Privacy Policy
Last updated: June 2026
1. Data Controller
The data controller within the meaning of the GDPR is: Finn Zender Zender Resources Group Im Mühlenfeld 15 66687 Wadern Germany Phone: +49 159 03170942 Email: info@zrgmineral.com Website: https://www.zrgmineral.com
2. Collection of Personal Data
When you visit our website, server log data is processed automatically (browser type, operating system, referrer URL, hostname, time of request, IP address). This is technically required to operate the site. Contact form: name, company, email address, optional phone number, role, commodity interest and message. Onboarding / admission: company name, contact person, email, selected plan and optional message for enterprise quotes. Platform use: uploaded supplier documents (CoA, certificates), validation results and audit trail entries — solely within the agreed compliance service.
3. Hosting and Processors
Website hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA — log data and static content. Transfer based on EU Standard Contractual Clauses. Email delivery: Resend, Inc. — contact and system emails. Payment processing: Stripe, Inc. — invoicing and payment collection for B2B subscriptions. Account storage: Vercel KV / Upstash — onboarding and billing account data (company name, email, plan status). AI document analysis (optional): OpenAI, L.L.C. — document content for field extraction and compliance validation when OPENAI_API_KEY is configured. Only text required for validation is transmitted.
4. Purpose of Processing
Operation and security of the website; handling inquiries and onboarding; provision of the ZRG Compliance Standard (validation, audit trail, market data dashboard); invoicing and contract fulfilment; compliance with statutory retention obligations.
5. Legal Basis
Art. 6(1)(b) GDPR — contract performance and pre-contractual measures. Art. 6(1)(a) GDPR — consent (contact form checkbox). Art. 6(1)(f) GDPR — legitimate interest (website operation, IT security, B2B communication). Art. 6(1)(c) GDPR — legal obligation (retention of invoice data).
6. Retention Period
Contact inquiries: deleted after processing, at latest after 3 years. Onboarding and contract data: duration of the contract plus statutory retention (typically 10 years for tax records). Server logs: maximum 30 days. Validation and audit data: per contractual agreement or deletion on request after contract end.
7. Your Rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Contact us at info@zrgmineral.com or via the contact form. You may lodge a complaint with a supervisory authority: Unabhängiges Datenschutzzentrum Saarland Fritz-Dobisch-Straße 12 66111 Saarbrücken Germany
8. Cookies
We do not use marketing or tracking cookies (no Google Analytics etc.). Technically necessary cookies: • NEXT_LOCALE — language preference (next-intl) • zrg_account_id — onboarding/billing account (httpOnly) • zrg_enterprise_session — platform access after activation (httpOnly) • zrg_session_email — signed-in user email (httpOnly) • zrg_platform_access — platform access grant (httpOnly) • zrg_member_id — team member session (httpOnly) • zrg_billing_admin — internal admin sessions only These cookies are required for platform operation. A notice is shown on first visit.