Built by design to collect almost nothing.

1. Who we are

We are ID ZENO KITION SECURITY AND PRIVACY LTD (trading as “Zeno Kition”), a company incorporated in the Republic of Cyprus (EU), registration number HE499612, registered office at 11 Kyriacou Matsi Str., Nikis Center, Office 303, 1082 Nicosia, Cyprus. Our website operates at zenokition.com. Contact: info@zenokition.com (Proton Mail, zero-access encryption).

2. What we collect — minimal by design

We build to GDPR Article 25 — data protection by design and by default: minimal collection, purpose limitation, secure by default, no excess retention. Our own website is the working example.

• Website visits: nothing automatic. The site sets no cookies, runs no tracking scripts, and does not fingerprint visitors. There is nothing to consent to and no banner.
• Contact / email: only what you choose to send us (name, company, message, contact details).
• Engagements: the data needed to deliver representation, documentation, or managed compliance services, per our service agreement.

3. No cookies

The website uses no cookies and requires none to function. No analytics scripts that track or fingerprint visitors. Privacy is by design, not by settings.

4. Email and communications

• All business email is handled by Proton Mail — end-to-end encrypted, Swiss jurisdiction, no content scanning or harvesting.
• If you are concerned about the privacy of the data you submit by email, we recommend using a VPN when emailing us at info@zenokition.com.

5. Subprocessors (processors of personal data)

Processor	Purpose	Data	Location
Proton AG (Proton Mail)	Business email hosting	Email content + metadata	Switzerland (EU adequacy)

Update rule: this list is extended before any new processor is used (e.g. web hosting, analytics). Never publish without a current list. Current web hosting (EU, Germany) serves only public static files — it is not a processor of personal data; it will be added to the list if that changes.

6. Legal basis, retention, and your rights

• Legal basis: performance of agreement, legitimate interest (responding to inquiries), consent where collected.
• Retention: only as long as the engagement (or the legal obligation) requires; minimal.
• Your GDPR rights: access, rectification, erasure, restriction, portability, objection — exercised free of charge via info@zenokition.com.
• Complaints: to the Cyprus Commissioner for Personal Data Protection, or your local supervisory authority.

7. Data transfers

The company is Cyprus-based. Our specialists are worldwide workers, and some work may be performed from locations outside the EEA — a fact we treat seriously. When EU personal data is transferred to a third country not covered by an EU adequacy decision, we rely on appropriate safeguards under GDPR Article 46 (e.g. Standard Contractual Clauses / SCCs) or an applicable derogation, and each transfer is documented.

• A Transfer Impact Assessment (TIA) is completed for each destination country, verifying that the safeguards provide essentially equivalent protection under that country’s law (the Schrems II standard) before any transfer proceeds. TIAs are kept on record and re-assessed whenever legislation affecting the destination changes.
• Proton Mail processes email in Switzerland (EU adequacy decision). Website hosting is EU-based (Germany).
• No personal data is transferred to a third country without a documented lawful basis, appropriate safeguards, and a completed TIA.

8. Changes

Changes are posted on this page; material changes are announced by email where we hold contact details.

9. Disclaimer

This policy is not legal advice. Compliance obligations vary by case — always verify with qualified counsel (“unless an exemption applies”).