Personal data
How does Zylio handle your personal data?
This policy describes the data Zylio processes as controller when you visit the www.zylio.io website, use the app.zylio.io platform or receive its services: why, on what legal basis, for how long, with whom it is shared and what your rights are. Two commitments apply to the whole platform: your data is never used to train models, and it is never shared between customers.
Controller
When you use the website or the services, and in the course of its contractual and commercial relationship with the customer on whose behalf you act, Zylio determines the means and purposes of the processing: it acts as controller.
When performing the services requested by the customer, Zylio also processes personal data concerning you on the customer’s instructions. Zylio then acts as processor, and the customer is the controller. To find out more about that processing, please contact the customer directly.
Zylio limits collection to what is necessary, in line with the data minimisation principle, and complies with the GDPR and the French Data Protection Act (Loi Informatique et Libertés).
- Company
- Registered office
- Data protection officer
- Contact for your requests
Further information about the publisher of this website is set out in the legal notice.
Data collected
On this website, the only personal data collected is the data you enter yourself in a contact form, a newsletter sign-up or a demonstration request. No field is filled in without your knowledge, and the form is only sent once your consent has been collected. The platform additionally collects the data needed for your account, your login and your use of the services.
When data is collected
- When you browse the website and interact with it: contact form, newsletter sign-up, demonstration request.
- When you register on the platform at the customer’s request, and then when you use it.
- When Zylio provides the services to the customer on whose behalf you act.
Contact form fields
Purposes, legal bases and retention periods
Zylio processes your data for the purposes set out below. For each one, the tables specify the data concerned, the legal basis that allows the processing and the retention period. None of this data is used to feed an artificial intelligence model.
When you are a visitor of the website
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Sending you Zylio’s newsletter and news | Email address | Your consent to receiving information about Zylio’s activities | Until you withdraw your consent |
| Responding to your contact requests | First and last name, company, email address, message content, attached file (optional) | Legitimate interest in responding to contact requests | 3 years from collection or from your last contact |
| Organising a demonstration of the platform at your request | Name, company, email address of the visitor and of the guests (provided by you), additional notes (optional) | Legitimate interest in managing and administering relations with prospects | 3 years from collection or from your last contact |
| Producing reports on demonstration meetings and training staff | Surname, first name, video (image and voice) | Your consent to the recording of demonstration videos | Until consent is withdrawn or, failing that, 12 months from collection |
| Measuring the website’s audience: visits, pages viewed, referrer, reading language | Cookie identifier, IP address (truncated by Google before storage), pages viewed, referrer, device and browser type | Your consent, collected through the banner shown on your first visit | Cookies: 13 months. Data in Google Analytics: the period set on the property, 14 months at most |
When you are a platform user or a customer representative
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Managing Zylio’s contractual and commercial relationship with its customer | First and last name, position, email address, telephone number | Legitimate interest in managing the contractual and commercial relationship with the customer | Up to 5 years after the end of the contractual relationship with the customer |
| Evaluating, improving and developing the services | Usage data | Legitimate interest in continually improving the services | Pseudonymised usage data: 24 months. Aggregated, non-identifying data: retained beyond that for statistical purposes |
| Identifying the people who have used the services | Connection data | Legal obligation | 1 year from collection |
| Ensuring the security of the platform and investigating fraud, infringements and abuse | Account data (email address and password), connection data, other activity-related data where applicable | Zylio’s legitimate interest in defending and preserving its rights and protecting the platform | 13 months from collection |
| Protecting the rights and interests of Zylio and third parties in the event of litigation or pre-litigation with the user or the customer | All data collected under this policy | Legitimate interest in defending and preserving Zylio’s rights | For as long as necessary to defend and assert our rights, and for the applicable limitation period |
| Meeting legal and regulatory obligations (tax regulations, requests from the authorities) | All data necessary to comply with the obligation concerned | Legal obligation | Data declared to the tax authorities: 10 years. Other data: for the period required by the applicable legal obligation |
Zylio makes no automated decisions and carries out no profiling when processing your personal data. Browsing data is also collected when you visit the website and the platform, in particular by means of cookies: see the dedicated section.
