Privacy Policy

The data controller responsible for your personal data is:
A. DEMS LTD
Contact for privacy requests: [email protected]

We collect only the minimum personal data needed to deliver the service. Specifically:

• Account / activation — your device ID (8-character code) and email address.
• Payment — purchase amount and order ID. Full card / PayPal details are processed by our payment providers and are never stored on our servers.
• In-app purchases — order ID, subscription status and purchase token supplied by Google Play or the App Store, solely to validate your Premium subscription. We never access your platform payment details.
• Advertising identifiers — Google AAID on Android and Apple IDFA on iOS, for mobile and tablet applications only and only for the purposes described in the mobile advertising section.
• Device identifier — used to attach your license or subscription to the relevant device.
• Technical — IP address, device type, browser type, OS/app version, language, timestamps and error logs (security and debugging only).
• Playlist data — the playlist URL or media server credentials you submit, stored encrypted on our servers and used solely to push the playlist to your device.
• Communications — content of messages you send through the contact form.

We process your data on the following bases:

• Performance of a contract (Art. 6(1)(b)) — activation, playlist management, Premium subscription validation and email confirmations.
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention and debugging.
• Legal obligation (Art. 6(1)(c)) — accounting and tax records (Cypriot law).
• Consent (Art. 6(1)(a)) — personalised advertising and advertising measurement where consent is required.

We use your personal data only to: (a) deliver the ZenTV Player service you ordered, (b) process website payments and validate in-app subscriptions through our partners, (c) send transactional emails, (d) detect and prevent fraud and abuse, (e) comply with legal obligations, and (f) display and measure advertising in the free mobile/tablet apps when permitted. We do not use your data for commercial profiling or unrelated marketing. Our website and connected-TV applications (Samsung Tizen, LG webOS, Android TV, Amazon Fire TV) contain no advertising.

The free version of ZenTV Player on mobile and tablet displays ads through Google AdMob (Google Ireland Limited). Our connected-TV applications do not display advertising.

Data processed for this purpose may include:

• the device advertising identifier (Google AAID on Android, IDFA on iOS);
• a device identifier, to attach your license or subscription to the device;
• technical and usage data such as device model, OS version, app version, approximate IP address and language.

Depending on your choice, ads may be personalised or non-personalised and their performance may be measured.

Consent. If you are in the EEA, the United Kingdom or Switzerland, we ask for your prior consent through Google's User Messaging Platform shown when the app starts. You may change or withdraw your choice at any time from the "Manage privacy choices" option in the app settings. Without consent, no personalised ads are served.

On iOS, the system may also ask for App Tracking Transparency permission. Refusing it does not prevent you from using the app.

Google information: policies.google.com/technologies/partner-sites and support.google.com/admob/answer/9012903.

The Premium subscription removes all advertising.

We share data only with the following processors, strictly for the purposes above:

• Hetzner Online GmbH (Germany / Finland) — server hosting.
• Cloudflare, Inc. (USA, with EU presence) — CDN, anti-bot protection and Turnstile captcha. Bound by Standard Contractual Clauses (SCCs) for any US transfer.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — PayPal website payments.
• MyPos AD (Bulgaria, EU) — website card payments.
• Google Ireland Limited — Google Play in-app subscriptions and Google AdMob advertising in mobile apps.
• Apple Distribution International Ltd. — App Store in-app subscriptions where the iOS app is available.
• OVH SAS (France, EU) — outgoing email (SMTP).

We do not sell your personal data.

Cloudflare, Google, Apple or their processors may process data outside the EU/EEA, including in the United States. Such transfers rely on adequacy decisions where available, the EU Commission's Standard Contractual Clauses (SCCs), or equivalent safeguards. Hosting data is stored in the EU/EEA.

You have the following rights regarding your personal data:

• Right to access (Art. 15) — get a copy of the data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17) — request deletion when no longer needed.
• Right to restriction (Art. 18) — limit processing in specific cases.
• Right to data portability (Art. 20) — receive your data in a structured machine-readable format.
• Right to object (Art. 21) — to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)) — at any time, where consent is the basis.
• Right not to be subject to automated decision-making (Art. 22) — we do not use such decision-making.

If you reside in California or another US state with comparable privacy legislation, you may have the right to know what personal data is collected, request deletion or correction, and opt out of the "sale" or "sharing" of personal data for targeted advertising.

We do not sell your personal data.

To opt out of targeted advertising, use the "Manage privacy choices" option in the app settings, reset your advertising identifier at operating-system level, or contact us at the email address in this policy.

Send your request to [email protected] with the device ID linked to your license. We respond within one month (Art. 12(3) GDPR). We may extend this period by two months for complex requests, after notifying you.

If you believe we mishandle your personal data, you have the right to lodge a complaint with the Cypriot supervisory authority: Office of the Commissioner for Personal Data Protection, 1, Iasonos Street, 1082 Nicosia, Cyprus — www.dataprotection.gov.cy. You may also complain to your local DPA in your EU country of residence.

We use industry-standard technical and organisational measures to protect your data: TLS encryption in transit, at-rest encryption of sensitive fields (AES-256-CBC), access controls, secrets stored outside the web root, request rate-limiting, anti-bot protection (Cloudflare + Turnstile), and audit logging. No method of transmission or electronic storage is 100% secure, but we apply reasonable care.

We use only strictly-necessary cookies for security (Cloudflare anti-bot) and to remember your form drafts. We do not use analytics, marketing, or tracking cookies. Therefore no consent dialog is required under GDPR/ePrivacy. A small information banner is shown on first visit; dismissing it is acknowledged but not consent (none being needed).

Our applications and services are not directed to children under 13, and we do not knowingly collect personal data from children. In the free mobile applications, advertising is served only after the consent flow described above and ad requests are flagged as not child-directed. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.

We may update this Privacy Policy occasionally. The "Last updated" date at the top reflects the most recent revision. Material changes are announced via email to active customers.

For any privacy question: [email protected], or write to A. DEMS LTD.