1. Data Controller
2. Personal data we collect
We collect only the minimum personal data needed to deliver the service. Specifically:
- Account / activation — your device ID (8-character code) and email address.
- Payment — purchase amount and order ID. Full card / PayPal details are processed by our payment providers and are never stored on our servers.
- In-app purchases — order ID, subscription status and purchase token supplied by Google Play or the App Store, solely to validate your Premium subscription. We never access your platform payment details.
- Advertising identifiers — Google AAID on Android and Apple IDFA on iOS, for mobile and tablet applications only and only for the purposes described in the mobile advertising section.
- Device identifier — used to attach your license or subscription to the relevant device.
- Technical — IP address, device type, browser type, OS/app version, language, timestamps and error logs (security and debugging only).
- Playlist data — the playlist URL or media server credentials you submit, stored encrypted on our servers and used solely to push the playlist to your device.
- Communications — content of messages you send through the contact form.
3. Legal bases (Art. 6 GDPR)
We process your data on the following bases:
- Performance of a contract (Art. 6(1)(b)) — activation, playlist management, Premium subscription validation and email confirmations.
- Legitimate interests (Art. 6(1)(f)) — security, fraud prevention and debugging.
- Legal obligation (Art. 6(1)(c)) — accounting and tax records (Cypriot law).
- Consent (Art. 6(1)(a)) — personalised advertising and advertising measurement where consent is required.
4. Why we process your data
We use your personal data only to: (a) deliver the ZenTV Player service you ordered, (b) process website payments and validate in-app subscriptions through our partners, (c) send transactional emails, (d) detect and prevent fraud and abuse, (e) comply with legal obligations, and (f) display and measure advertising in the free mobile/tablet apps when permitted. We do not use your data for commercial profiling or unrelated marketing. Our website and connected-TV applications (Samsung Tizen, LG webOS, Android TV, Amazon Fire TV) contain no advertising.
5. Advertising in mobile applications
The free version of ZenTV Player on mobile and tablet displays ads through Google AdMob (Google Ireland Limited). Our connected-TV applications do not display advertising.
Data processed for this purpose may include:
Consent. If you are in the EEA, the United Kingdom or Switzerland, we ask for your prior consent through Google's User Messaging Platform shown when the app starts. You may change or withdraw your choice at any time from the "Manage privacy choices" option in the app settings. Without consent, no personalised ads are served.
On iOS, the system may also ask for App Tracking Transparency permission. Refusing it does not prevent you from using the app.
Google information: policies.google.com/technologies/partner-sites and support.google.com/admob/answer/9012903.
The Premium subscription removes all advertising.
Data processed for this purpose may include:
- the device advertising identifier (Google AAID on Android, IDFA on iOS);
- a device identifier, to attach your license or subscription to the device;
- technical and usage data such as device model, OS version, app version, approximate IP address and language.
Consent. If you are in the EEA, the United Kingdom or Switzerland, we ask for your prior consent through Google's User Messaging Platform shown when the app starts. You may change or withdraw your choice at any time from the "Manage privacy choices" option in the app settings. Without consent, no personalised ads are served.
On iOS, the system may also ask for App Tracking Transparency permission. Refusing it does not prevent you from using the app.
Google information: policies.google.com/technologies/partner-sites and support.google.com/admob/answer/9012903.
The Premium subscription removes all advertising.
6. Recipients & processors
We share data only with the following processors, strictly for the purposes above:
- Hetzner Online GmbH (Germany / Finland) — server hosting.
- Cloudflare, Inc. (USA, with EU presence) — CDN, anti-bot protection and Turnstile captcha. Bound by Standard Contractual Clauses (SCCs) for any US transfer.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — PayPal website payments.
- MyPos AD (Bulgaria, EU) — website card payments.
- Google Ireland Limited — Google Play in-app subscriptions and Google AdMob advertising in mobile apps.
- Apple Distribution International Ltd. — App Store in-app subscriptions where the iOS app is available.
- OVH SAS (France, EU) — outgoing email (SMTP).
7. International transfers
Cloudflare, Google, Apple or their processors may process data outside the EU/EEA, including in the United States. Such transfers rely on adequacy decisions where available, the EU Commission's Standard Contractual Clauses (SCCs), or equivalent safeguards. Hosting data is stored in the EU/EEA.
8. How long we keep data
- Account / activation — for the duration of your license + 5 years (Cypriot tax law).
- Payment and in-app purchase records — 7 years (mandatory accounting retention).
- IPN/payment logs — 90 days, then deleted.
- Technical logs — 30 days, rotated.
- Mobile advertising consent choices — for as long as needed to honour your choice, until reset/withdrawal or app data deletion.
- Contact form messages — up to 24 months after the last reply.
- Playlist data — until you delete it or the license/subscription expires.
9. Your rights under GDPR
- Erişim (Mad. 15)
- Düzeltme (Mad. 16)
- Silme (Mad. 17)
- Sınırlama (Mad. 18)
- Veri taşınabilirliği (Mad. 20)
- İtiraz (Mad. 21)
- Rızayı geri çekme (Mad. 7.3)
- Otomatik karara tabi olmama (Mad. 22) — kullanmıyoruz
10. United States residents
If you reside in California or another US state with comparable privacy legislation, you may have the right to know what personal data is collected, request deletion or correction, and opt out of the "sale" or "sharing" of personal data for targeted advertising.
We do not sell your personal data.
To opt out of targeted advertising, use the "Manage privacy choices" option in the app settings, reset your advertising identifier at operating-system level, or contact us at the email address in this policy.
We do not sell your personal data.
To opt out of targeted advertising, use the "Manage privacy choices" option in the app settings, reset your advertising identifier at operating-system level, or contact us at the email address in this policy.
11. How to exercise your rights
Talebinizi cihaz ID ile [email protected] adresine gönderin. Bir ay içinde yanıtlarız (Mad. 12.3 GDPR).
12. Right to lodge a complaint
Kıbrıs denetim kurumuna şikayette bulunabilirsiniz: Office of the Commissioner for Personal Data Protection, 1, Iasonos Street, 1082 Nicosia, Kıbrıs — www.dataprotection.gov.cy. Veya AB ikamet ülkenizdeki kuruma.
13. Security
Aktarımda TLS şifreleme, hassas veriler için AES-256-CBC, erişim denetimi, web kökü dışında sırlar, hız sınırlama, bot koruma (Cloudflare + Turnstile), denetim günlükleri.
14. Cookies
Yalnızca kesinlikle gerekli çerezler (Cloudflare bot koruma) ve form taslakları için. Analitik, pazarlama veya izleme yok. GDPR/ePrivacy kapsamında onay gerekli değil. İlk ziyarette bilgilendirme bandı görünür.
15. Children
Our applications and services are not directed to children under 13, and we do not knowingly collect personal data from children. In the free mobile applications, advertising is served only after the consent flow described above and ad requests are flagged as not child-directed. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.
16. Changes to this policy
Politikayı zaman zaman güncelleyebiliriz. Önemli değişiklikler aktif müşterilere e-posta ile bildirilir.
17. Contact
Gizlilik soruları: [email protected] veya postayla A. DEMS LTD.