Privacy Notice

Data Controller

ZLabs S.R.L., a company established in Montevideo, Uruguay, is the primary controller of the personal data described in this notice. Its affiliated companies Zimmic LLC (United States) and Zimmic E.A.S. (Paraguay) may also process personal data in the course of business, in which case this notice applies equally to them. Where Zimmic processes personal data on behalf of a customer in the course of delivering services, Zimmic acts as a processor under the applicable services agreement, and the customer's own privacy notice governs that processing.

Personal Data We Collect

• Business contact data: name, email address, phone number, company, and role, typically provided through our contact and quote forms or in the course of business.
• Inquiry data: the content of your messages, such as project descriptions and estimated budget.
• Recruitment data: information you provide when applying to work with us, such as your CV and application emails.
• Website and log data: IP address, browser type and version, pages visited, and the date, time, and duration of visits.
• Cookie and device data: identifiers set by the cookies and similar technologies described below.

Sources of Personal Data

• Directly from you, when you submit a form, email us, or communicate with us in the course of business.
• Automatically, when you browse our website.
• From business channels, such as referrals, events, or publicly available professional profiles.

Purposes of Processing

• Responding to inquiries and quote requests, and managing business relationships.
• Delivering, administering, and improving our services.
• Recruitment and evaluation of candidates.
• Operating, securing, and improving our website, including spam and abuse prevention.
• Measuring the effectiveness of our website and communications.
• Complying with legal obligations.

Legal Bases for Processing

Where applicable law requires a legal basis for processing, Zimmic relies on one or more of the following, depending on the context:

• Performance of a contract, or steps taken at your request before entering into a contract.
• Legitimate interests, such as operating and securing our website, responding to business inquiries, and improving our services.
• Consent, where required — for example, for non-essential cookies or marketing communications.
• Compliance with legal obligations.

Rights and safeguards apply according to applicable law. This notice does not assume that any single privacy regime applies in every case.

Website and Analytics Data

We use Google Tag Manager to manage the measurement tools on our website. Through it, Google Analytics 4 collects information about how visitors use the site. Our forms use Google reCAPTCHA to protect against spam and abuse. We also use the Meta Pixel, which may collect information about your device and your interactions with our website and may be used to show you relevant content on Meta platforms. Each of these providers has its own privacy policy describing how it handles data.

Cookies

Cookies and similar technologies used on this website fall into the following groups:

• Necessary: required for the website to function and to protect it from abuse (for example, reCAPTCHA on our forms).
• Functional: remember choices you make to improve your experience.
• Analytics: help us understand how the website is used (Google Analytics).
• Marketing: support measurement and relevant content on third-party platforms (Meta Pixel, and Google advertising features where active).

You can control or delete cookies through your browser settings, and opt out of certain analytics and advertising features through the tools those providers offer. Blocking some cookies may affect parts of the website.

Service Providers and Third Parties

We share personal data with service providers that support our business, only to the extent needed for them to perform their functions, and under obligations of confidentiality and data protection. These currently include:

• Salesforce, for managing business inquiries and customer relationships.
• Google, for tag management, analytics, and form protection (reCAPTCHA).
• Meta Platforms, for measurement and advertising services.
• Infrastructure providers that host our website and business systems.

We do not sell personal data.

International Data Transfers

Zimmic operates from Uruguay, the United States, and Paraguay, and personal data may be processed in any of those countries. Our service providers may also process data in other countries. Where an international transfer is subject to legal requirements, we rely on the mechanisms available under applicable law, such as contractual safeguards or the recipient's participation in recognized data protection frameworks. Safeguards apply according to applicable law.

Data Retention

We keep personal data only for as long as needed for the purposes described in this notice, including meeting legal, accounting, or contractual obligations, and then delete or anonymize it. Retention periods vary depending on the category of data and the context in which it was collected.

Security Measures

We apply technical and organizational measures designed to protect personal data, as described in our Security Overview. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Rights

Depending on your jurisdiction and according to applicable law, you may have the right to:

• Access the personal data we hold about you.
• Request rectification of inaccurate or incomplete data.
• Request erasure of your data.
• Request restriction of certain processing.
• Receive your data in a portable format.
• Object to certain processing, including for direct marketing.
• Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal.

To exercise any of these rights, contact privacy@zimmic.com. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by applicable law. You can opt out of marketing communications at any time using the unsubscribe link in our emails.

Complaints and Supervisory Authorities

If you believe our processing of your personal data does not comply with applicable law, you have the right to lodge a complaint with the supervisory authority in your jurisdiction. In Uruguay, the supervisory authority is the Unidad Reguladora y de Control de Datos Personales (URCDP). We would appreciate the opportunity to address your concerns first — please contact us before escalating.

Changes to This Notice

We may update this Privacy Notice from time to time. Changes are effective when posted on this page, and the "Last Updated" date above reflects the most recent revision. We encourage you to review this notice periodically.

Contact

For privacy questions or requests, contact privacy@zimmic.com.