, registrations and orders may also be transferred within the group to Zingerle Group USA Inc. or be accessible there; we base these intra-group transfers on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). 

Legal background in detail

Google and Meta state that they are certified under the DPF, under which the European Commission generally confirms an adequate level of data protection for such recipients (adequacy decision of 10 July 2023). The legal certainty of this framework has been subject to uncertainty since 29 June 2026: in Trump v. Slaughter, the US Supreme Court held that the statutory protection against removal of the members of the Federal Trade Commission (FTC) is incompatible with the separation of powers under the US Constitution. The FTC is the enforcement authority for the DPF principles; independent oversight under the DPF otherwise rests mainly on the Data Protection Review Court and the Privacy and Civil Liberties Oversight Board (PCLOB). What consequences the ruling has for the adequacy decision remains open. A challenge to the adequacy decision is pending before the CJEU (Case C-703/25 P); a ruling is still pending and the adequacy decision remains in force unchanged in the meantime.

11. Additional information for users in Switzerland

For users based in Switzerland, in addition to section 1: the controller within the meaning of the Swiss Federal Act on Data Protection (FADP) is, in addition to Zingerle Group AG, Zingerle Group Schweiz GmbH, Bahnhofstrasse 27, 8864 Reichenburg. As the FADP largely corresponds to the GDPR, sections 2–9 apply accordingly; the following differences apply: the FADP does not require private controllers to appoint a data protection officer, and the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), not an EU supervisory authority. Transfers to the USA are based on the Federal Council’s adequacy decision where the recipient is certified under the Swiss-US Data Privacy Framework, and otherwise on standard contractual clauses with Swiss adaptations.

12. Additional information for users in the USA (CCPA)

For users resident in the United States, in particular California, in addition to section 1: data of users in the USA is additionally processed by Zingerle Group USA Inc., 6965 Northpark Blvd, Suite N, Charlotte, NC 28216, USA, which acts in this respect as an independent business within the meaning of the CCPA (no joint controllership under Art. 26 GDPR). Where the thresholds of the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), are met, the following applies. 

Categories collected in the last 12 months: identifiers (name, e-mail address, address, IP address, cookie identifiers), commercial information (enquiries, orders), internet or network activity (website usage data), approximate location data (derived from the IP address) and, for applications, professional information. Retention is governed by the periods stated for each processing activity in this notice. “Sharing” for cross-context behavioural advertising takes place only via the marketing tools named in section 6 and only with your consent; we do not sell personal information for monetary consideration. 

Rights of California consumers: access to the categories, sources, purposes and recipients of data collected, deletion, correction, the right to opt out of the “sale” or “sharing” of personal information (“Do Not Sell or Share My Personal Information”) and non-discrimination for exercising these rights. You can exercise these rights by e-mail to [email protected], by phone on +39 0472/977100 or – for the opt-out – via the cookie settings banner. We treat opt-out preference signals such as Global Privacy Control (GPC) as an opt-out request. 

13. Social Media 

Facebook & Instagram 

This website contains buttons or links to our Facebook and/or Instagram profiles (provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). These are plain links without an active social plugin on the page itself; the links alone do not transmit any data to Meta. Only when you click the icon is a connection established to Meta’s servers, and Meta receives information that you have visited our site. Independently of this, where you have given consent, Meta may receive data about your visit via the Meta Pixel (see section 6). Further details can be found in Meta’s privacy information: https://www.facebook.com/privacy/explanation. 

LinkedIn 

This website contains a link to our LinkedIn company profile (provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). Clicking the icon establishes a connection to LinkedIn; LinkedIn receives information about your visit. Further information: LinkedIn Privacy Policy (https://www.linkedin.com/legal/privacy-policy).

14. Changes to this privacy notice

We update this privacy notice whenever changes to the law, case law or our processing activities require it. The version published on the website at any given time applies.