Privacy Policy.

1.1 This Policy applies to Dáva Zmysel's public website, Account signup and administration, billing metadata, support, demonstrations, sales and marketing, and Dáva Zmysel's own use of the platform. It also explains at a high level how Dáva Zmysel processes Customer-controlled visitor and conversion data.

1.2 This Policy does not replace a Customer's privacy or cookie notice. A Customer that installs Dáva Zmysel on its website controls its configuration and is responsible for telling visitors what it collects, selecting an appropriate lawful basis and obtaining consent where required.

1.3 In Australian terms, Dáva Zmysel is generally the organisation handling its own business information. In EU, UK and US privacy-law terms, Dáva Zmysel is generally a controller or business for that information. For Customer-controlled visitor and conversion data, Dáva Zmysel generally acts as processor, service provider or contractor under the Data Processing Agreement.

We do not intentionally collect full payment-card data, card security codes, financial account credentials, passwords, private keys or authentication tokens through tracking fields. Customers must not submit them.

• directly from you when you create an Account, request a demo, contact us, pay, submit a request or communicate with us;
• automatically from your browser or device when you use our website or platform;
• from a Customer-controlled subdomain, tracking link, Hosted Page or website snippet;
• from a Customer or its Authorised Users when they configure mappings, goals, content, spend data or integrations;
• from connected services and inbound webhooks selected by a Customer;
• from infrastructure and security providers that operate, protect or monitor the Service; and
• from public authorities or professional advisers where needed to comply with law or protect legal rights.

If you do not provide required Account, payment or contact information, we may be unable to create or administer an Account, supply the Service or respond to a request.

We do not sell or rent Customer Data, use it for third-party advertising or lead enrichment, or use it to train an AI model. We do not buy, scrape or enrich lead lists at launch.

We may create aggregated and de-identified statistics or benchmarks. We use safeguards designed to prevent identification, including removing direct identifiers, pseudonymising, aggregating across unrelated Customers, suppressing small cohorts and outliers, restricting access and prohibiting re-identification. Customers may opt out of optional cross-customer benchmarking by contacting support.

5.1 If Dáva Zmysel receives personal information from a Customer's website, campaign, integration or Hosted Page, the Customer is ordinarily responsible for the collection and determines why the information is processed. Requests about that information should first go to the relevant website operator or Customer.

5.2 Dáva Zmysel assists Customers with verified requests where required. The Account Owner may search by email or contact ID, export matched information and delete matched events. Dáva Zmysel hashes an entered email to locate a corresponding stored hash. The Customer remains responsible for verifying identity and deciding the legal response.

5.3 Dáva Zmysel does not use Customer-controlled visitor information to contact the Customer's visitors, build unrelated profiles or advertise to them. Dáva Zmysel may process minimum information for security, fraud prevention, reliability, legal compliance, billing and usage administration.

Dáva Zmysel uses cookies, browser storage, URL parameters and server-side identifiers for authentication, security, consent preferences, session continuity and first-party analytics. Our Cookie Policy describes the current categories and controls. We do not use third-party advertising pixels at launch.

On Customer websites, Dáva Zmysel can operate in explicit-consent mode so the website snippet does not set its analytics cookie or send analytics events before the Customer's consent manager calls Dáva Zmysel. The Customer controls its consent banner and configuration.

Server-side redirect routing and minimum security processing may still occur where lawful.

• the Customer and its authorised Account users;
• hosting, database, authentication, file-storage, content-delivery, security, logging, email, support and other suppliers that process information for us;
• Stripe and related payment, billing and tax service providers;
• integration providers selected by the Customer, to the extent the configuration requires an exchange of data;
• professional advisers, insurers, auditors and financing providers under confidentiality duties;
• a buyer, successor or participant in a proposed corporate transaction, subject to appropriate confidentiality and privacy safeguards;
• regulators, courts, law enforcement or other recipients where disclosure is legally required or reasonably necessary to protect rights, safety or the Service; and
• the public when a Customer intentionally publishes Hosted Page content.

Our Subprocessor List identifies providers that process Customer Data for the Service. Dáva Zmysel remains responsible for subprocessors as stated in the Data Processing Agreement.

