Privacy policy
This is ZimSystem’s current privacy policy. It explains how personal data is handled in connection with the service, our website and our customer relationships. The customer expressly acknowledges this policy as part of the terms accepted during onboarding. That acknowledgement is not blanket consent to processing and does not replace a separate consent where one is required. A customer’s webshop has its own controller and must provide its own information to shoppers.
Updated · 20 September 2026
1. Who is responsible?
ZimSystem ApS, company no. 41432462, Skejbytoften 33, 8200 Aarhus N, Denmark, is the controller for its own sales, invoicing, support and contact purposes. When a business uses the platform for its customers, staff and orders, the business is generally the controller and ZimSystem processes information on its instructions as processor. Specific roles depend on the processing and the agreement.
2. What information?
Depending on use, ZimSystem processes names, business contact details, addresses, email addresses, telephone numbers, account access information, support requests, invoice information and technical information such as IP addresses and operational logs. A customer’s use of the platform may also involve end-customer profiles, orders, delivery details, payment references and staff actions. The Admin AI assistant is separated from those identity domains: its database allowlist excludes customer and user tables, names, email addresses, telephone numbers, addresses, credentials and other direct identifiers. Company and outlet names and registration numbers are also excluded. Server-side controls reject common direct identifiers in chat text and remove protected identity fields before a request reaches the AI provider. Users must not enter personal data, passwords, payment-card data or other confidential identifiers in AI chat or other free-text fields.
3. Where does information come from?
Information comes from you, the business you represent, use of the platform and the integrations selected by the business. Information about shop customers typically comes from orders, account creation and the shop’s own records. We do not necessarily receive the same data from every payment provider; this depends on the payment solution.
4. Purposes and legal bases
As controller, we use information to answer enquiries, administer customer relationships, invoice, provide support and maintain operations. The legal basis may be performance of a contract with you where you are personally a contracting party (GDPR Article 6(1)(b)), legal obligations such as accounting (Article 6(1)(c)), or legitimate interests in business communications, customer administration, operations and security (Article 6(1)(f)), subject to an appropriate balancing assessment. Consent-based processing relies on Article 6(1)(a). For customer-controlled data, the customer determines purposes and legal bases; our processing agreement is not itself the customer’s legal basis.
5. Recipients and integrations
Information is available only to authorised users within the customer’s tenant and to ZimSystem personnel who need access for agreed operation, support, security or legal duties. End customers cannot see another end customer’s data, and one business customer cannot see another business customer’s tenant data through the ordinary service. Necessary suppliers may process limited data under their actual role, contract and documented purpose. These may include hosting and email suppliers, e-conomic where enabled for accounting, S5, MobilePay or Frisbii for selected payment services, InMobile for SMS, and OpenAI for the optional Admin AI assistant. The AI integration is configured without stored model output and is intended to receive only tenant-scoped operational data from the code-owned allowlist, not customer or user identity data. Authorities may receive information where law requires it. The customer must inform its own users and end customers about relevant disclosures, purposes, legal bases and rights. No technical control by itself is a blanket GDPR certification.
6. Hosting and transfers
Platform data is currently hosted on our own servers in Denmark and replicated to a physically separate server at another location. Replication does not itself establish historical backups or a particular recovery capability. We envisage possible future Azure hosting with MySQL and may later change processing countries. Such changes require appropriate agreements and updated information; transfers outside the EEA require a lawful transfer mechanism and necessary supplementary measures. Danish platform hosting does not necessarily mean that every external integration processes data exclusively in Denmark.
7. Retention and the current limitation
There is currently no automatic deletion routine. Accounts, customer information and orders generally remain stored until deletion is handled manually, including following a valid request. This practice does not provide a legal basis for indefinite retention. Accounting material generally must be retained for five years from the end of the relevant financial year; this does not automatically apply to every account or item of personal data. Other information may be retained only while a relevant lawful purpose exists. For data processed on a customer’s behalf, the customer determines retention instructions and chooses return or deletion on termination under the data processing agreement. Requests are handled manually through info@zimsystem.dk, subject to applicable legal obligations.
8. Cookies and tracking
This marketing website does not load analytics tools, advertising scripts or external media embeds. Customer webshops can separately be configured with Google tracking and other integrations. Optional tracking is controlled there through cookie choices and must not be activated merely because someone visits the site. The shop must explain its specific tools, purposes and consent choices. Necessary cookies and personal-data processing must each be assessed under the applicable rules; a cookie category is not itself a GDPR legal basis.
9. Your rights
Depending on the circumstances, you have rights of access, rectification, erasure, restriction, objection and data portability. Consent can be withdrawn without affecting the lawfulness of earlier processing. Rights are not absolute; for example, statutory retention may restrict erasure. Contact info@zimsystem.dk. If your request concerns a shop’s processing, you should contact the shop as controller; we assist on instructions. We may request information necessary to verify identity and respond within GDPR time limits.
10. Security and complaints
Access is tenant-scoped and permission-controlled. Customer and user identity data is excluded from the Admin AI assistant’s database tools and protected UI context; common direct identifiers in prompts are blocked on the server before provider access. AI database tools are read-only, use fixed company and outlet scope, and cannot write changes. These safeguards support data minimisation, purpose limitation and privacy by design, but lawful operation also requires an applicable legal basis, transparent notices, appropriate processor terms, retention and transfer assessments, and operating practices for the specific use. Consent is used where consent is the applicable legal basis; GDPR does not make consent the only possible legal basis. This page does not establish certification, complete encryption of all stored data or a particular recovery time. Contact us promptly if you suspect a security problem. You may complain to the Danish Data Protection Agency through datatilsynet.dk if you believe personal data is processed unlawfully.