Recipients and transfers outside the EU
Your data is intended for Zylio’s use and is only accessible to staff who need to know it. Requests sent from the website forms are passed to the contact management tool used by Zylio, Brevo, then handled by the sales and pre-sales teams. Data may also be accessible to service providers acting as processors for the purposes above or for the functional and technical management of Zylio’s activities. Zylio then makes sure these recipients protect your data and that the transmission is carried out with an adequate level of security; where applicable, clauses compliant with Article 28 of the GDPR govern these relationships. In every case, data is only transmitted when necessary and justified for a specific purpose.
Processors
- Website hosting
- Platform hosting
- Payment
- Contact management
- Appointment scheduling and video conferencing
- Audience measurement
A full list of recipients is available on request from the DPO.
Transfers outside the European Economic Area
Your data may be transferred outside the European Economic Area, to a country the European Commission does not consider to provide adequate protection. In that case, Zylio implements appropriate safeguards: standard contractual clauses or the Data Privacy Framework, a transfer impact assessment and, where necessary, additional measures. Under Article 46 of the GDPR, you can obtain information about these safeguards and, where applicable, a copy, by contacting the DPO.
The website may contain links to third-party websites. When you visit them, the processing of your data is governed by their own data protection policies, which Zylio recommends you read. Zylio is not responsible for the processing carried out by these third parties.
Hosting and security
The data processed by the platform is hosted in France and encrypted end to end. Zylio implements appropriate security measures, and passwords are stored in hashed form, never in clear text.
- Certifications
- Hosting
- Encryption
- Access
- Controls
- Personal data
- Use of data
- Traceability
Cookies and audience measurement
A cookie is a small file stored by a server on your device and associated with a web domain, used to make a website work, analyse its traffic or remember your preferences.
This website sets audience measurement cookies, and only after you agree: until you have answered the banner no third-party script is loaded, and a refusal never loads one. The tool is Google Analytics 4; there are two cookies, named _ga and _ga_0ECVNMPZ5E, and their lifetime is capped at 13 months. No advertising purpose is enabled: advertising storage, data sharing with Google’s advertising services and ad personalisation all stay denied, whatever your answer.
No other cookie is set: no third-party tracker, no preference cookie. The browsing language is carried by the URL (/en/, /es/) and is not stored. Your decision itself is not a cookie: it is kept for six months in your browser’s local storage, after which the question is asked again. You can change it at any time through “Manage cookies”, at the bottom of every page; a refusal after an agreement deletes the cookies already set.
The app.zylio.io platform only uses the cookies strictly necessary for your session and the security of your account, which do not require consent.
Configuring your browser
You can configure your browser to refuse cookies automatically or to delete those already installed. The procedure depends on the browser; the help pages of the main vendors are listed below.
Your rights
The GDPR and the French Data Protection Act give you rights over the data concerning you. Conditions and limitations provided for by the regulations may apply to their exercise.
How to exercise your rights
You exercise your rights by contacting Zylio’s DPO, by email or by post, at the details given at the top of this page. Zylio responds within one month, which may be extended where the complexity or number of requests justifies it. In the event of reasonable doubt about your identity, further information may be requested.
Withdrawing your consent does not affect the lawfulness of the processing carried out before the withdrawal. You can unsubscribe from our communications at any time using the unsubscribe link in every email; where prospecting is based on Zylio’s legitimate interest, you may object at any time.
Supervisory authority
You may also lodge a complaint with the CNIL, the French supervisory authority.
Commission nationale de l’informatique et des libertés3 Place de Fontenoy
TSA 80715
75334 PARIS CEDEX 07
www.cnil.fr
Changes to this policy
Zylio may amend this policy at any time, to take account of changes to the website, to the processing carried out or to the regulatory framework. The applicable version is the one published on this page: consult it regularly to keep informed of the latest changes.
Last updated: September 2026.