Dáva Zmysel is based in Australia. Persistent Account and event data is intended to be stored in the European Union. Information may also be accessed from Australia and processed in the United States or other countries used by Stripe and verified service providers. Edge routing may occur near the visitor's location.

Where Australian Privacy Principle 8 applies, we take reasonable steps before disclosing personal information to an overseas recipient. Where EU or UK restricted-transfer rules apply, we use an adequacy decision or appropriate safeguards such as the 2021 EU Standard Contractual Clauses and the UK International Data Transfer Addendum, as set out in the DPA.

A Customer may separately request Account deletion. Subject to legal retention and security restrictions, Dáva Zmysel removes Customer Data from active systems within 30 days and from encrypted backups within 90 days. We may retain the minimum records required for tax, fraud, security, disputes and legal obligations.

We use technical and organisational measures designed to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. These measures include encrypted network connections, provider-managed encryption at rest, access controls, separate production environments, credential controls, logging, backup and incident-response processes.

No system is completely secure. Please report a suspected vulnerability or incident to [email protected] and do not include passwords, private keys or recovery codes.

You may request access to or correction of personal information Dáva Zmysel controls by emailing [email protected] or writing to 63A Edward Street, Pyrmont NSW 2009, Australia. You may also request deletion, restriction, objection, portability or withdrawal of consent where the applicable law gives you that right.

We may need information to verify your identity and authority. We use verification information only for that purpose. We respond within the period required by applicable law and aim to complete straightforward requests within 30 days.

For Customer-controlled visitor data, contact the website or business that collected your information. If you contact Dáva Zmysel directly, we may identify the relevant Customer where possible, refer the request to it and assist under the DPA.

We send Account, billing, security and service-administration messages where necessary. We send promotional or newsletter messages only with consent or another lawful basis. Marketing consent is separate from acceptance of the Terms.

Every marketing email includes a clear unsubscribe method. We process Australian unsubscribe requests within five working days and otherwise as soon as reasonably practicable. Necessary service, billing and security messages may continue while an Account remains active.

Dáva Zmysel Account holders must be at least 18. We do not knowingly offer Accounts to children.

A Customer may use Dáva Zmysel on a child-directed or regulated website only if it has appropriate authority, notices, lawful basis, consent and safeguards. Where personal data about children or health information will reach Dáva Zmysel, prior written approval and agreed controls are required. Other sensitive categories listed in the Acceptable Use Policy are prohibited by default.

Dáva Zmysel does not use personal information to make solely automated decisions that produce legal or similarly significant effects. Automated security, fraud or sanctions signals may support an Account restriction, but Dáva Zmysel will provide human review of a contested material decision where reasonably possible.

This section applies only to the extent the California Consumer Privacy Act or another US state privacy law applies. Depending on residence and the law, an individual may have rights to know, access, correct, delete or obtain a copy of personal information; opt out of sale, sharing, targeted advertising or certain profiling; limit specified uses of sensitive information; and appeal a denied request.

Dáva Zmysel does not sell personal information or share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics or for a purpose that requires a right to limit under the CCPA. Where applicable, we honour recognised opt-out preference signals such as Global Privacy Control for non-essential processing.

Submit a request to [email protected]. We will not discriminate against you for exercising a privacy right. An authorised agent may submit a request with proof of authority. Dáva Zmysel may direct a request concerning Customer-controlled data to the relevant Customer.

Send a privacy complaint to [email protected] or 63A Edward Street, Pyrmont NSW 2009, Australia. Include enough detail for us to understand the issue, but do not send passwords or unnecessary sensitive information. We aim to acknowledge a complaint within five business days and provide a substantive response within 30 calendar days.

If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. Depending on where you live, you may also complain to your local privacy or data-protection regulator.

We may update this Policy as our practices or laws change. We will publish a new version and effective date. We will give appropriate advance notice before a material change and seek consent where required for a new use.

• Privacy contact[email protected]
• Legal notices[email protected]
• Security reports[email protected]
• Postal address
  63A Edward Street, Pyrmont NSW 2009, Australia